Technical Information
Malicious functions:
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' <Current directory>\utmp\help.htm
Searches for windows to
detect analytical utilities:
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:9666'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '127.0.0.1'
- [<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1C00' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
Modifies file system:
Creates the following files:
- <Current directory>\utmp\help.htm
- %HOMEPATH%\PUTTY.RND
- <Current directory>\utmp\Hdzhjzoxpj9t0g5d
- <Current directory>\utmp\Tmfgzqzthc7b4w3v
- <Current directory>\utmp\Dpdcqogick6h8n7o
- <Current directory>\utmp\Rfebdaiwji5a3y9m
- <Current directory>\utmp\Tnyrwumjfq1a8v3f
Network activity:
Connects to:
- '74.##5.232.51':443
- '63.##3.101.38':443
- '64.##2.198.161':443
- 's3.###zonaws.com':443
- 's3#######theast-1.amazonaws.com':443
- '19#.#14.219.67':443
- '65.#9.14.19':443
- '74.##5.232.51':80
- 'ap##pot.com':443
- '65.#9.14.88':443
- '65.##.14.164':443
TCP:
HTTP GET requests:
- http://www.google.com/ via 74.##5.232.51
UDP:
- DNS ASK www.uz##gg.info
- DNS ASK s3#######theast-1.amazonaws.com
- DNS ASK s3.###zonaws.com
- DNS ASK www.sn###yq.info
- DNS ASK ap##pot.com
- DNS ASK www.google.com
- DNS ASK www.ll###efw.info
- DNS ASK google.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: '' WindowName: ''
