Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '*MalwareBytes0' = '"%ALLUSERSPROFILE%\MalwareBytes0\acrotray.exe"'
Changes the following executable system files:
- <SYSTEM32>\mmc.exe.Pv5y7
- <SYSTEM32>\Firewall.cpl.bvIcj
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Creates and executes the following:
- '%ALLUSERSPROFILE%\MalwareBytes0\regmon.exe'
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=disable profile=all
- '<SYSTEM32>\sc.exe' config SharedAccess start= disabled
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\MalwareBytes0\regmon.exe
Sets the 'hidden' attribute to the following files:
- %ALLUSERSPROFILE%\MalwareBytes0\regmon.exe
Deletes the following files:
- <SYSTEM32>\xRQKfVRaqcUxc
- <SYSTEM32>\lmeKVxeTiuWqXkJlpJWe
Moves the following system files:
- from <SYSTEM32>\UOOFHdCOCh`iqFBQ to <SYSTEM32>\KVcNKQewloTnGUu
- from <SYSTEM32>\KVcNKQewloTnGUu to <SYSTEM32>\ndWpcKWJWvIZAxLEB
- from <SYSTEM32>\ndWpcKWJWvIZAxLEB to <SYSTEM32>\eXsFXRegtRmUzoiVm
- from <SYSTEM32>\mmc.exe.Pv5y7 to <SYSTEM32>\UOOFHdCOCh`iqFBQ
- from <SYSTEM32>\TgJTeRQRODSDLSsxEBrtX to <SYSTEM32>\CMEGZZVjemHYhHPMfHMCG
- from <SYSTEM32>\CMEGZZVjemHYhHPMfHMCG to <SYSTEM32>\lmeKVxeTiuWqXkJlpJWe
- from <SYSTEM32>\mmc.exe to <SYSTEM32>\mmc.exe.Pv5y7
- from <SYSTEM32>\eXsFXRegtRmUzoiVm to <SYSTEM32>\GoxaQsqXHYgKwHcvo
- from <SYSTEM32>\VLNPBXldCLDzP to <SYSTEM32>\zACGHHdSMIPToc
- from <SYSTEM32>\zACGHHdSMIPToc to <SYSTEM32>\dmQDwVpCoYRIuq
- from <SYSTEM32>\dmQDwVpCoYRIuq to <SYSTEM32>\xRQKfVRaqcUxc
- from <SYSTEM32>\wBxCEFGNyVmhbcrsh to <SYSTEM32>\VLNPBXldCLDzP
- from <SYSTEM32>\GoxaQsqXHYgKwHcvo to <SYSTEM32>\kuHPhLzbYwucgCT
- from <SYSTEM32>\kuHPhLzbYwucgCT to <SYSTEM32>\cLWtVMBjFdSBZLx
- from <SYSTEM32>\cLWtVMBjFdSBZLx to <SYSTEM32>\wBxCEFGNyVmhbcrsh
- from <SYSTEM32>\yKqnkMifGXFFgpGkQWzF to <SYSTEM32>\TgJTeRQRODSDLSsxEBrtX
- from <SYSTEM32>\VAdZxBAfqUotwyBlwxqw to <SYSTEM32>\PHKBURlNnjZnOlsBbixXq
- from <SYSTEM32>\PHKBURlNnjZnOlsBbixXq to <SYSTEM32>\HxjsJlqcMFdznZckbDkP
- from <SYSTEM32>\HxjsJlqcMFdznZckbDkP to <SYSTEM32>\eOxGoXqVwJwxTzXAcJobAU
- from <SYSTEM32>\ZhvAAraGfVdyIVRGeYGC to <SYSTEM32>\VAdZxBAfqUotwyBlwxqw
- from <SYSTEM32>\firewall.cpl to <SYSTEM32>\Firewall.cpl.bvIcj
- from <SYSTEM32>\Firewall.cpl.bvIcj to <SYSTEM32>\SdiFOvIzkKEoEhwdnX
- from <SYSTEM32>\SdiFOvIzkKEoEhwdnX to <SYSTEM32>\ZhvAAraGfVdyIVRGeYGC
- from <SYSTEM32>\eOxGoXqVwJwxTzXAcJobAU to <SYSTEM32>\zuozpuosLRqcoboCoLpJ
- from <SYSTEM32>\zRUtzhKbTxbykugbimCM to <SYSTEM32>\dYxJYlSAwQjQosnKnAB
- from <SYSTEM32>\dYxJYlSAwQjQosnKnAB to <SYSTEM32>\DJraSubdzOHQlVcVyFvG
- from <SYSTEM32>\DJraSubdzOHQlVcVyFvG to <SYSTEM32>\yKqnkMifGXFFgpGkQWzF
- from <SYSTEM32>\jTWqKQOWbWVnwtSBWrQ to <SYSTEM32>\zRUtzhKbTxbykugbimCM
- from <SYSTEM32>\zuozpuosLRqcoboCoLpJ to <SYSTEM32>\SkEXI@YCVPzuKXiPlknx
- from <SYSTEM32>\SkEXI@YCVPzuKXiPlknx to <SYSTEM32>\ZfOgIYQFUBcPzXmutvFqGZ
- from <SYSTEM32>\ZfOgIYQFUBcPzXmutvFqGZ to <SYSTEM32>\jTWqKQOWbWVnwtSBWrQ
Moves itself:
- from <Full path to virus> to %ALLUSERSPROFILE%\MalwareBytes0\acrotray.exe
Network activity:
Connects to:
- 'xt######igital-network.info':80
TCP:
HTTP POST requests:
- xt######igital-network.info/xpro/lod/page.php
UDP:
- DNS ASK xt######igital-network.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
