Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SSDP Awareness Studio PnP-X' = 'C:\jqcyuddmenmkuu\eqxwfydd.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Workstation Enumerator Tracking] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\jqcyuddmenmkuu\auvmlkh.exe' "c:\jqcyuddmenmkuu\eqxwfydd.exe"
- 'C:\jqcyuddmenmkuu\eqxwfydd.exe'
- 'C:\jqcyuddmenmkuu\p8oec37lggheikpdx9alql.exe'
Modifies file system :
Creates the following files:
- C:\jqcyuddmenmkuu\eqxwfydd.exe
- C:\jqcyuddmenmkuu\auvmlkh.exe
- C:\jqcyuddmenmkuu\x6lxabemewf
- %WINDIR%\jqcyuddmenmkuu\qf6sbwgtqmg
- C:\jqcyuddmenmkuu\qf6sbwgtqmg
- C:\jqcyuddmenmkuu\p8oec37lggheikpdx9alql.exe
Sets the 'hidden' attribute to the following files:
- C:\jqcyuddmenmkuu\auvmlkh.exe
- C:\jqcyuddmenmkuu\eqxwfydd.exe
Deletes the following files:
- C:\jqcyuddmenmkuu\p8oec37lggheikpdx9alql.exe
- %WINDIR%\jqcyuddmenmkuu\qf6sbwgtqmg
Network activity:
Connects to:
- 'cr####ondition.net':80
- 'th####tnation.net':80
- 'su####condition.net':80
- 'su####please.net':80
- 'cr###please.net':80
- 'th####tplease.net':80
- 'wa###please.net':80
- 'wa####oldier.net':80
- 'wa###nation.net':80
- 'th####tsoldier.net':80
- 'kn###please.net':80
- 'be####ondition.net':80
- 'be###please.net':80
- 'be####oldier.net':80
- 'kn####oldier.net':80
- 'su####soldier.net':80
- 'cr####oldier.net':80
- 'cr###nation.net':80
- 'kn####ondition.net':80
- 'su####nation.net':80
- 'th#####condition.net':80
- 'pa###please.net':80
- 'fi###please.net':80
- 'fi####oldier.net':80
- 'fi###nation.net':80
- 'pa####oldier.net':80
- 'ex#####ncecentury.net':80
- 'fr###famous.net':80
- 'fr####entury.net':80
- 'pa####ondition.net':80
- 'fi####ondition.net':80
- 'wo####oldier.net':80
- 'sm####oldier.net':80
- 'sm###nation.net':80
- 'wa####ondition.net':80
- 'wo###nation.net':80
- 'sm####ondition.net':80
- 'pa###nation.net':80
- 'wo####ondition.net':80
- 'wo###please.net':80
- 'sm###please.net':80
- 'kn###nation.net':80
- 'fi###people.net':80
- 'pa####aughter.net':80
- 'pa###people.net':80
- 'pa###brown.net':80
- 'fi###brown.net':80
- 'fr####oldier.net':80
- 'ex#####ncesoldier.net':80
- 'ex#####ncenation.net':80
- 'fi####aughter.net':80
- 'fr###nation.net':80
- 'sm###brown.net':80
- 'wo###people.net':80
- 'wo###brown.net':80
- 'wo###ready.net':80
- 'sm###ready.net':80
- 'pa###ready.net':80
- 'fi###ready.net':80
- 'sm####aughter.net':80
- 'sm###people.net':80
- 'wo####aughter.net':80
- 'fr###please.net':80
- 'fo####soldier.net':80
- 'me####soldier.net':80
- 'me####nation.net':80
- 'al#####condition.net':80
- 'fo####nation.net':80
- 'me####condition.net':80
- 'be###nation.net':80
- 'fo####condition.net':80
- 'fo####please.net':80
- 'me####please.net':80
- 'ge####mannation.net':80
- 'al####ynation.net':80
- 'ex#####ncecondition.net':80
- 'ex#####nceplease.net':80
- 'fr####ondition.net':80
- 'al####yplease.net':80
- 'ge#####ancondition.net':80
- 'ge####manplease.net':80
- 'ge#####ansoldier.net':80
- 'al####ysoldier.net':80
TCP:
HTTP GET requests:
- http://cr####ondition.net/index.php?me########
- http://th####tnation.net/index.php?me########
- http://su####condition.net/index.php?me########
- http://su####please.net/index.php?me########
- http://cr###please.net/index.php?me########
- http://th####tplease.net/index.php?me########
- http://wa###please.net/index.php?me########
- http://wa####oldier.net/index.php?me########
- http://wa###nation.net/index.php?me########
- http://th####tsoldier.net/index.php?me########
- http://kn###please.net/index.php?me########
- http://be####ondition.net/index.php?me########
- http://be###please.net/index.php?me########
- http://be####oldier.net/index.php?me########
- http://kn####oldier.net/index.php?me########
- http://su####soldier.net/index.php?me########
- http://cr####oldier.net/index.php?me########
- http://cr###nation.net/index.php?me########
- http://kn####ondition.net/index.php?me########
- http://su####nation.net/index.php?me########
- http://th#####condition.net/index.php?me########
- http://pa###please.net/index.php?me########
- http://fi###please.net/index.php?me########
- http://fi####oldier.net/index.php?me########
