Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Control Image Gateway RPC Resource Backup' = 'C:\jid9cvvu\zno6fjuriac.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\UPnP KtmRm Foundation Experience] 'ImagePath' = 'C:\jid9cvvu\zno6fjuriac.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\UPnP KtmRm Foundation Experience] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\jid9cvvu\wtxgpfhsp.exe' "c:\jid9cvvu\zno6fjuriac.exe"
- 'C:\jid9cvvu\zno6fjuriac.exe'
- 'C:\jid9cvvu\sarbtzb2o8urcpimgaf4f.exe'
Modifies file system:
Creates the following files:
- C:\jid9cvvu\zno6fjuriac.exe
- C:\jid9cvvu\wtxgpfhsp.exe
- C:\jid9cvvu\xirxdbnvnyp
- %WINDIR%\jid9cvvu\vrpkpwfa0nkv
- C:\jid9cvvu\vrpkpwfa0nkv
- C:\jid9cvvu\sarbtzb2o8urcpimgaf4f.exe
Sets the 'hidden' attribute to the following files:
- C:\jid9cvvu\wtxgpfhsp.exe
- C:\jid9cvvu\zno6fjuriac.exe
Deletes the following files:
- C:\jid9cvvu\sarbtzb2o8urcpimgaf4f.exe
- %WINDIR%\jid9cvvu\vrpkpwfa0nkv
Network activity:
Connects to:
- 'ca#####nathompsett.net':80
- 'ca#####nesamuelson.net':80
- 'ca#####nasamuelson.net':80
- 'ca#####necristians.net':80
- 'ca#####nacristians.net':80
- 'ca#####nethompsett.net':80
- 'ma#####iancristians.net':80
- 'ki#####eethompsett.net':80
- 'ma#####ianthompsett.net':80
- 'ca#####nestevenson.net':80
- 'ca#####nastevenson.net':80
- 'ki#####eecristians.net':80
- 'an#####testevenson.net':80
- 'st#####iestevenson.net':80
- 'ch#####testevenson.net':80
- 'ma#####necristians.net':80
- 'ch#####tethompsett.net':80
- 'st#####iesamuelson.net':80
- 'ch#####tesamuelson.net':80
- 'ma#####nesamuelson.net':80
- 'an#####tesamuelson.net':80
- 'ma#####nestevenson.net':80
- 'an#####tecristians.net':80
- 'ma#####nethompsett.net':80
- 'an#####tethompsett.net':80
- 'ma#####keeccleston.net':80
- 'ze#####aheccleston.net':80
- 'ma#####kepickering.net':80
- 'ze#####ahgrenville.net':80
- 'ma#####kegeorgeson.net':80
- 'ze#####ahgeorgeson.net':80
- 'ge#####vegeorgeson.net':80
- 'je#####negeorgeson.net':80
- 'ge#####veeccleston.net':80
- 'ze#####ahpickering.net':80
- 'ge#####vegrenville.net':80
- 'je#####negrenville.net':80
- 'ma#####kegrenville.net':80
- 'ma#####ianstevenson.net':80
- 'ca#####racristians.net':80
- 'kr#####hercristians.net':80
- 'ki#####eesamuelson.net':80
- 'ma#####iansamuelson.net':80
- 'ki#####eestevenson.net':80
- 'kr#####hersamuelson.net':80
- 'ca#####rastevenson.net':80
- 'kr#####herstevenson.net':80
- 'ca#####rathompsett.net':80
- 'kr#####herthompsett.net':80
- 'ca#####rasamuelson.net':80
TCP:
HTTP GET requests:
- http://ca#####nathompsett.net/index.php
- http://ca#####nesamuelson.net/index.php
- http://ca#####nasamuelson.net/index.php
- http://ca#####necristians.net/index.php
- http://ca#####nacristians.net/index.php
- http://ca#####nethompsett.net/index.php
- http://ma#####iancristians.net/index.php
- http://ki#####eethompsett.net/index.php
- http://ma#####ianthompsett.net/index.php
- http://ca#####nestevenson.net/index.php
- http://ca#####nastevenson.net/index.php
- http://ki#####eecristians.net/index.php
- http://an#####testevenson.net/index.php
- http://st#####iestevenson.net/index.php
- http://ch#####testevenson.net/index.php
