Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AutoConfig Solutions Problem Manager Internet' = 'C:\qtcxtascgxckcgm\cwzbsblw.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Server PC User Remote Play Secondary] 'ImagePath' = 'C:\qtcxtascgxckcgm\cwzbsblw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Server PC User Remote Play Secondary] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\qtcxtascgxckcgm\jlehktf.exe' "c:\qtcxtascgxckcgm\cwzbsblw.exe"
- 'C:\qtcxtascgxckcgm\cwzbsblw.exe'
- 'C:\qtcxtascgxckcgm\cpvk2nuinzlhbjsjcg4x8.exe'
Modifies file system:
Creates the following files:
- C:\qtcxtascgxckcgm\cwzbsblw.exe
- C:\qtcxtascgxckcgm\jlehktf.exe
- C:\qtcxtascgxckcgm\vvpxgm
- %WINDIR%\qtcxtascgxckcgm\jcmsfbf1rjou
- C:\qtcxtascgxckcgm\jcmsfbf1rjou
- C:\qtcxtascgxckcgm\cpvk2nuinzlhbjsjcg4x8.exe
Sets the 'hidden' attribute to the following files:
- C:\qtcxtascgxckcgm\jlehktf.exe
- C:\qtcxtascgxckcgm\cwzbsblw.exe
Deletes the following files:
- C:\qtcxtascgxckcgm\cpvk2nuinzlhbjsjcg4x8.exe
- %WINDIR%\qtcxtascgxckcgm\jcmsfbf1rjou
Network activity:
Connects to:
- 'st####ebeyond.net':80
- 'hi####ybeyond.net':80
- 'mo####gbottom.net':80
- 'mo####gforever.net':80
- 'ra####bottom.net':80
- 'hi####yforever.net':80
- 'st####ebottom.net':80
- 'st####eforever.net':80
- 'st####ebeing.net':80
- 'hi####ybeing.net':80
- 'mi####bottom.net':80
- 'tw####bottom.net':80
- 'tw####forever.net':80
- 'tw###ebeing.net':80
- 'mi####forever.net':80
- 'mo####gbeing.net':80
- 'ra####forever.net':80
- 'ra###rbeing.net':80
- 'ra####beyond.net':80
- 'mo####gbeyond.net':80
- 'th###flower.net':80
- 'pr####tflower.net':80
- 'cl###bottom.net':80
- 'cl###being.net':80
- 'cl####orever.net':80
- 'pr####tspecial.net':80
- 'th###corner.net':80
- 'th####pecial.net':80
- 'th###minute.net':80
- 'pr####tminute.net':80
- 'am###tbeing.net':80
- 'we####rbeing.net':80
- 'we####rbeyond.net':80
- 'hi####ybottom.net':80
- 'am####beyond.net':80
- 'we####rbottom.net':80
- 'cl###beyond.net':80
- 'am####bottom.net':80
- 'am####forever.net':80
- 'we####rforever.net':80
- 'mi###ebeing.net':80
- 'se###nclose.net':80
- 'th###beyond.net':80
- 'qu###close.net':80
- 'qu###yellow.net':80
- 'se####yellow.net':80
- 'th####orever.net':80
- 'pr####tforever.net':80
- 'pr####tbeing.net':80
- 'pr####tbeyond.net':80
- 'th###being.net':80
- 'br###yellow.net':80
- 'fl###close.net':80
- 'fl###yellow.net':80
- 'fl###travel.net':80
- 'br###travel.net':80
- 'qu###travel.net':80
- 'se####travel.net':80
- 'se###nspace.net':80
- 'br###close.net':80
- 'qu###space.net':80
- 'al###being.net':80
- 'of####orever.net':80
- 'of###being.net':80
- 'of###beyond.net':80
- 'al###beyond.net':80
- 'mi####beyond.net':80
- 'tw####beyond.net':80
- 'al###bottom.net':80
- 'al####orever.net':80
- 'of###bottom.net':80
- 'co####ebeyond.net':80
- 'ch###being.net':80
- 'ch###beyond.net':80
- 'th###bottom.net':80
- 'pr####tbottom.net':80
- 'ch###bottom.net':80
- 'co####ebottom.net':80
- 'co####eforever.net':80
- 'co####ebeing.net':80
- 'ch####orever.net':80
TCP:
HTTP GET requests:
- http://st####ebeyond.net/index.php?me########
- http://hi####ybeyond.net/index.php?me########
- http://mo####gbottom.net/index.php?me########
- http://mo####gforever.net/index.php?me########
- http://ra####bottom.net/index.php?me########
- http://hi####yforever.net/index.php?me########
- http://st####ebottom.net/index.php?me########
- http://st####eforever.net/index.php?me########
- http://st####ebeing.net/index.php?me########
- http://hi####ybeing.net/index.php?me########
- http://mi####bottom.net/index.php?me########
- http://tw####bottom.net/index.php?me########
- http://tw####forever.net/index.php?me########
- http://tw###ebeing.net/index.php?me########
- http://mi####forever.net/index.php?me########
- http://mo####gbeing.net/index.php?me########
- http://ra####forever.net/index.php?me########
- http://ra###rbeing.net/index.php?me########
- http://ra####beyond.net/index.php?me########
- http://mo####gbeyond.net/index.php?me########
- http://th###flower.net/index.php?me########
- http://pr####tflower.net/index.php?me########
- http://cl###bottom.net/index.php?me########
- http://cl###being.net/index.php?me########
- http://cl####orever.net/index.php?me########
- http://pr####tspecial.net/index.php?me########
- http://th###corner.net/index.php?me########
- http://th####pecial.net/index.php?me########
- http://th###minute.net/index.php?me########
- http://pr####tminute.net/index.php?me########
- http://am###tbeing.net/index.php?me########
- http://we####rbeing.net/index.php?me########
