Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f4' = '%APPDATA%\ec525f4.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f' = 'C:\ec525f4\ec525f4.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\ec525f4.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Executes the following:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %APPDATA%\ec525f4.exe
- C:\ec525f4\ec525f4.exe
Network activity:
Connects to:
- 'sa#####faototamir.com':80
- 'mo####kechar.com':80
- 'fo####nnecting.com':80
- 'vi####anservisi.com':80
- 'in####llions.com':80
- 'os####mobilien.com':80
- 'vd##58.ru':80
- 'ag####etcorp.com':80
- 'sl#.it':80
- 'sp####stache.com':80
- 'mo####fromspain.com':80
- 'al######gasurvivalgear.com':80
- 'be######osting-smart.com':80
- 'co###hep.com':80
- 'ts###dal.com':80
- 'st##ena.ru':80
- 'st####arbrand.co':80
- 've#####cipesworld.com':80
- 'un###uified.com':80
- 'pa###aina.ru':80
- 'gu####ekorasyon.com':80
- 'my####rnalip.com':80
- 'ip##ddr.es':80
- 'ni####evolved.com':80
- 'cu###yip.com':80
- 'we######ngnursesource.com':80
- 'th####meindex.com':80
- 'ho#########cocainestayinyoursystem.org':80
- 'no#####ltipropiedad.com':80
- 'mo###ser.com':80
- 'sw###babes.ru':80
- 'sh###ingcm.com':80
- 'bi####tgiveaway.com':80
- 'be###urs.com':80
TCP:
HTTP GET requests:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
HTTP POST requests:
- http://vi####anservisi.com/wp-content/themes/perspectivewp/functions/pagebuilder/functions/metaboxes/js/2.php?k=############
- http://fo####nnecting.com/wp-content/plugins/easy-contact-forms/js/tinymce/themes/advanced/skins/4.php?u=############
- http://sl#.it/wp-content/upgrade/wp-maintenance-mode.tmp/wp-maintenance-mode/assets/images/.X1-unix/de1/4.php?y=############
- http://sa#####faototamir.com/wp-content/plugins/simple-tags/assets/js/lib/jquery.autocomplete/4.php?w=############
- http://ag####etcorp.com/components/com_phocaguestbook/assets/library/standalone/HTMLPurifier/DefinitionCache/Serializer/CSS/2.php?z=############
- http://vd##58.ru/phpshop/admpanel/editor3/scripts/moz/icons/russian/5.php?p=############
- http://mo####kechar.com/fichiers/apps/files_pdfviewer/vendor/pdfjs/web/locale/my/4.php?y=############
- http://ts###dal.com/wp-content/themes/skylab/option-tree/assets/images/layout/2.php?n=############
- http://sp####stache.com/wp-content/uploads/gravity_forms/1-7a320e64883203f22a4e76de83776fc3/tmp/2.php?k=############
- http://be######osting-smart.com/wp-content/themes/blogolife/functions/be/images/icons/4.php?g=############
- http://al######gasurvivalgear.com/wp-content/plugins/js_composer/assets/lib/bower/vcIconPicker/css/4.php?k=############
- http://mo####fromspain.com/wp-content/themes/diva-final/assets/bootstrap-master/docs/examples/starter-template/4.php?a=############
- http://co###hep.com/articles/_thumbs/Images/2/3.php?s=############
- http://st####arbrand.co/wp-content/plugins/better-wp-security/modules/free/away-mode/css/smoothness/5.php?g=############
- http://st##ena.ru/wp-content/plugins/fusion-core/admin/page-builder/assets/fonts/fonts/5.php?k=############
- http://in####llions.com/wp-content/uploads/js_composer/.X1-unix/03a/2.php?c=############
- http://pa###aina.ru/wp-includes/js/tinymce/themes/advanced/skins/wp_theme/img/4.php?i=############
- http://we######ngnursesource.com/wp-content/themes/epic/inc/ReduxFramework/ReduxCore/assets/css/5.php?s=############
- http://sh###ingcm.com/wp-content/plugins/contact-form-lite/inc/css/formbuilder/vendor/fonts/3.php?s=############
- http://gu####ekorasyon.com/wp-content/themes/rttheme18/js/lightbox/img/graphics/retina/5.php?r=############
- http://ni####evolved.com/wp-content/plugins/easyblogging/themes/stripes_orange/assets/icons/theme_icons/5.php?i=############
- http://un###uified.com/wp-content/themes/flexform/includes/page-builder/composer/lib/shortcodes/3.php?k=############
- http://ve#####cipesworld.com/wp-content/plugins/ultimate-product-catalogue/PHPExcel/Classes/PHPExcel/locale/de/5.php?m=############
- http://sw###babes.ru/catalog/view/theme/beamstore/skins/store_default/Watches/js/5.php?m=############
- http://mo###ser.com/wp-content/plugins/wordpress-backup-to-dropbox/Dropbox/Dropbox/OAuth/Consumer/5.php?e=############
- http://no#####ltipropiedad.com/wp-content/plugins/security-ninja-core-scanner-addon/documentation/assets/blueprint-css/plugins/fancy-type/3.php?x=############
- http://os####mobilien.com/wp-content/themes/manchester/blueprint/extensions/options-framework/images/colorpicker/5.php?r=############
- http://th####meindex.com/wp-content/themes/ublog/options/ReduxCore/inc/validation/preg_replace/2.php?a=############
- http://be###urs.com/it/wp-content/plugins/js_composer/include/templates/params/column_offset/3.php?a=############
- http://bi####tgiveaway.com/wp-content/plugins/js_composer/inline/assets/vc/social/tw/3.php?z=############
- http://ho#########cocainestayinyoursystem.org/wp-content/plugins/backupbuddy/destinations/sftp/lib/phpseclib/File/3.php?p=############
UDP:
- DNS ASK vi####anservisi.com
- DNS ASK sa#####faototamir.com
- DNS ASK sl#.it
- DNS ASK fo####nnecting.com
- DNS ASK ag####etcorp.com
- DNS ASK in####llions.com
- DNS ASK mo####kechar.com
- DNS ASK vd##58.ru
- DNS ASK ts###dal.com
- DNS ASK be######osting-smart.com
- DNS ASK sp####stache.com
- DNS ASK pr##soya.ru
- DNS ASK al######gasurvivalgear.com
- DNS ASK st####arbrand.co
- DNS ASK co###hep.com
- DNS ASK mo####fromspain.com
- DNS ASK st##ena.ru
- DNS ASK os####mobilien.com
- DNS ASK ve#####cipesworld.com
- DNS ASK un###uified.com
- DNS ASK pa###aina.ru
- DNS ASK gu####ekorasyon.com
- DNS ASK my####rnalip.com
- DNS ASK ip##ddr.es
- DNS ASK ni####evolved.com
- DNS ASK cu###yip.com
- DNS ASK we######ngnursesource.com
- DNS ASK th####meindex.com
- DNS ASK ho#########cocainestayinyoursystem.org
- DNS ASK no#####ltipropiedad.com
- DNS ASK mo###ser.com
- DNS ASK sw###babes.ru
- DNS ASK sh###ingcm.com
- DNS ASK bi####tgiveaway.com
- DNS ASK be###urs.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
