Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '247200fc5' = '%APPDATA%\247200fc5\7200fc51af.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\asalam.exe
- %TEMP%\rarsfx0\invoice.png
- %TEMP%\rarsfx0\tmp\zip\work\429276683.txt
- %APPDATA%\247200fc5\7200fc51af.exe
Network activity
Connects to
- 'co#####s-finance.com':80
- 'ig##ocd.com':80
- 'em######gitalmarketing.com':80
- 'ih###hat.com':80
- 'bu####sdealer.com':80
- 'bu####sdealer.com':443
TCP
HTTP POST requests
- http://as#####esigns.com.au/0rTVlG.php?d=#############
- http://co#####s-finance.com/kJsnUb.php?r=###########
- http://ig##ocd.com/rklVaO.php?d=###########
- http://em######gitalmarketing.com/09LihY.php?q=############
- http://ih###hat.com/1NEnbi.php?l=#############
- http://bu####sdealer.com/vR3BEX.php?w=###########
UDP
- DNS ASK as#####esigns.com.au
- DNS ASK va#######dispensarycoalition.ca
- DNS ASK co#####s-finance.com
- DNS ASK ig##ocd.com
- DNS ASK in#####iandomains.com
- DNS ASK em######gitalmarketing.com
- DNS ASK ih###hat.com
- DNS ASK it####shkino.org
- DNS ASK bu####sdealer.com
- DNS ASK ap###tudes.fr
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\asalam.exe'
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
