Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'B9BC6A5C' = '%APPDATA%\B9BC6A5C\bin.exe'
Malicious functions:
Executes the following:
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\cscript.exe
a large number of user processes.
Modifies file system:
Creates the following files:
- %APPDATA%\B9BC6A5C\bin.exe
- %APPDATA%\B9BC6A5C\log.dat
Network activity:
Connects to:
- 'kl###riexdmj.me':789
- 'cs####sykkrq.co.in':789
- 'cs####sykkrq.biz':789
- 'kl####iexdmj.co.in':789
- 'kl####iexdmj.biz':789
- 'kl####iexdmj.me.uk':789
- 'hf####xxssps.biz':789
- 'hf####xxssps.me.uk':789
- 'hf###nxxssps.me':789
- 'cs####sykkrq.me.uk':789
- 'cs###msykkrq.me':789
- 'hf####xxssps.co.in':789
- 'um###jynlsdg.me':789
- 'cd####rjowwt.co.in':789
- 'cd####rjowwt.biz':789
- 'um####ynlsdg.co.in':789
- 'um####ynlsdg.biz':789
- 'um####ynlsdg.me.uk':789
- 'uy####gcrrjf.biz':789
- 'uy####gcrrjf.me.uk':789
- 'uy###cgcrrjf.me':789
- 'cd####rjowwt.me.uk':789
- 'cd###krjowwt.me':789
- 'uy####gcrrjf.co.in':789
- 'hk####xexpiu.co.in':789
- 'tp####cwxome.co.in':789
- 'tp####cwxome.biz':789
- 'tp####cwxome.me.uk':789
- 'lh####vuhhcc.biz':789
- 'lh####vuhhcc.me.uk':789
- 'lh###ovuhhcc.me':789
- 'th####ejuphl.me.uk':789
- 'th###rejuphl.me':789
- 'u2####749nd7493y.cc':789
- 'tp###icwxome.me':789
- 'th####ejuphl.co.in':789
- 'th####ejuphl.biz':789
- 'fm####rhxmwm.co.in':789
- 'fm####rhxmwm.biz':789
- 'fm####rhxmwm.me.uk':789
- 'hk####xexpiu.biz':789
- 'hk####xexpiu.me.uk':789
- 'hk###exexpiu.me':789
- 'uq####owvcdd.me.uk':789
- 'uq###howvcdd.me':789
- 'lh####vuhhcc.co.in':789
- 'fm###krhxmwm.me':789
- 'uq####owvcdd.co.in':789
- 'uq####owvcdd.biz':789
UDP:
- DNS ASK kl###riexdmj.me
- DNS ASK cs####sykkrq.co.in
- DNS ASK cs####sykkrq.biz
- DNS ASK kl####iexdmj.co.in
- DNS ASK kl####iexdmj.biz
- DNS ASK kl####iexdmj.me.uk
- DNS ASK hf####xxssps.biz
- DNS ASK hf####xxssps.me.uk
- DNS ASK hf###nxxssps.me
- DNS ASK cs####sykkrq.me.uk
- DNS ASK cs###msykkrq.me
- DNS ASK hf####xxssps.co.in
- DNS ASK um###jynlsdg.me
- DNS ASK cd####rjowwt.co.in
- DNS ASK cd####rjowwt.biz
- DNS ASK um####ynlsdg.co.in
- DNS ASK um####ynlsdg.biz
- DNS ASK um####ynlsdg.me.uk
- DNS ASK uy####gcrrjf.biz
- DNS ASK uy####gcrrjf.me.uk
- DNS ASK uy###cgcrrjf.me
- DNS ASK cd####rjowwt.me.uk
- DNS ASK cd###krjowwt.me
- DNS ASK uy####gcrrjf.co.in
- DNS ASK hk####xexpiu.co.in
- DNS ASK tp####cwxome.co.in
- DNS ASK tp####cwxome.biz
- DNS ASK tp####cwxome.me.uk
- DNS ASK lh####vuhhcc.biz
- DNS ASK lh####vuhhcc.me.uk
- DNS ASK lh###ovuhhcc.me
- DNS ASK th####ejuphl.me.uk
- DNS ASK th###rejuphl.me
- DNS ASK u2####749nd7493y.cc
- DNS ASK tp###icwxome.me
- DNS ASK th####ejuphl.co.in
- DNS ASK th####ejuphl.biz
- DNS ASK fm####rhxmwm.co.in
- DNS ASK fm####rhxmwm.biz
- DNS ASK fm####rhxmwm.me.uk
- DNS ASK hk####xexpiu.biz
- DNS ASK hk####xexpiu.me.uk
- DNS ASK hk###exexpiu.me
- DNS ASK uq####owvcdd.me.uk
- DNS ASK uq###howvcdd.me
- DNS ASK lh####vuhhcc.co.in
- DNS ASK fm###krhxmwm.me
- DNS ASK uq####owvcdd.co.in
- DNS ASK uq####owvcdd.biz
