Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Discovery Netlogon Performance' = 'C:\mdisxndhwrig\huvbwx42y.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\PNRP Defender RPC Client] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\PNRP Defender RPC Client] 'ImagePath' = 'C:\mdisxndhwrig\huvbwx42y.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\mdisxndhwrig\tybfrdx
- C:\mdisxndhwrig\tybfrdx
- C:\mdisxndhwrig\vgngji37y1idvq06lxlrj.exe
- C:\mdisxndhwrig\huvbwx42y.exe
- C:\mdisxndhwrig\gqe46ihh.exe
- C:\mdisxndhwrig\nv9cwuzlf
Sets the 'hidden' attribute to the following files:
- C:\mdisxndhwrig\huvbwx42y.exe
- C:\mdisxndhwrig\gqe46ihh.exe
Deletes the following files:
- %WINDIR%\mdisxndhwrig\tybfrdx
- C:\mdisxndhwrig\vgngji37y1idvq06lxlrj.exe
Substitutes the following files:
- %WINDIR%\mdisxndhwrig\tybfrdx
Network activity:
Connects to:
- 'ch#####anmichelyne.net':80
- 'ch#####nekingsley.net':80
- 'sh#####lekingsley.net':80
- 'ch#####neanastasia.net':80
- 'sh#####leanastasia.net':80
- 'ch#####neandriana.net':80
- 'sh#####leandriana.net':80
- 'ar#####ldcharnette.net':80
- 'za#####ahcharnette.net':80
- 'ar#####ldkingsley.net':80
- 'za#####ahkingsley.net':80
- 'ar#####ldanastasia.net':80
- 'ar#####ldandriana.net':80
- 'an#####lekingsley.net':80
- 'za#####ahandriana.net':80
- 'ge#####nacharnette.net':80
- 'ch#####lecharnette.net':80
- 'ge#####nakingsley.net':80
- 'ch#####lekingsley.net':80
- 'ge#####naanastasia.net':80
- 'ch#####leanastasia.net':80
- 'ge#####naandriana.net':80
- 'ch#####leandriana.net':80
- 'an#####lecharnette.net':80
- 'gu#####encharnette.net':80
- 'sh#####lecharnette.net':80
- 'za#####ahanastasia.net':80
- 'ch#####necharnette.net':80
- 'al#####racharnette.net':80
- 'gw#####retatianna.net':80
- 'ch#####antatianna.net':80
- 'ka#####necharnette.net':80
- 'al#####ercharnette.net':80
- 'ka#####nekingsley.net':80
- 'al#####erkingsley.net':80
- 'ka#####neanastasia.net':80
- 'al#####eranastasia.net':80
- 'ka#####neandriana.net':80
- 'al#####erandriana.net':80
- 'ma#####nacharnette.net':80
- 'ma#####nakingsley.net':80
- 'am#####neandriana.net':80
- 'al#####rakingsley.net':80
- 'ma#####naanastasia.net':80
- 'al#####raanastasia.net':80
- 'ma#####naandriana.net':80
- 'al#####raandriana.net':80
- 'am#####necharnette.net':80
- 'ce#####necharnette.net':80
- 'am#####nekingsley.net':80
- 'ce#####nekingsley.net':80
- 'am#####neanastasia.net':80
- 'ce#####neanastasia.net':80
- 'ce#####neandriana.net':80
- 'gu#####enkingsley.net':80
TCP:
HTTP GET requests:
- http://ch#####anmichelyne.net/index.php
- http://ch#####nekingsley.net/index.php
- http://sh#####lekingsley.net/index.php
- http://ch#####neanastasia.net/index.php
- http://sh#####leanastasia.net/index.php
- http://ch#####neandriana.net/index.php
- http://sh#####leandriana.net/index.php
- http://ar#####ldcharnette.net/index.php
- http://za#####ahcharnette.net/index.php
- http://ar#####ldkingsley.net/index.php
- http://za#####ahkingsley.net/index.php
- http://ar#####ldanastasia.net/index.php
- http://ar#####ldandriana.net/index.php
- http://an#####lekingsley.net/index.php
- http://za#####ahandriana.net/index.php
- http://ge#####nacharnette.net/index.php
- http://ch#####lecharnette.net/index.php
- http://ge#####nakingsley.net/index.php
- http://ch#####lekingsley.net/index.php
- http://ge#####naanastasia.net/index.php
- http://ch#####leanastasia.net/index.php
- http://ge#####naandriana.net/index.php