- http://ma#####necristians.net/index.php
- http://ch#####tethompsett.net/index.php
- http://st#####iesamuelson.net/index.php
- http://ch#####tesamuelson.net/index.php
- http://ma#####nesamuelson.net/index.php
- http://an#####tesamuelson.net/index.php
- http://ma#####nestevenson.net/index.php
- http://an#####tecristians.net/index.php
- http://ma#####nethompsett.net/index.php
- http://an#####tethompsett.net/index.php
- http://ma#####keeccleston.net/index.php
- http://ze#####aheccleston.net/index.php
- http://ma#####kepickering.net/index.php
- http://ze#####ahgrenville.net/index.php
- http://ma#####kegeorgeson.net/index.php
- http://ze#####ahgeorgeson.net/index.php
- http://ge#####vegeorgeson.net/index.php
- http://je#####negeorgeson.net/index.php
- http://ge#####veeccleston.net/index.php
- http://ze#####ahpickering.net/index.php
- http://ge#####vegrenville.net/index.php
- http://je#####negrenville.net/index.php
- http://ma#####kegrenville.net/index.php
- http://ma#####ianstevenson.net/index.php
- http://ca#####racristians.net/index.php
- http://kr#####hercristians.net/index.php
- http://ki#####eesamuelson.net/index.php
- http://ma#####iansamuelson.net/index.php
- http://ki#####eestevenson.net/index.php
- http://kr#####hersamuelson.net/index.php
- http://ca#####rastevenson.net/index.php
- http://kr#####herstevenson.net/index.php
- http://ca#####rathompsett.net/index.php
- http://kr#####herthompsett.net/index.php
- http://ca#####rasamuelson.net/index.php
UDP:
- DNS ASK ca#####nethompsett.net
- DNS ASK ca#####nathompsett.net
- DNS ASK ca#####nesamuelson.net
- DNS ASK an#####testevenson.net
- DNS ASK ca#####necristians.net
- DNS ASK ca#####nacristians.net
- DNS ASK ki#####eecristians.net
- DNS ASK ma#####iancristians.net
- DNS ASK ki#####eethompsett.net
- DNS ASK ca#####nasamuelson.net
- DNS ASK ca#####nestevenson.net
- DNS ASK ca#####nastevenson.net
- DNS ASK ma#####nestevenson.net
- DNS ASK ch#####tesamuelson.net
- DNS ASK st#####iestevenson.net
- DNS ASK ch#####testevenson.net
- DNS ASK st#####iethompsett.net
- DNS ASK ch#####tethompsett.net
- DNS ASK st#####iesamuelson.net
- DNS ASK an#####tethompsett.net
- DNS ASK ma#####nesamuelson.net
- DNS ASK an#####tesamuelson.net
- DNS ASK ma#####necristians.net
- DNS ASK an#####tecristians.net
- DNS ASK ma#####nethompsett.net
- DNS ASK ma#####ianthompsett.net
- DNS ASK ma#####keeccleston.net
- DNS ASK ze#####aheccleston.net
- DNS ASK ma#####kepickering.net
- DNS ASK ze#####ahgrenville.net
- DNS ASK ma#####kegeorgeson.net
- DNS ASK ze#####ahgeorgeson.net
- DNS ASK ge#####vegeorgeson.net
- DNS ASK je#####negeorgeson.net
- DNS ASK ge#####veeccleston.net
- DNS ASK ze#####ahpickering.net
- DNS ASK ge#####vegrenville.net
- DNS ASK je#####negrenville.net
- DNS ASK ma#####kegrenville.net
- DNS ASK ma#####ianstevenson.net
- DNS ASK ca#####racristians.net
- DNS ASK kr#####hercristians.net
- DNS ASK ki#####eesamuelson.net
- DNS ASK ma#####iansamuelson.net
- DNS ASK ki#####eestevenson.net
- DNS ASK kr#####hersamuelson.net
- DNS ASK ca#####rastevenson.net
- DNS ASK kr#####herstevenson.net
- DNS ASK ca#####rathompsett.net
- DNS ASK kr#####herthompsett.net
- DNS ASK ca#####rasamuelson.net
