Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'PSwitch' = '<Full path to file>'
Malicious functions:
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
Modifies file system:
Creates the following files:
- %TEMP%\evb1.tmp
- %TEMP%\evb2.tmp
- %TEMP%\evb3.tmp
- %APPDATA%\WNR\PSW\44F120ED19412860.tmp.2856-2860
- %TEMP%\evb4.tmp
- %TEMP%\evb5.tmp
- %TEMP%\evb6.tmp
- %APPDATA%\WNR\PSW\44F120ED19412876.tmp.2872-2876
- %APPDATA%\WNR\PSW\44F120ED19413028.tmp.2856-3028
- %ALLUSERSPROFILE%\Application Data\WNR\PSW\44F120ED19412860.tmp.2856-2860
- %APPDATA%\WNR\PSW\psw.lz.tmp.2856-2860
- %APPDATA%\WNR\PSW\44F120ED19413064.tmp.2856-3064
- %APPDATA%\WNR\PSW\proxynet.lz
- %APPDATA%\WNR\PSW\updated_proxies.ini
Deletes the following files:
- %APPDATA%\WNR\PSW\44F120ED19412860
- %TEMP%\evb1.tmp
- %TEMP%\evb2.tmp
- %TEMP%\evb3.tmp
- %APPDATA%\WNR\PSW\44F120ED19412876
- %APPDATA%\WNR\PSW\44F120ED19413028
- %ALLUSERSPROFILE%\Application Data\WNR\PSW\44F120ED19412860
- %APPDATA%\WNR\PSW\44F120ED19413064
Moves the following files:
- from %APPDATA%\WNR\PSW\44F120ED19412860.tmp.2856-2860 to %APPDATA%\WNR\PSW\44F120ED19412860
- from %APPDATA%\WNR\PSW\44F120ED19412876.tmp.2872-2876 to %APPDATA%\WNR\PSW\44F120ED19412876
- from %APPDATA%\WNR\PSW\44F120ED19413028.tmp.2856-3028 to %APPDATA%\WNR\PSW\44F120ED19413028
- from %ALLUSERSPROFILE%\Application Data\WNR\PSW\44F120ED19412860.tmp.2856-2860 to %ALLUSERSPROFILE%\Application Data\WNR\PSW\44F120ED19412860
- from %APPDATA%\WNR\PSW\psw.lz.tmp.2856-2860 to %APPDATA%\WNR\PSW\psw.lz
- from %APPDATA%\WNR\PSW\44F120ED19413064.tmp.2856-3064 to %APPDATA%\WNR\PSW\44F120ED19413064
Substitutes the following files:
- %APPDATA%\WNR\PSW\44F120ED19412860.tmp.2856-2860
- %APPDATA%\WNR\PSW\44F120ED19412860
- %APPDATA%\WNR\PSW\44F120ED19412876.tmp.2872-2876
- %APPDATA%\WNR\PSW\44F120ED19412876
- %APPDATA%\WNR\PSW\44F120ED19413028.tmp.2856-3028
- %APPDATA%\WNR\PSW\44F120ED19413028
- %ALLUSERSPROFILE%\Application Data\WNR\PSW\44F120ED19412860.tmp.2856-2860
- %ALLUSERSPROFILE%\Application Data\WNR\PSW\44F120ED19412860
- %APPDATA%\WNR\PSW\44F120ED19413064.tmp.2856-3064
- %APPDATA%\WNR\PSW\44F120ED19413064
Network activity:
Connects to:
- 'co##.##oxyswitcher.com':80
- 'localhost':3128
- '87.##5.209.168':80
- 'pr####witcher.com':80
TCP:
HTTP GET requests:
- http://co##.##oxyswitcher.com/trouble.php
- http://PR######TCHER.INTERNAL.HOST/ via localhost
- http://www.pr####witcher.com/psw_std.xml via pr####witcher.com
- http://co##.##oxyswitcher.com/script.lz
- http://co##.##oxyswitcher.com/proxies.ini
UDP:
- DNS ASK co##.##oxyswitcher.com
- DNS ASK microsoft.com
- DNS ASK www.pr####witcher.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'AdMuncherMain' WindowName: ''
Creates and executes the following:
- '<Full path to file>' A331F713F1814131A3824EA1CFD70E37
