Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Files WMI Service Acquisition' = '%APPDATA%\ikqignp\xhtlthzgmwhd.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\ikqignp\rhfanrliwmnz.exe' "%APPDATA%\ikqignp\xhtlthzgmwhd.exe"
- '%APPDATA%\ikqignp\xhtlthzgmwhd.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\ikqignp\xhtlthzgmwhd.whs2v
- %APPDATA%\ikqignp\rhfanrliwmnz.exe
- %APPDATA%\ikqignp\xhtlthzgmwhd.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\ikqignp\rhfanrliwmnz.exe
- %APPDATA%\ikqignp\xhtlthzgmwhd.exe
Network activity:
Connects to:
- 'ca####nrealize.net':80
- 're###dshore.net':80
- 'el####icshore.net':80
- 'la####ealize.net':80
- 'ca####nwritten.net':80
- 'la###dollar.net':80
- 'ca####ndollar.net':80
- 're####written.net':80
- 'el####icrealize.net':80
- 'st###tshore.net':80
- 'tr###shore.net':80
- 're####realize.net':80
- 'el####icwritten.net':80
- 're####dollar.net':80
- 'el####icdollar.net':80
- 'ni###shore.net':80
- 'de###eshore.net':80
- 'ni####ritten.net':80
- 'do####ealize.net':80
- 'ag####tdollar.net':80
- 'do###dollar.net':80
- 'ag####trealize.net':80
- 'de####written.net':80
- 'la###shore.net':80
- 'ca####nshore.net':80
- 'la####ritten.net':80
- 'de####realize.net':80
- 'ni###dollar.net':80
- 'de####dollar.net':80
- 'ni####ealize.net':80
TCP:
HTTP GET requests:
- ca####nrealize.net/forum/search.php?em#########################################
- re###dshore.net/forum/search.php?em#########################################
- el####icshore.net/forum/search.php?em#########################################
- la####ealize.net/forum/search.php?em#########################################
- ca####nwritten.net/forum/search.php?em#########################################
- la###dollar.net/forum/search.php?em#########################################
- ca####ndollar.net/forum/search.php?em#########################################
- re####written.net/forum/search.php?em#########################################
- el####icrealize.net/forum/search.php?em#########################################
- st###tshore.net/forum/search.php?em#########################################
- tr###shore.net/forum/search.php?em#########################################
- re####realize.net/forum/search.php?em#########################################
- el####icwritten.net/forum/search.php?em#########################################
- re####dollar.net/forum/search.php?em#########################################
- el####icdollar.net/forum/search.php?em#########################################
- ni###shore.net/forum/search.php?em#########################################
- de###eshore.net/forum/search.php?em#########################################
- ni####ritten.net/forum/search.php?em#########################################
- do####ealize.net/forum/search.php?em#########################################
- ag####tdollar.net/forum/search.php?em#########################################
- do###dollar.net/forum/search.php?em#########################################
- ag####trealize.net/forum/search.php?em#########################################
- de####written.net/forum/search.php?em#########################################
- la###shore.net/forum/search.php?em#########################################
- ca####nshore.net/forum/search.php?em#########################################
- la####ritten.net/forum/search.php?em#########################################
- de####realize.net/forum/search.php?em#########################################
- ni###dollar.net/forum/search.php?em#########################################
- de####dollar.net/forum/search.php?em#########################################
- ni####ealize.net/forum/search.php?em#########################################
UDP:
- DNS ASK re###dshore.net
- DNS ASK el####icshore.net
- DNS ASK re####written.net
- DNS ASK ca####nrealize.net
- DNS ASK la###dollar.net
- DNS ASK ca####ndollar.net
- DNS ASK la####ealize.net
- DNS ASK el####icwritten.net
- DNS ASK st###tshore.net
- DNS ASK tr###shore.net
- DNS ASK st####written.net
- DNS ASK el####icrealize.net
- DNS ASK re####dollar.net
- DNS ASK el####icdollar.net
- DNS ASK re####realize.net
- DNS ASK ca####nwritten.net
- DNS ASK ni###shore.net
- DNS ASK de###eshore.net
- DNS ASK ni####ritten.net
- DNS ASK do####ealize.net
- DNS ASK ag####tdollar.net
- DNS ASK do###dollar.net
- DNS ASK ag####trealize.net
- DNS ASK de####written.net
- DNS ASK la###shore.net
- DNS ASK ca####nshore.net
- DNS ASK la####ritten.net
- DNS ASK de####realize.net
- DNS ASK ni###dollar.net
- DNS ASK de####dollar.net
- DNS ASK ni####ealize.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
