Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Update' = '%APPDATA%\Isass.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Isass.exe' /AutoIt3ExecuteScript "%TEMP%\delphi.dat"
- '%APPDATA%\Isass.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /C echo. > "%APPDATA%\Isass.exe":Zone.Identifier
Modifies file system:
Creates the following files:
- %APPDATA%\Isass.exe
- %APPDATA%\07E721AE1943BE7380C25530D4BE8A21
- %APPDATA%\Isass.exe:Zone.Identifier
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\redpirate[1].php
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\google[1]
- %TEMP%\pdata.dat
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\delphi.dat
- %TEMP%\delphi.bin
Deletes the following files:
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
Network activity:
Connects to:
- 're####rdpirates.com':80
- '74.##5.232.51':80
TCP:
HTTP GET requests:
- http://re####rdpirates.com/redpirate.php?p=#################################################################################################################
- http://google.com/ via 74.##5.232.51
UDP:
- DNS ASK re####rdpirates.com
- DNS ASK google.com
