Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PromoReg' = '<Full path to file>'
Malicious functions:
Reads files which store third party applications passwords:
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite
- %APPDATA%\Mozilla\Firefox\profiles.ini
Network activity:
Connects to:
- '86.##.232.66':80
- '13#.#60.97.80':80
- '24.##2.215.177':80
- '98.##0.42.109':80
- '71.##0.108.65':80
- '85.##0.201.16':80
- '88.##3.64.84':80
- '87.##0.104.204':80
- '84.##8.89.189':80
- '84.##1.28.19':80
- '69.##2.64.241':80
- '88.##0.111.152':80
- '85.##.178.249':80
- '99.##2.10.26':80
- '89.##1.45.99':80
- '93.##3.254.229':80
- '71.##1.41.216':80
- '77.##9.185.91':80
- '92.##4.17.83':80
TCP:
HTTP POST requests:
- http://71.##1.41.216/vunqcrdmc.htm
- http://71.##0.108.65/bxxltndrtlwq.htm
- http://69.##2.64.241/ceofpm.htm
- http://77.##9.185.91/zpbiffmubx.htm
- http://86.##.232.66/ujxu.png
- http://84.##8.89.189/pcwogqn.png
- http://85.##.178.249/qmkglifdd.htm
- http://71.##1.41.216/wdwhihuwjdm.htm
- http://92.##4.17.83/mvwrmanqciks.htm
- http://84.##8.89.189/eefxmsu.htm
- http://77.##9.185.91/yuvw.htm
- http://98.##0.42.109/oqgewxodgail.png
- http://84.##8.89.189/rnpjihvcfiv.png
- http://89.##1.45.99/atc.htm
- http://88.##0.111.152/rtah.htm
- http://71.##0.108.65/wlmvqtnwxab.htm
- http://84.##8.89.189/
- http://86.##.232.66/rqvhvlyvxlzi.png
- http://69.##2.64.241/obquu.htm
- http://99.##2.10.26/qphcajoa.htm
- http://88.##3.64.84/hygwpp.htm
- http://89.##1.45.99/vvx.htm
- http://69.##2.64.241/lbya.png
- http://84.##8.89.189/hib.htm
- http://89.##1.45.99/xfto.png
- http://69.##2.64.241/wpvx.png
- http://85.##0.201.16/bnh.png
- http://85.##0.201.16/rsbz.htm
- http://98.##0.42.109/hmbmqtctcanb.htm
- http://85.##0.201.16/ykjqtmv.htm
- http://88.##0.111.152/pljvboghbb.htm
- http://13#.#60.97.80/dqn.htm
- http://98.##0.42.109/gzpmvoozw.htm
- http://99.##2.10.26/jibrtptvx.htm
- http://98.##0.42.109/eoztheaies.png
- http://84.##1.28.19/jrmxmsxzvrpc.htm
- http://89.##1.45.99/zualtsacqe.htm
- http://84.##1.28.19/qfo.htm
- http://13#.#60.97.80/hbgxsqgu.png
- http://98.##0.42.109/rmmxihc.png
- http://87.##0.104.204/xfqbmihym.htm
- http://85.##0.201.16/lsghegpca.htm
- http://86.##.232.66/fxhijkynw.htm
- http://87.##0.104.204/oqlfith.htm
- http://88.##0.111.152/jwlk.png
- http://87.##0.104.204/zcvf.htm
- http://69.##2.64.241/zujijc.htm
- http://84.##1.28.19/xdlpubh.htm
- http://85.##.178.249/qkvsafyh.htm
- http://77.##9.185.91/ybjsywcmgzst.htm
- http://69.##2.64.241/lrl.htm
- http://89.##1.45.99/ivdvvyxi.png
- http://88.##0.111.152/osu.png
- http://85.##.178.249/sxnp.png
- http://86.##.232.66/mywpdcijxsp.htm
- http://86.##.232.66/qvhvfflyuav.htm
- http://99.##2.10.26/wkiiytxakcq.htm
- http://89.##1.45.99/tlnp.htm
- http://93.##3.254.229/iyrleys.htm
- http://86.##.232.66/
- http://88.##3.64.84/ynwgn.htm
- http://85.##0.201.16/dpvpwtjps.png
- http://88.##3.64.84/wxnkzqul.png
- http://84.##1.28.19/cltcv.png
- http://86.##.232.66/gwgs.htm
- http://99.##2.10.26/joybtast.htm
- http://13#.#60.97.80/wpqlzpxnwuh.htm
- http://85.##.178.249/xlusmglfr.png
- http://99.##2.10.26/wckeclkt.htm
- http://69.##2.64.241/nqylejtz.htm
- http://24.##2.215.177/uyytuigkwj.htm
- http://98.##0.42.109/gfpgmzao.png
- http://85.##.178.249/kik.htm
- http://71.##0.108.65/yseq.htm
- http://71.##1.41.216/bpuxzvyes.htm
- http://86.##.232.66/wxuhrilfdjg.htm
- http://84.##1.28.19/oylsdmegi.png
- http://71.##1.41.216/valfvxeticlr.png
- http://93.##3.254.229/kmaiugieeq.png
- http://93.##3.254.229/mdumkw.htm
- http://88.##3.64.84/zrxgbg.htm
- http://99.##2.10.26/oiacpswvhc.htm
- http://85.##.178.249/pxhb.png