- http://we####rbeyond.net/index.php?me########
- http://hi####ybottom.net/index.php?me########
- http://am####beyond.net/index.php?me########
- http://we####rbottom.net/index.php?me########
- http://cl###beyond.net/index.php?me########
- http://am####bottom.net/index.php?me########
- http://am####forever.net/index.php?me########
- http://we####rforever.net/index.php?me########
- http://mi###ebeing.net/index.php?me########
- http://se###nclose.net/index.php?me########
- http://th###beyond.net/index.php?me########
- http://qu###close.net/index.php?me########
- http://qu###yellow.net/index.php?me########
- http://se####yellow.net/index.php?me########
- http://th####orever.net/index.php?me########
- http://pr####tforever.net/index.php?me########
- http://pr####tbeing.net/index.php?me########
- http://pr####tbeyond.net/index.php?me########
- http://th###being.net/index.php?me########
- http://br###yellow.net/index.php?me########
- http://fl###close.net/index.php?me########
- http://fl###yellow.net/index.php?me########
- http://fl###travel.net/index.php?me########
- http://br###travel.net/index.php?me########
- http://qu###travel.net/index.php?me########
- http://se####travel.net/index.php?me########
- http://se###nspace.net/index.php?me########
- http://br###close.net/index.php?me########
- http://qu###space.net/index.php?me########
- http://al###being.net/index.php?me########
- http://of####orever.net/index.php?me########
- http://of###being.net/index.php?me########
- http://of###beyond.net/index.php?me########
- http://al###beyond.net/index.php?me########
- http://mi####beyond.net/index.php?me########
- http://tw####beyond.net/index.php?me########
- http://al###bottom.net/index.php?me########
- http://al####orever.net/index.php?me########
- http://of###bottom.net/index.php?me########
- http://co####ebeyond.net/index.php?me########
- http://ch###being.net/index.php?me########
- http://ch###beyond.net/index.php?me########
- http://th###bottom.net/index.php?me########
- http://pr####tbottom.net/index.php?me########
- http://ch###bottom.net/index.php?me########
- http://co####ebottom.net/index.php?me########
- http://co####eforever.net/index.php?me########
- http://co####ebeing.net/index.php?me########
- http://ch####orever.net/index.php?me########
UDP:
- DNS ASK st####ebeyond.net
- DNS ASK hi####ybeyond.net
- DNS ASK mo####gbottom.net
- DNS ASK mo####gforever.net
- DNS ASK ra####bottom.net
- DNS ASK hi####yforever.net
- DNS ASK st####ebottom.net
- DNS ASK st####eforever.net
- DNS ASK st####ebeing.net
- DNS ASK hi####ybeing.net
- DNS ASK mi####bottom.net
- DNS ASK tw####bottom.net
- DNS ASK tw####forever.net
- DNS ASK tw###ebeing.net
- DNS ASK mi####forever.net
- DNS ASK mo####gbeing.net
- DNS ASK ra####forever.net
- DNS ASK ra###rbeing.net
- DNS ASK ra####beyond.net
- DNS ASK mo####gbeyond.net
- DNS ASK th###flower.net
- DNS ASK pr####tflower.net
- DNS ASK cl###bottom.net
- DNS ASK cl###being.net
- DNS ASK cl####orever.net
- DNS ASK pr####tspecial.net
- DNS ASK th###corner.net
- DNS ASK th####pecial.net
- DNS ASK th###minute.net
- DNS ASK pr####tminute.net
- DNS ASK am###tbeing.net
- DNS ASK we####rbeing.net
- DNS ASK we####rbeyond.net
- DNS ASK hi####ybottom.net
- DNS ASK am####beyond.net
- DNS ASK we####rbottom.net
- DNS ASK cl###beyond.net
- DNS ASK am####bottom.net
- DNS ASK am####forever.net
- DNS ASK we####rforever.net
- DNS ASK mi###ebeing.net
- DNS ASK se###nclose.net
- DNS ASK th###beyond.net
- DNS ASK qu###close.net
- DNS ASK qu###yellow.net
- DNS ASK se####yellow.net
- DNS ASK th####orever.net
- DNS ASK pr####tforever.net
- DNS ASK pr####tbeing.net
- DNS ASK pr####tbeyond.net
- DNS ASK th###being.net
- DNS ASK br###yellow.net
- DNS ASK fl###close.net
- DNS ASK fl###yellow.net
- DNS ASK fl###travel.net
- DNS ASK br###travel.net
- DNS ASK qu###travel.net
- DNS ASK se####travel.net
- DNS ASK se###nspace.net
- DNS ASK br###close.net
- DNS ASK qu###space.net
- DNS ASK al###being.net
- DNS ASK of####orever.net
- DNS ASK of###being.net
- DNS ASK of###beyond.net
- DNS ASK al###beyond.net
- DNS ASK mi####beyond.net
- DNS ASK tw####beyond.net
- DNS ASK al###bottom.net
- DNS ASK al####orever.net
- DNS ASK of###bottom.net
- DNS ASK co####ebeyond.net
- DNS ASK ch###being.net
- DNS ASK ch###beyond.net
- DNS ASK th###bottom.net
- DNS ASK pr####tbottom.net
- DNS ASK ch###bottom.net
- DNS ASK co####ebottom.net
- DNS ASK co####eforever.net
- DNS ASK co####ebeing.net
- DNS ASK ch####orever.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
