Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Hardware Secure Credential' = '<SYSTEM32>\mdmjgdakoh.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\DNS Transfer Remote Player Awareness] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\gyuhjtadpj.exe' "<SYSTEM32>\mdmjgdakoh.exe"
- '%WINDIR%\Temp\hgbdujzr3peyhx5j.exe' -r 36922 tcp
- '%TEMP%\hgbdujzr3m5bhx5jnb1lipy.exe'
- '<SYSTEM32>\mdmjgdakoh.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\uzricyibyc\run
- <SYSTEM32>\uzricyibyc\rng
- <SYSTEM32>\uzricyibyc\cfg
- <SYSTEM32>\uzricyibyc\por
- %WINDIR%\Temp\hgbdujzr3peyhx5j.exe
- %TEMP%\hgbdujzr3m5bhx5jnb1lipy.exe
- <SYSTEM32>\uzricyibyc\tst
- <SYSTEM32>\uzricyibyc\etc
- <SYSTEM32>\gyuhjtadpj.exe
- <SYSTEM32>\mdmjgdakoh.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\gyuhjtadpj.exe
- <SYSTEM32>\mdmjgdakoh.exe
Deletes the following files:
- %WINDIR%\Temp\hgbdujzr3peyhx5j.exe
- %TEMP%\hgbdujzr3m5bhx5jnb1lipy.exe
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'sp###ill.net':80
- 'sa###ill.net':80
- 'sp###irst.net':80
- 'sa###tood.net':80
- 'up###uess.net':80
- 'wh###guess.net':80
- 'sp###tood.net':80
- 'ta###stood.net':80
- 'gl###ill.net':80
- 'ta###kill.net':80
- 'gl###tood.net':80
- 'sa###irst.net':80
- 'sp###uess.net':80
- 'sa###uess.net':80
- 'wh###first.net':80
- 'ta###fruit.net':80
- 'st###march.net':80
- 'so###first.net':80
- 'da###ekilai.com':80
- 'do####n4guia.com':80
- 'fr###secas.com':80
- 'la###onea.com':80
- 'up###ill.net':80
- 'wh###kill.net':80
- 'up###irst.net':80
- 'wh###stood.net':80
- 'ar###guess.net':80
- 'so###guess.net':80
- 'up###tood.net':80
TCP:
HTTP GET requests:
- sp###ill.net/forum/search.php?me#########################################
- sa###ill.net/forum/search.php?me#########################################
- sp###irst.net/forum/search.php?me#########################################
- sa###tood.net/forum/search.php?me#########################################
- up###uess.net/forum/search.php?me#########################################
- wh###guess.net/forum/search.php?me#########################################
- sp###tood.net/forum/search.php?me#########################################
- ta###stood.net/forum/search.php?me#########################################
- gl###ill.net/forum/search.php?me#########################################
- ta###kill.net/forum/search.php?me#########################################
- gl###tood.net/forum/search.php?me#########################################
- sa###irst.net/forum/search.php?me#########################################
- sp###uess.net/forum/search.php?me#########################################
- sa###uess.net/forum/search.php?me#########################################
- wh###first.net/forum/search.php?me#########################################
- ta###fruit.net/forum/search.php?me#########################################
- st###march.net/forum/search.php?me#########################################
- so###first.net/forum/search.php?me#########################################
- da###ekilai.com/forum/search.php?me#########################################
- do####n4guia.com/forum/search.php?me#########################################
- fr###secas.com/forum/search.php?me#########################################
- la###onea.com/forum/search.php?me#########################################
- up###ill.net/forum/search.php?me#########################################
- wh###kill.net/forum/search.php?me#########################################
- up###irst.net/forum/search.php?me#########################################
- wh###stood.net/forum/search.php?me#########################################
- ar###guess.net/forum/search.php?me#########################################
- so###guess.net/forum/search.php?me#########################################
- up###tood.net/forum/search.php?me#########################################
UDP:
- DNS ASK sp###ill.net
- DNS ASK sa###ill.net
- DNS ASK sp###irst.net
- DNS ASK sa###tood.net
- DNS ASK up###uess.net
- DNS ASK wh###guess.net
- DNS ASK sp###tood.net
- DNS ASK sa###irst.net
- DNS ASK gl###ill.net
- DNS ASK ta###kill.net
- DNS ASK gl###irst.net
- DNS ASK ta###stood.net
- DNS ASK sp###uess.net
- DNS ASK sa###uess.net
- DNS ASK gl###tood.net
- DNS ASK wh###first.net
- DNS ASK ta###fruit.net
- DNS ASK st###march.net
- DNS ASK so###first.net
- DNS ASK da###ekilai.com
- DNS ASK do####n4guia.com
- DNS ASK fr###secas.com
- DNS ASK la###onea.com
- DNS ASK up###ill.net
- DNS ASK wh###kill.net
- DNS ASK up###irst.net
- DNS ASK wh###stood.net
- DNS ASK ar###guess.net
- DNS ASK so###guess.net
- DNS ASK up###tood.net
- '23#.#55.255.250':1900
