Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinHTTP BitLocker Diagnostic WLAN' = 'C:\ynygugjjfzg\pqtezhcrn.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Manager CardSpace Publication] 'ImagePath' = 'C:\ynygugjjfzg\pqtezhcrn.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Manager CardSpace Publication] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\ynygugjjfzg\nnkzywbgfs.exe' "c:\ynygugjjfzg\pqtezhcrn.exe"
- 'C:\ynygugjjfzg\pqtezhcrn.exe'
- 'C:\ynygugjjfzg\ad2mhwmnp4uwjdqsc.exe'
Modifies file system:
Creates the following files:
- C:\ynygugjjfzg\pqtezhcrn.exe
- C:\ynygugjjfzg\nnkzywbgfs.exe
- C:\ynygugjjfzg\ad2mhwmnp4uwjdqsc.exe
- %WINDIR%\ynygugjjfzg\rcfhuq
- C:\ynygugjjfzg\rcfhuq
Sets the 'hidden' attribute to the following files:
- C:\ynygugjjfzg\nnkzywbgfs.exe
- C:\ynygugjjfzg\pqtezhcrn.exe
Deletes the following files:
- C:\ynygugjjfzg\ad2mhwmnp4uwjdqsc.exe
- %WINDIR%\ynygugjjfzg\rcfhuq
Substitutes the following files:
- %WINDIR%\ynygugjjfzg\rcfhuq
Network activity:
Connects to:
- 'st####further.net':80
- 'el####iccompany.net':80
- 're####company.net':80
- 'tr###cover.net':80
- 'st###tcover.net':80
- 'tr####urther.net':80
- 'el####icbecome.net':80
- 'el####icfurther.net':80
- 're####further.net':80
- 'ca####ncompany.net':80
- 're####become.net':80
- 'el####iccover.net':80
- 're###dcover.net':80
- 'st####become.net':80
- 'be####company.net':80
- 'ga####become.net':80
- 'be####become.net':80
- 'br####urther.net':80
- 'fl####urther.net':80
- 'ga####company.net':80
- 'ga###rcover.net':80
- 'tr####ompany.net':80
- 'st####company.net':80
- 'tr###become.net':80
- 'be###rcover.net':80
- 'ga####further.net':80
- 'be####further.net':80
- 'do###become.net':80
- 'ag####tbecome.net':80
- 'do###cover.net':80
- 'ni####urther.net':80
- 'do####ompany.net':80
- 'ag####tcompany.net':80
- 'ag####tcover.net':80
- 'qu###govern.net':80
- 'se####enough.net':80
- 'qu###enough.net':80
- 'do####urther.net':80
- 'ag####tfurther.net':80
- 'se####govern.net':80
- 'de####further.net':80
- 'ca####ncover.net':80
- 'la###cover.net':80
- 'ca####nfurther.net':80
- 'la####ompany.net':80
- 'ca####nbecome.net':80
- 'la###become.net':80
- 'la####urther.net':80
- 'ni###become.net':80
- 'de###ecover.net':80
- 'ni###cover.net':80
- 'de####company.net':80
- 'ni####ompany.net':80
- 'de####become.net':80
TCP:
HTTP GET requests:
- http://st####further.net/index.php
- http://el####iccompany.net/index.php
- http://re####company.net/index.php
- http://tr###cover.net/index.php
- http://st###tcover.net/index.php
- http://tr####urther.net/index.php
- http://el####icbecome.net/index.php
- http://el####icfurther.net/index.php
- http://re####further.net/index.php
- http://ca####ncompany.net/index.php
- http://re####become.net/index.php
- http://el####iccover.net/index.php
- http://re###dcover.net/index.php
- http://st####become.net/index.php
- http://be####company.net/index.php
- http://ga####become.net/index.php
- http://be####become.net/index.php
- http://br####urther.net/index.php
- http://fl####urther.net/index.php
- http://ga####company.net/index.php
- http://ga###rcover.net/index.php
- http://tr####ompany.net/index.php
- http://st####company.net/index.php
- http://tr###become.net/index.php
- http://be###rcover.net/index.php
- http://ga####further.net/index.php
- http://be####further.net/index.php
- http://do###become.net/index.php
- http://ag####tbecome.net/index.php
- http://do###cover.net/index.php
- http://ni####urther.net/index.php
- http://do####ompany.net/index.php
- http://ag####tcompany.net/index.php
- http://ag####tcover.net/index.php
- http://qu###govern.net/index.php
- http://se####enough.net/index.php
- http://qu###enough.net/index.php
- http://do####urther.net/index.php
- http://ag####tfurther.net/index.php
- http://se####govern.net/index.php
- http://de####further.net/index.php
- http://ca####ncover.net/index.php
- http://la###cover.net/index.php
- http://ca####nfurther.net/index.php
- http://la####ompany.net/index.php
- http://ca####nbecome.net/index.php
- http://la###become.net/index.php
- http://la####urther.net/index.php
- http://ni###become.net/index.php
- http://de###ecover.net/index.php
- http://ni###cover.net/index.php
- http://de####company.net/index.php
- http://ni####ompany.net/index.php
- http://de####become.net/index.php
UDP:
- DNS ASK tr####urther.net
- DNS ASK st####further.net
- DNS ASK el####iccompany.net
- DNS ASK st####become.net
- DNS ASK tr###cover.net
- DNS ASK st###tcover.net
- DNS ASK re####company.net
- DNS ASK re###dcover.net
- DNS ASK el####icfurther.net
- DNS ASK re####further.net
- DNS ASK el####icbecome.net
- DNS ASK re####become.net
- DNS ASK el####iccover.net
- DNS ASK tr###become.net
- DNS ASK ga####company.net
- DNS ASK be####company.net
- DNS ASK ga####become.net
- DNS ASK fl###cover.net
- DNS ASK br####urther.net
- DNS ASK fl####urther.net
- DNS ASK be####become.net
- DNS ASK be####further.net
- DNS ASK tr####ompany.net
- DNS ASK st####company.net
- DNS ASK ga###rcover.net
- DNS ASK be###rcover.net
- DNS ASK ga####further.net
- DNS ASK ca####ncompany.net
- DNS ASK do###become.net
- DNS ASK ag####tbecome.net
- DNS ASK do###cover.net
- DNS ASK ni####urther.net
- DNS ASK do####ompany.net
- DNS ASK ag####tcompany.net
- DNS ASK ag####tcover.net
- DNS ASK qu###govern.net
- DNS ASK se####enough.net
- DNS ASK qu###enough.net
- DNS ASK do####urther.net
- DNS ASK ag####tfurther.net
- DNS ASK se####govern.net
- DNS ASK de####further.net
- DNS ASK ca####ncover.net
- DNS ASK la###cover.net
- DNS ASK ca####nfurther.net
- DNS ASK la####ompany.net
- DNS ASK ca####nbecome.net
- DNS ASK la###become.net
- DNS ASK la####urther.net
- DNS ASK ni###become.net
- DNS ASK de###ecover.net
- DNS ASK ni###cover.net
- DNS ASK de####company.net
- DNS ASK ni####ompany.net
- DNS ASK de####become.net