- http://ch#####leandriana.net/index.php
- http://an#####lecharnette.net/index.php
- http://gu#####encharnette.net/index.php
- http://sh#####lecharnette.net/index.php
- http://za#####ahanastasia.net/index.php
- http://ch#####necharnette.net/index.php
- http://al#####racharnette.net/index.php
- http://gw#####retatianna.net/index.php
- http://ch#####antatianna.net/index.php
- http://ka#####necharnette.net/index.php
- http://al#####ercharnette.net/index.php
- http://ka#####nekingsley.net/index.php
- http://al#####erkingsley.net/index.php
- http://ka#####neanastasia.net/index.php
- http://al#####eranastasia.net/index.php
- http://ka#####neandriana.net/index.php
- http://al#####erandriana.net/index.php
- http://ma#####nacharnette.net/index.php
- http://ma#####nakingsley.net/index.php
- http://am#####neandriana.net/index.php
- http://al#####rakingsley.net/index.php
- http://ma#####naanastasia.net/index.php
- http://al#####raanastasia.net/index.php
- http://ma#####naandriana.net/index.php
- http://al#####raandriana.net/index.php
- http://am#####necharnette.net/index.php
- http://ce#####necharnette.net/index.php
- http://am#####nekingsley.net/index.php
- http://ce#####nekingsley.net/index.php
- http://am#####neanastasia.net/index.php
- http://ce#####neanastasia.net/index.php
- http://ce#####neandriana.net/index.php
- http://gu#####enkingsley.net/index.php
UDP:
- DNS ASK ch#####anmichelyne.net
- DNS ASK ch#####neanastasia.net
- DNS ASK sh#####leanastasia.net
- DNS ASK ch#####neandriana.net
- DNS ASK sh#####leandriana.net
- DNS ASK ar#####ldcharnette.net
- DNS ASK za#####ahcharnette.net
- DNS ASK ar#####ldkingsley.net
- DNS ASK za#####ahkingsley.net
- DNS ASK ar#####ldanastasia.net
- DNS ASK za#####ahanastasia.net
- DNS ASK ch#####nekingsley.net
- DNS ASK sh#####lekingsley.net
- DNS ASK ar#####ldandriana.net
- DNS ASK ch#####lecharnette.net
- DNS ASK ge#####nakingsley.net
- DNS ASK ch#####lekingsley.net
- DNS ASK ge#####naanastasia.net
- DNS ASK ch#####leanastasia.net
- DNS ASK ge#####naandriana.net
- DNS ASK ch#####leandriana.net
- DNS ASK an#####lecharnette.net
- DNS ASK gu#####encharnette.net
- DNS ASK an#####lekingsley.net
- DNS ASK za#####ahandriana.net
- DNS ASK ge#####nacharnette.net
- DNS ASK sh#####lecharnette.net
- DNS ASK ch#####necharnette.net
- DNS ASK ce#####neandriana.net
- DNS ASK ch#####antatianna.net
- DNS ASK ka#####necharnette.net
- DNS ASK al#####ercharnette.net
- DNS ASK ka#####nekingsley.net
- DNS ASK al#####erkingsley.net
- DNS ASK ka#####neanastasia.net
- DNS ASK al#####eranastasia.net
- DNS ASK ka#####neandriana.net
- DNS ASK al#####erandriana.net
- DNS ASK ma#####nacharnette.net
- DNS ASK al#####racharnette.net
- DNS ASK gw#####retatianna.net
- DNS ASK ma#####nakingsley.net
- DNS ASK ma#####naanastasia.net
- DNS ASK al#####raanastasia.net
- DNS ASK ma#####naandriana.net
- DNS ASK al#####raandriana.net
- DNS ASK am#####necharnette.net
- DNS ASK ce#####necharnette.net
- DNS ASK am#####nekingsley.net
- DNS ASK ce#####nekingsley.net
- DNS ASK am#####neanastasia.net
- DNS ASK ce#####neanastasia.net
- DNS ASK am#####neandriana.net
- DNS ASK al#####rakingsley.net
- DNS ASK gu#####enkingsley.net
- DNS ASK an#####leanastasia.net
Miscellaneous:
Creates and executes the following:
- 'C:\mdisxndhwrig\vgngji37y1idvq06lxlrj.exe'
- 'C:\mdisxndhwrig\huvbwx42y.exe'
- 'C:\mdisxndhwrig\gqe46ihh.exe' "c:\mdisxndhwrig\huvbwx42y.exe"
