Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\Inst_Rep.job
Malicious functions:
Creates and executes the following:
- '%TEMP%\Install_15256\ins_ytd.exe' /S
- '%TEMP%\Install_15256\ins_smk.exe' /S /db=all /is=1 /ih=1 /sparam=FAAzamodk0,99999999-9999-4701-a288-6cd564063837, /urlset=searching /aff=amodk0_0_0_0_0,99999999-9999-4701-a288-6cd564063837, /rnd=5778
- '%TEMP%\Install_15256\ins_U501EXE.exe' s=FAAzamodk0,99999999-9999-4701-a288-6cd564063837 /dochr /doexp /domoz /nodel
- '%TEMP%\Install_15256\ins_smk.exe' (downloaded from the Internet)
- '%TEMP%\Install_15256\ins_U501EXE.exe' (downloaded from the Internet)
- '%TEMP%\Install_15256\ins_ytd.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %TEMP%\Install_15256\ins_U501EXE.exe
- %TEMP%\Install_15256\ins_ytd.exe
- %TEMP%\Install_15256\ins_smk.exe
- <LS_APPDATA>\Installer\Install_30266\<Virus name>.exe
- <LS_APPDATA>\Installer\Install_27498\<Virus name>.exe
- %TEMP%\Install_15256\bxsdk32.dll
Deletes the following files:
- %WINDIR%\Tasks\Inst_Rep.job
Network activity:
Connects to:
- 'd1#######fj8ag.cloudfront.net':80
- '2b########-1ghhyl1c.netdna-ssl.com':80
- 'd1#######zti92.cloudfront.net':80
- '6b########7q8a7h8.netdna-ssl.com':80
- 'g4########c7q8a7h8.netdna-ssl.com':80
- 'dy#######h76q.cloudfront.net':80
TCP:
HTTP GET requests:
- http://d1#######fj8ag.cloudfront.net/SetterExeV18.exe
- http://2b########-1ghhyl1c.netdna-ssl.com/YTDownloaderFull.exe
- http://d1#######zti92.cloudfront.net/smw121634dp.exe
- http://dy#######h76q.cloudfront.net/bxsdk32.dll
- http://6b########7q8a7h8.netdna-ssl.com/23030.ashx?e=############################################################################################################################################...
- http://6b########7q8a7h8.netdna-ssl.com/5778.ashx?e=#############################################################################################################################################...
- http://g4########c7q8a7h8.netdna-ssl.com/t.ashx?e=###############################################################################################################################################...
UDP:
- DNS ASK d1#######fj8ag.cloudfront.net
- DNS ASK 2b########-1ghhyl1c.netdna-ssl.com
- DNS ASK d1#######zti92.cloudfront.net
- DNS ASK 6b########7q8a7h8.netdna-ssl.com
- DNS ASK g4########c7q8a7h8.netdna-ssl.com
- DNS ASK dy#######h76q.cloudfront.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'SB_download_btn' WindowName: 'SB Download Button'
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'chrome.exe' WindowName: ''
