Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Controls Secondary Base Store SPP' = 'C:\zdqfqbayui\cpdpuaar.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Collector Alerts Player UPnP Key] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Collector Alerts Player UPnP Key] 'ImagePath' = 'C:\zdqfqbayui\cpdpuaar.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\zdqfqbayui\vszdgxj7ixu
- C:\zdqfqbayui\vszdgxj7ixu
- C:\zdqfqbayui\dnqx3fadjq2qvaop0t.exe
- C:\zdqfqbayui\cpdpuaar.exe
- C:\zdqfqbayui\xhqqbeox.exe
Sets the 'hidden' attribute to the following files:
- C:\zdqfqbayui\cpdpuaar.exe
- C:\zdqfqbayui\xhqqbeox.exe
Deletes the following files:
- %WINDIR%\zdqfqbayui\vszdgxj7ixu
- C:\zdqfqbayui\dnqx3fadjq2qvaop0t.exe
Substitutes the following files:
- %WINDIR%\zdqfqbayui\vszdgxj7ixu
Network activity:
Connects to:
- 'th####tcontrol.net':80
- 'ge####manfather.net':80
- 'al####yfather.net':80
- 'ge####manapple.net':80
- 'al####yapple.net':80
- 'ge####manbuilt.net':80
- 'al####ybuilt.net':80
- 'ge####mancarry.net':80
- 'al####ycarry.net':80
- 'fi###matter.net':80
- 'fo####father.net':80
- 'fo###wapple.net':80
- 'me###rapple.net':80
- 'fo###wbuilt.net':80
- 'me###rbuilt.net':80
- 'fo###wcarry.net':80
- 'me###rcarry.net':80
- 'be###father.net':80
- 'kn###father.net':80
- 'fr###carry.net':80
- 'ex####encecarry.net':80
- 'ex####encebuilt.net':80
- 'fr###built.net':80
- 'ex####enceapple.net':80
- 'wo###matter.net':80
- 'sm###matter.net':80
- 'wo###spent.net':80
- 'sm###spent.net':80
- 'wo####ogether.net':80
- 'sm####ogether.net':80
- 'wo####ontrol.net':80
- 'sm####ontrol.net':80
- 'be###apple.net':80
- 'me####father.net':80
- 'pa###matter.net':80
- 'fi###spent.net':80
- 'pa####ogether.net':80
- 'fi####ogether.net':80
- 'pa####ontrol.net':80
- 'fi####ontrol.net':80
- 'fr###father.net':80
- 'ex#####ncefather.net':80
- 'fr###apple.net':80
- 'wa####ontrol.net':80
- 'pa###spent.net':80
- 'kn###apple.net':80
TCP:
HTTP GET requests:
- http://th####tcontrol.net/index.php
- http://ge####manfather.net/index.php
- http://al####yfather.net/index.php
- http://ge####manapple.net/index.php
- http://al####yapple.net/index.php
- http://ge####manbuilt.net/index.php
- http://al####ybuilt.net/index.php
- http://ge####mancarry.net/index.php
- http://al####ycarry.net/index.php
- http://fi###matter.net/index.php
- http://fo####father.net/index.php
- http://fo###wapple.net/index.php
- http://me###rapple.net/index.php
- http://fo###wbuilt.net/index.php
- http://me###rbuilt.net/index.php
- http://fo###wcarry.net/index.php
- http://me###rcarry.net/index.php
- http://be###father.net/index.php
- http://kn###father.net/index.php
- http://fr###carry.net/index.php
- http://ex####encecarry.net/index.php
- http://ex####encebuilt.net/index.php
- http://fr###built.net/index.php
- http://ex####enceapple.net/index.php
- http://wo###matter.net/index.php
- http://sm###matter.net/index.php
- http://wo###spent.net/index.php
- http://sm###spent.net/index.php
- http://wo####ogether.net/index.php
- http://sm####ogether.net/index.php
- http://wo####ontrol.net/index.php
- http://sm####ontrol.net/index.php
- http://be###apple.net/index.php
- http://me####father.net/index.php
- http://pa###matter.net/index.php
- http://fi###spent.net/index.php
- http://pa####ogether.net/index.php
- http://fi####ogether.net/index.php
- http://pa####ontrol.net/index.php
- http://fi####ontrol.net/index.php
- http://fr###father.net/index.php
- http://ex#####ncefather.net/index.php
- http://fr###apple.net/index.php
- http://wa####ontrol.net/index.php
- http://pa###spent.net/index.php
- http://kn###apple.net/index.php
UDP:
- DNS ASK th####tcontrol.net
- DNS ASK ge####manfather.net
- DNS ASK al####yfather.net
- DNS ASK ge####manapple.net
- DNS ASK al####yapple.net
- DNS ASK ge####manbuilt.net
- DNS ASK al####ybuilt.net
- DNS ASK ge####mancarry.net
- DNS ASK al####ycarry.net
- DNS ASK fi###matter.net
- DNS ASK fo####father.net
- DNS ASK fo###wapple.net
- DNS ASK me###rapple.net
- DNS ASK fo###wbuilt.net
- DNS ASK me###rbuilt.net
- DNS ASK fo###wcarry.net
- DNS ASK me###rcarry.net
- DNS ASK be###father.net
- DNS ASK kn###father.net
- DNS ASK fr###carry.net
- DNS ASK ex####encecarry.net
- DNS ASK ex####encebuilt.net
- DNS ASK fr###built.net
- DNS ASK ex####enceapple.net
- DNS ASK wo###matter.net
- DNS ASK sm###matter.net
- DNS ASK wo###spent.net
- DNS ASK sm###spent.net
- DNS ASK wo####ogether.net
- DNS ASK sm####ogether.net
- DNS ASK wo####ontrol.net
- DNS ASK sm####ontrol.net
- DNS ASK be###apple.net
- DNS ASK me####father.net
- DNS ASK pa###matter.net
- DNS ASK fi###spent.net
- DNS ASK pa####ogether.net
- DNS ASK fi####ogether.net
- DNS ASK pa####ontrol.net
- DNS ASK fi####ontrol.net
- DNS ASK fr###father.net
- DNS ASK ex#####ncefather.net
- DNS ASK fr###apple.net
- DNS ASK wa####ontrol.net
- DNS ASK pa###spent.net
- DNS ASK kn###apple.net
Miscellaneous:
Creates and executes the following:
- 'C:\zdqfqbayui\dnqx3fadjq2qvaop0t.exe'
- 'C:\zdqfqbayui\cpdpuaar.exe'
- 'C:\zdqfqbayui\xhqqbeox.exe' "c:\zdqfqbayui\cpdpuaar.exe"
