Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'gipychagcasp' = '%HOMEPATH%\gipychagcasp.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\merck[1].htm
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\4c458dc3-6380-41a7-9009-e409170c25af
- %HOMEPATH%\gipychagcasp.exe
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\09fd881e-862b-48cd-a90a-4d582c9075fd
Network activity:
Connects to:
- 'al###-dsl.de':25
- 'mc####onhboc.com':25
- 'me##k.com':80
- 'nf#.com':25
- 'ho##ail.com':25
- 'mv##le.edu':25
- 'lc##pa.com':25
- 'ju##i.dk':25
- 'ga####inriver.net':25
TCP:
HTTP POST requests:
- me##k.com/
UDP:
- DNS ASK de###bosf.kz
- DNS ASK as##.com
- DNS ASK ba##ctor.us
- DNS ASK ao#.de
- DNS ASK vo###one.com
- DNS ASK em###msn.com
- DNS ASK ra##tar.com
- DNS ASK me##om.com
- DNS ASK mu###asosr.kz
- DNS ASK ch###ensys.com
- DNS ASK ca###line.org
- DNS ASK ex##te.com
- DNS ASK me##o.net
- DNS ASK ke###vuzloda.kz
- DNS ASK wi###tream.net
- DNS ASK bi##s.com
- DNS ASK gu###muvo.kz
- DNS ASK ca###n.com.mx
- DNS ASK po#####nmitsubishi.com
- DNS ASK ne###zomih.kz
- DNS ASK ca###.gov.br
- DNS ASK ma###rent.com
- DNS ASK nc###e.net.au
- DNS ASK be####fuldecay.com
- DNS ASK ca###ina.com
- DNS ASK da##t.com
- DNS ASK vi###t.com.mx
- DNS ASK te##her.com
- DNS ASK zd###mail.com
- DNS ASK ei##om.net
- DNS ASK sp##y.se
- DNS ASK li##ro.it
- DNS ASK gr##.com
- DNS ASK xi###ladgusi.kz
- DNS ASK yo##ube.com
- DNS ASK na##r.com
- DNS ASK li##one.net
- DNS ASK ma##.#arthlink.net
- DNS ASK jm#.edu
- DNS ASK ga###peed.com
- DNS ASK je###tmoharo.kz
- DNS ASK ax##ero.hu
- DNS ASK cr###paths.net
- DNS ASK bl###planet.com
- DNS ASK hu#.com
- DNS ASK ya###.com.cn
- DNS ASK mw##.co.za
- DNS ASK wo###-net.co.nz
- DNS ASK ms#.edu
- DNS ASK ol##iss.edu
- DNS ASK re####onsearch.com
- DNS ASK sp###tmail.com
- DNS ASK ao#.com
- DNS ASK va###net.com
- DNS ASK ac####endlease.com
- DNS ASK ca####-systems.com
- DNS ASK bo###efixim.kz
- DNS ASK mo###ainmax.net
- DNS ASK sh###dvare.com
- DNS ASK ly##hta.org
- DNS ASK cb###ted.com
- DNS ASK ag##ent.com
- DNS ASK co##ast.net
- DNS ASK so##h.net
- DNS ASK mi####ryofsound.net
- DNS ASK ho####do-this.com
- DNS ASK ca###ail.com
- DNS ASK mi##47.com
- DNS ASK so#.dk
- DNS ASK ma##id.com
- DNS ASK ba####egifford.com
- DNS ASK pt.lu
- DNS ASK ju##i.dk
- DNS ASK nf#.com
- DNS ASK mc####onhboc.com
- DNS ASK ho##ail.com
- DNS ASK lc##pa.com
- DNS ASK mv##le.edu
- DNS ASK ga####inriver.net
- DNS ASK dr##el.edu
- DNS ASK pg#.com
- DNS ASK ta###bay.rr.com
- DNS ASK va##ine.com
- DNS ASK al###-dsl.de
- DNS ASK me##k.com
- DNS ASK in#.net
- DNS ASK ew#.edu
- DNS ASK ho##ale.com
- DNS ASK vo#.com
- DNS ASK rc#.com
- DNS ASK tx##ate.edu
- DNS ASK co###oweb.com
- DNS ASK te##ett.com
- DNS ASK ia.##lecom.net
- DNS ASK my##ace.com
- DNS ASK ti###s-net.com
- DNS ASK va##.com
- DNS ASK zo###own.com
- DNS ASK nu###focibim.kz
- DNS ASK ne###ape.net
- DNS ASK o2.pl
- DNS ASK bu####andbumble.com
- DNS ASK wi###rmere.com
- DNS ASK va####efreaks.com
- DNS ASK up##nk.net
- DNS ASK vu###rkuz.kz
- DNS ASK wo####nline.co.uk
- DNS ASK fr###burg.edu
- DNS ASK ht##mp.net
- DNS ASK ve##zon.net
- DNS ASK ca###rande.com
- DNS ASK sa####goinsider.com
- DNS ASK sp##.com
- DNS ASK al###ream.net
- DNS ASK fo###dihija.kz
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
