Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinInit' = '<LS_APPDATA>\Packages\utorrentie.exe'
Modifies file system:
Creates the following files:
- %TEMP%\is-LF4TT.tmp\<File name>.tmp
- %TEMP%\is-NMNMO.tmp\<File name>.tmp
- <LS_APPDATA>\Packages\is-7RFST.tmp
- <LS_APPDATA>\Packages\is-K4O4T.tmp
Deletes the following files:
- %TEMP%\is-LF4TT.tmp\<File name>.tmp
- %TEMP%\is-NMNMO.tmp\<File name>.tmp
Moves the following files:
- from <LS_APPDATA>\Packages\is-7RFST.tmp to <LS_APPDATA>\Packages\utorrentie.exe
- from <LS_APPDATA>\Packages\is-K4O4T.tmp to <LS_APPDATA>\Packages\utorrentie.exe.config
Network activity:
Connects to:
- 'wp#d':80
- 'ms#####.#ion.feralhosting.com':80
- 'ms#####.#allas.feralhosting.com':80
- '18#.#5.48.68':80
- 'pa###bin.com':80
- '20#.#6.232.182':443
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://ms#####.#ion.feralhosting.com/3753f9ba56bb6017239d22387fc53035
- http://ms#####.#ion.feralhosting.com/4a8774400e6d2e209109d021a74e2d3c
- http://ms#####.#allas.feralhosting.com/034220e27f40d14d8012c43e0cf0e841
- http://ms#####.#allas.feralhosting.com/b9e6dd4de7f79fa37836774d2474253c
- http://18#.#5.48.68/02ed55faea5d1d2b1490e78da30da107/5fc741325308c0e741e9509ed5d
- http://18#.#5.48.68/02ed55faea5d1d2b1490e78da30da107/fc324f595608bf3e9809c401917f9a6900977
- http://pa###bin.com/raw/h5yBCwpY
- http://pa###bin.com/raw/HNkipzLK
- http://pa###bin.com/raw/qdwMGvDS
- http://pa###bin.com/raw/Vf81BwHn
- http://pa###bin.com/raw/Z3mcNqjz
- http://pa###bin.com/raw/u66uXYRh
- http://ms#####.#allas.feralhosting.com/zm.zip
- http://ms#####.#ion.feralhosting.com/zm.zip
- http://18#.#5.48.68/02ed55faea5d1d2b1490e78da30da107/zm.zip
UDP:
- DNS ASK wp#d
- DNS ASK ms#####.#ion.feralhosting.com
- DNS ASK ms#####.#allas.feralhosting.com
- DNS ASK pa###bin.com
- DNS ASK download.microsoft.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\is-LF4TT.tmp\<File name>.tmp' /SL5="$30092,244006,122880,<Full path to file>"
- '<Full path to file>' /VERYSILENT /NORESTARTAPPLICATIONS /NOFORCECLOSEAPPLICATIONS /NOCLOSEAPPLICATIONS
- '%TEMP%\is-NMNMO.tmp\<File name>.tmp' /SL5="$30094,244006,122880,<Full path to file>" /VERYSILENT /NORESTARTAPPLICATIONS /NOFORCECLOSEAPPLICATIONS /NOCLOSEAPPLICATIONS
- '<LS_APPDATA>\Packages\utorrentie.exe'
