Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System Routing Event Authentication' = '<SYSTEM32>\ticyqkal.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Extender Client Defender Hardware Studio] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\gasitoybc.exe' "<SYSTEM32>\ticyqkal.exe"
- '%WINDIR%\Temp\jb1fdg3zj3ajx.exe' -r 49422 tcp
- '%TEMP%\jb1fdg3u48ajxegm4bzdu.exe'
- '<SYSTEM32>\ticyqkal.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\pcbhfcpqbitp\run
- <SYSTEM32>\pcbhfcpqbitp\rng
- <SYSTEM32>\pcbhfcpqbitp\cfg
- <SYSTEM32>\pcbhfcpqbitp\por
- %WINDIR%\Temp\jb1fdg3zj3ajx.exe
- %TEMP%\jb1fdg3u48ajxegm4bzdu.exe
- <SYSTEM32>\pcbhfcpqbitp\tst
- <SYSTEM32>\pcbhfcpqbitp\etc
- <SYSTEM32>\gasitoybc.exe
- <SYSTEM32>\ticyqkal.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\gasitoybc.exe
- <SYSTEM32>\ticyqkal.exe
Deletes the following files:
- %WINDIR%\Temp\jb1fdg3zj3ajx.exe
- <DRIVERS>\etc\hosts
- %TEMP%\jb1fdg3u48ajxegm4bzdu.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'fe###ctober.net':80
- 'lo###ctober.net':80
- 'fe###oon.net':80
- 'lo###hoe.net':80
- 'hi###uter.net':80
- 'wh###uter.net':80
- 'fe###hoe.net':80
- 'th####ctober.net':80
- 'th###moon.net':80
- 'th###outer.net':80
- 'th###shoe.net':80
- 'lo###oon.net':80
- 'fe###uter.net':80
- 'lo###uter.net':80
- 'wh###oon.net':80
- 'ta###fruit.net':80
- 'st###march.net':80
- 'ju###oon.net':80
- 'da###ekilai.com':80
- 'do####n4guia.com':80
- 'fr###secas.com':80
- 'la###onea.com':80
- 'hi###ctober.net':80
- 'wh###ctober.net':80
- 'hi###oon.net':80
- 'wh###hoe.net':80
- 'mo###uter.net':80
- 'ju###uter.net':80
- 'hi###hoe.net':80
TCP:
HTTP GET requests:
- fe###ctober.net/forum/search.php?me#########################################
- lo###ctober.net/forum/search.php?me#########################################
- fe###oon.net/forum/search.php?me#########################################
- lo###hoe.net/forum/search.php?me#########################################
- hi###uter.net/forum/search.php?me#########################################
- wh###uter.net/forum/search.php?me#########################################
- fe###hoe.net/forum/search.php?me#########################################
- th####ctober.net/forum/search.php?me#########################################
- th###moon.net/forum/search.php?me#########################################
- th###outer.net/forum/search.php?me#########################################
- th###shoe.net/forum/search.php?me#########################################
- lo###oon.net/forum/search.php?me#########################################
- fe###uter.net/forum/search.php?me#########################################
- lo###uter.net/forum/search.php?me#########################################
- wh###oon.net/forum/search.php?me#########################################
- ta###fruit.net/forum/search.php?me#########################################
- st###march.net/forum/search.php?me#########################################
- ju###oon.net/forum/search.php?me#########################################
- da###ekilai.com/forum/search.php?me#########################################
- do####n4guia.com/forum/search.php?me#########################################
- fr###secas.com/forum/search.php?me#########################################
- la###onea.com/forum/search.php?me#########################################
- hi###ctober.net/forum/search.php?me#########################################
- wh###ctober.net/forum/search.php?me#########################################
- hi###oon.net/forum/search.php?me#########################################
- wh###hoe.net/forum/search.php?me#########################################
- mo###uter.net/forum/search.php?me#########################################
- ju###uter.net/forum/search.php?me#########################################
- hi###hoe.net/forum/search.php?me#########################################
UDP:
- DNS ASK fe###ctober.net
- DNS ASK lo###ctober.net
- DNS ASK fe###oon.net
- DNS ASK lo###hoe.net
- DNS ASK hi###uter.net
- DNS ASK wh###uter.net
- DNS ASK fe###hoe.net
- DNS ASK lo###oon.net
- DNS ASK th###moon.net
- DNS ASK th###outer.net
- DNS ASK dr###shoe.net
- DNS ASK th####ctober.net
- DNS ASK fe###uter.net
- DNS ASK lo###uter.net
- DNS ASK th###shoe.net
- DNS ASK wh###oon.net
- DNS ASK ta###fruit.net
- DNS ASK st###march.net
- DNS ASK ju###oon.net
- DNS ASK da###ekilai.com
- DNS ASK do####n4guia.com
- DNS ASK fr###secas.com
- DNS ASK la###onea.com
- DNS ASK hi###ctober.net
- DNS ASK wh###ctober.net
- DNS ASK hi###oon.net
- DNS ASK wh###hoe.net
- DNS ASK mo###uter.net
- DNS ASK ju###uter.net
- DNS ASK hi###hoe.net
- '23#.#55.255.250':1900
