Technical Information
To ensure autorun and distribution
Changes the following executable system files
- <SYSTEM32>\comctl32.ocx
- <SYSTEM32>\comdlg32.ocx
- <SYSTEM32>\msinet.ocx
Modifies file system
Creates the following files
- <DRIVERS>\etc\hosts.ics
- %TEMP%\etilqs_8w6a5e8ocbszaqf
Deletes the following files
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity
TCP
HTTP GET requests
- http://ci######ongans.blogspot.com/
- http://3.##.#logspot.com/-3ypydr9U3DI/U9DHOBQy-vI/AAAAAAAAAbs/hvhfDPIpevI/s1600/share.png
- http://pe#######n-cits.blogspot.com/2015/09/undefined
- http://www.bl##ger.com/comment-iframe.g?bl###########################################################################
- http://3.##.#logspot.com/-3UcLXxRcetg/WaTYDnjaJbI/AAAAAAAADt0/LL7OaZTjsE4hTzpKkm-Jj55c8JI4SZBhQCK4BGAYYCw/s1600/head-back.jpg
- http://4.##.#logspot.com/-U2FiDOW13h8/WaUuGbhbUpI/AAAAAAAADuQ/-tZACcQo3hYxUbXIe30RUfEMtIInpeiHACK4BGAYYCw/s1600/header-mask.png
- http://4.##.#logspot.com/-Tev2WNGyFs8/WaUuh31ZVRI/AAAAAAAADuY/5D9_uZ3rgrY9cVKC46DXxPMlXlxCOmB4gCK4BGAYYCw/s1600/sg-back.jpg
- http://ma####.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=#####
- http://c.##sco.re/
- http://go.##btrks.com/notice.php?p=######################
- http://ma####.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css
- http://www.bl##ger.com/comment-iframe.g?bl##################################################################################
- http://6.##sco.re/
- http://se###.popads.net/c?_=#####################################################################################################################################################################...
- http://do##hen.com/apu.php?zo############
- http://my.##mark.net/img.gif?f=#############################################
- http://www.ci###atis.com/
- http://2.##.#logspot.com/-eXDzvmiaYcc/VktrFQnAsPI/AAAAAAAAGJQ/ECTgSNQKlzs/s1600/siminihome.png
- http://pl######97.puserving.com/0c/eb/c2/0cebc208e531c6b4761e5d1bb6afa0d0.js
- http://3.##.#logspot.com/-NN3Axwd3gjc/WaUv1CODCDI/AAAAAAAADvE/vyiHmT0rl98F-ZTqYB0xmst60IHuVFmxQCK4BGAYYCw/s1600/team_3.jpg
- http://pu###est.com/ntfc.php?p=#######
- http://www.ci###atis.com/favicon.ico
- http://www.ci####alongan.com/js/cookienotice.js
- http://ci#####iss.blogspot.com/
- http://pe#######n-cits.blogspot.com/2015/09/error-file.html
- http://www.ci####alongan.com/
- http://pe#######n-cits.blogspot.com/favicon.ico
- http://pe#######n-cits.blogspot.com/feeds/posts/default/-/Error%20File?al#########################################################
- http://aj##.#oogleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js
- http://pe#######n-cits.blogspot.com/js/cookienotice.js
- http://www.ci####alongan.com/favicon.ico
- http://ma####.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
- http://1.##.#logspot.com/-P1UCUBWGCMU/WaUv1CxF6kI/AAAAAAAADvM/aOSCRX-UHAwKF8EFs20fqryoqDNa3DJQwCK4BGAYYCw/s1600/team_1.jpg
- http://cd#.##nearicons.com/free/1.0.0/icon-font.min.css
- http://4.##.#logspot.com/-JbKcdfpLIpY/VGPWTO9Us7I/AAAAAAAAA9g/WT3xvYm_J28/s1600/btp.png
- http://1.##.#logspot.com/-5aYbXTaUxvU/WaUpd8qmbfI/AAAAAAAADuE/SzqpbJ8DJkM8tEF1S-PNYPL0Gx6oaMmjwCK4BGAYYCw/s1600/Basil.png
- http://1.##.#logspot.com/-zjRQwZusQuA/WaUu4AM9p_I/AAAAAAAADug/68l5-04iSWoVMAkpi8iQGM430fUYKAzdACK4BGAYYCw/s400/128.jpg
- http://4.##.#logspot.com/-B1N0s6e1Y90/WaUvFDHMc7I/AAAAAAAADuo/5L4qayXHNiAWVAgZhTRhJ7S2VSAL-E-3QCK4BGAYYCw/s400/128%2B%25281%2529.jpg
- http://www.ci###atis.com/js/cookienotice.js
- http://do##hen.com/fac.php
- http://1.##.#logspot.com/--AljITWu1is/WaUvSgSDbEI/AAAAAAAADuw/5FZ7WobSdtAVINLVQT3qpCSktRNlDA23gCK4BGAYYCw/s400/128.jpg
- http://1.##.#logspot.com/-lS8BCMfild4/WaUv1I0ZzxI/AAAAAAAADvI/TRbkU8DD6qAMXTEciXxlZXakbMGB29xWQCK4BGAYYCw/s1600/team_2.jpg
- http://c1.##pads.net/pop.js
HTTP POST requests
- http://ad##o.re/t
- http://ad##o.re/p
UDP
- DNS ASK ci######ongans.blogspot.com
- DNS ASK fo###.gstatic.com
- DNS ASK my.##mark.net
- DNS ASK c1.##pads.net
- DNS ASK st#####x.facebook.com
- DNS ASK fa###ook.com
- DNS ASK re#####es.blogblog.com
- DNS ASK 3.##.#logspot.com
- DNS ASK accounts.google.com
- DNS ASK 6.##sco.re
- DNS ASK od#####lr0mq.l.adsco.re
- DNS ASK od#####lr0mq.n.adsco.re
- DNS ASK od#####lr0mq.s.adsco.re
- DNS ASK google.com
- DNS ASK c.##sco.re
- DNS ASK ad##o.re
- DNS ASK 4.##.#logspot.com
- DNS ASK cd#.##nearicons.com
- DNS ASK 1.##.#logspot.com
- DNS ASK pe#######n-cits.blogspot.com
- DNS ASK ci###atis.com
- DNS ASK ci####alongan.com
- DNS ASK bl##ger.com
- DNS ASK ma####.bootstrapcdn.com
- DNS ASK aj##.#oogleapis.com
- DNS ASK ci#####iss.blogspot.com
- DNS ASK pl######97.puserving.com
- DNS ASK pu###est.com
- DNS ASK go.##btrks.com
- DNS ASK 2.##.#logspot.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK co#####.facebook.net
- DNS ASK do##hen.com
- DNS ASK fi#######torage.googleapis.com
- DNS ASK se###.popads.net
- DNS ASK sc#######amt2-1.xx.fbcdn.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc\hosts /reset' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc\hosts.ics /reset' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc\hosts /reset
- '<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc\hosts.ics /reset
- '%ProgramFiles%\mozilla firefox\firefox.exe' -osint -url "http://ci######ongans.blogspot.com/"
- '%ProgramFiles%\mozilla firefox\firefox.exe' -osint -url "http://ci#####iss.blogspot.com/"
- '%ProgramFiles%\mozilla firefox\firefox.exe' -osint -url "http://pe#######n-cits.blogspot.com/2015/09/error-file.html"
