Installation
This threat is based on an HTML file that redirects you to a compromised site to steal your sensitive information. In this example, the redirection links are:
- hxxp://integritycounselingministries.com/wpmail.php/
- hxxp://37.153.97.16/bopl/b.php
This threat can create files on your PC, including:
-
%LOCALAPPDATA%\microsoft\internet explorer\recovery\active\{85fb0cbf-2e2c-11e4-8379-00db7fa21001}.dat
-
%LOCALAPPDATA%\microsoft\internet explorer\recovery\active\recoverystore.{7e44f1a8-2e2c-11e4-8379-00db7fa21001}.dat
It can make various registry changes during its installation, including:
In subkey: HKLM\software\classes\typelib\{1ea4dbf0-3c3b-11cf-810c-00aa00389b71}\1.1\0\win32
Sets value: "(default)"
With data: "<system folder>\oleacc.dll"
Payload
Steals your sensitive information
This threat can steal your sensitive information, such as your user names and passwords for:
- Email or social media websites
- Banking websites
- Online games
Connects to a remote host
We have seen this threat connect to a remote host, including:
- bancopostaonline.poste.it using port 443
- www.poste.it using port 443
- www.live.com using port 80
Malware can connect to a remote host to do any of the following:
- Check for an Internet connection
- Download and run files (including updates or other malware)
- Report a new infection to its author
- Receive configuration or other data
- Receive instructions from a malicious hacker
- Search for your PC location
- Upload information taken from your PC
- Validate a digital certificate
We have seen this threat access online content, including:
Additional information
Creates a mutex
This threat can create one or more mutexes on your PC. For example:
- ConnHashTable<2224>_HashTable_Mutex
- Local\!BrowserEmulation!SharedMemory!Mutex
- Local\c:!documents and settings!administrator!local settings!application data!microsoft!feeds cache!
- Local\Feed Arbitration Shared Memory Mutex [ User : S-1-5-21-1844237615-2111687655-839522115-500 ]
- Local\Feed Eventing Shared Memory Mutex S-1-5-21-1844237615-2111687655-839522115-500
- Local\Feeds Store Mutex S-1-5-21-1844237615-2111687655-839522115-500
- Local\RSS Eventing Connection Database Mutex 000008b0
It might use this mutex as an infection marker to prevent more than one copy of the threat running on your PC.
This malware description was published using automated analysis of file SHA1 3b703c44716cb20d5909fb61dd1eb4953d081886.
