Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Logon Play Biometric ActiveX' = '%APPDATA%\cnqdfllzmznxcsl\cfntajrbc.exe'
Malicious functions:
Executes the following:
- '%APPDATA%\cnqdfllzmznxcsl\atuctpff.exe' "%APPDATA%\cnqdfllzmznxcsl\cfntajrbc.exe"
- '%APPDATA%\cnqdfllzmznxcsl\cfntajrbc.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\cnqdfllzmznxcsl\cfntajrbc.dkb
- %APPDATA%\cnqdfllzmznxcsl\atuctpff.exe
- %APPDATA%\cnqdfllzmznxcsl\cfntajrbc.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\cnqdfllzmznxcsl\atuctpff.exe
- %APPDATA%\cnqdfllzmznxcsl\cfntajrbc.exe
Network activity:
Connects to:
- 'de####partial.net':80
- 'st####thnumber.net':80
- 'pr####epartial.net':80
- 'pr####estrike.net':80
- 'de####strike.net':80
- 'st###number.net':80
- 'st###strike.net':80
- 'st####thpartial.net':80
- 'st####thstrike.net':80
- 'st#####hposition.net':80
- 'st####osition.net':80
- 'de####position.net':80
- 're####position.net':80
- 'br####strike.net':80
- 'br####position.net':80
- 'br####number.net':80
- 're####number.net':80
- 're####strike.net':80
- 'de####number.net':80
- 'pr####eposition.net':80
- 'pr####enumber.net':80
- 'br####partial.net':80
- 're####partial.net':80
TCP:
HTTP GET requests:
- http://de####partial.net/forum/search.php?em#######################################
- http://st####thnumber.net/forum/search.php?em#######################################
- http://pr####epartial.net/forum/search.php?em#######################################
- http://pr####estrike.net/forum/search.php?em#######################################
- http://de####strike.net/forum/search.php?em#######################################
- http://st###number.net/forum/search.php?em#######################################
- http://st###strike.net/forum/search.php?em#######################################
- http://st####thpartial.net/forum/search.php?em#######################################
- http://st####thstrike.net/forum/search.php?em#######################################
- http://st#####hposition.net/forum/search.php?em#######################################
- http://st####osition.net/forum/search.php?em#######################################
- http://de####position.net/forum/search.php?em#######################################
- http://re####position.net/forum/search.php?em#######################################
- http://br####strike.net/forum/search.php?em#######################################
- http://br####position.net/forum/search.php?em#######################################
- http://br####number.net/forum/search.php?em#######################################
- http://re####number.net/forum/search.php?em#######################################
- http://re####strike.net/forum/search.php?em#######################################
- http://de####number.net/forum/search.php?em#######################################
- http://pr####eposition.net/forum/search.php?em#######################################
- http://pr####enumber.net/forum/search.php?em#######################################
- http://br####partial.net/forum/search.php?em#######################################
- http://re####partial.net/forum/search.php?em#######################################
UDP:
- DNS ASK de####partial.net
- DNS ASK st####thnumber.net
- DNS ASK pr####epartial.net
- DNS ASK pr####estrike.net
- DNS ASK de####strike.net
- DNS ASK st###number.net
- DNS ASK st###strike.net
- DNS ASK st####thpartial.net
- DNS ASK st####thstrike.net
- DNS ASK st#####hposition.net
- DNS ASK st####osition.net
- DNS ASK de####position.net
- DNS ASK re####position.net
- DNS ASK br####strike.net
- DNS ASK br####position.net
- DNS ASK br####number.net
- DNS ASK re####number.net
- DNS ASK re####strike.net
- DNS ASK de####number.net
- DNS ASK pr####eposition.net
- DNS ASK pr####enumber.net
- DNS ASK br####partial.net
- DNS ASK re####partial.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