- http://fi###nation.net/index.php?me########
- http://pa####oldier.net/index.php?me########
- http://ex#####ncecentury.net/index.php?me########
- http://fr###famous.net/index.php?me########
- http://fr####entury.net/index.php?me########
- http://pa####ondition.net/index.php?me########
- http://fi####ondition.net/index.php?me########
- http://wo####oldier.net/index.php?me########
- http://sm####oldier.net/index.php?me########
- http://sm###nation.net/index.php?me########
- http://wa####ondition.net/index.php?me########
- http://wo###nation.net/index.php?me########
- http://sm####ondition.net/index.php?me########
- http://pa###nation.net/index.php?me########
- http://wo####ondition.net/index.php?me########
- http://wo###please.net/index.php?me########
- http://sm###please.net/index.php?me########
- http://kn###nation.net/index.php?me########
- http://fi###people.net/index.php?me########
- http://pa####aughter.net/index.php?me########
- http://pa###people.net/index.php?me########
- http://pa###brown.net/index.php?me########
- http://fi###brown.net/index.php?me########
- http://fr####oldier.net/index.php?me########
- http://ex#####ncesoldier.net/index.php?me########
- http://ex#####ncenation.net/index.php?me########
- http://fi####aughter.net/index.php?me########
- http://fr###nation.net/index.php?me########
- http://sm###brown.net/index.php?me########
- http://wo###people.net/index.php?me########
- http://wo###brown.net/index.php?me########
- http://wo###ready.net/index.php?me########
- http://sm###ready.net/index.php?me########
- http://pa###ready.net/index.php?me########
- http://fi###ready.net/index.php?me########
- http://sm####aughter.net/index.php?me########
- http://sm###people.net/index.php?me########
- http://wo####aughter.net/index.php?me########
- http://fr###please.net/index.php?me########
- http://fo####soldier.net/index.php?me########
- http://me####soldier.net/index.php?me########
- http://me####nation.net/index.php?me########
- http://al#####condition.net/index.php?me########
- http://fo####nation.net/index.php?me########
- http://me####condition.net/index.php?me########
- http://be###nation.net/index.php?me########
- http://fo####condition.net/index.php?me########
- http://fo####please.net/index.php?me########
- http://me####please.net/index.php?me########
- http://ge####mannation.net/index.php?me########
- http://al####ynation.net/index.php?me########
- http://ex#####ncecondition.net/index.php?me########
- http://ex#####nceplease.net/index.php?me########
- http://fr####ondition.net/index.php?me########
- http://al####yplease.net/index.php?me########
- http://ge#####ancondition.net/index.php?me########
- http://ge####manplease.net/index.php?me########
- http://ge#####ansoldier.net/index.php?me########
- http://al####ysoldier.net/index.php?me########
UDP:
- DNS ASK th####tnation.net
- DNS ASK wa###nation.net
- DNS ASK cr####ondition.net
- DNS ASK cr###please.net
- DNS ASK su####condition.net
- DNS ASK wa###please.net
- DNS ASK th#####condition.net
- DNS ASK th####tplease.net
- DNS ASK th####tsoldier.net
- DNS ASK wa####oldier.net
- DNS ASK su####please.net
- DNS ASK kn###please.net
- DNS ASK be####ondition.net
- DNS ASK be###please.net
- DNS ASK be####oldier.net
- DNS ASK kn####oldier.net
- DNS ASK su####soldier.net
- DNS ASK cr####oldier.net
- DNS ASK cr###nation.net
- DNS ASK kn####ondition.net
- DNS ASK su####nation.net
- DNS ASK fi###please.net
- DNS ASK pa####ondition.net
- DNS ASK pa###please.net
- DNS ASK pa####oldier.net
- DNS ASK fi####oldier.net
- DNS ASK fr###famous.net
- DNS ASK ex#####ncefamous.net
- DNS ASK ex#####ncecentury.net
- DNS ASK fi####ondition.net
- DNS ASK fr####entury.net
- DNS ASK fi###nation.net
- DNS ASK wo####oldier.net
- DNS ASK sm####oldier.net
- DNS ASK sm###nation.net
- DNS ASK wa####ondition.net
- DNS ASK wo###nation.net
- DNS ASK sm####ondition.net
- DNS ASK pa###nation.net
- DNS ASK wo####ondition.net
- DNS ASK wo###please.net
- DNS ASK sm###please.net
- DNS ASK pa####aughter.net
- DNS ASK fi####aughter.net
- DNS ASK fi###people.net
- DNS ASK fi###brown.net
- DNS ASK pa###people.net
- DNS ASK ex#####ncesoldier.net
- DNS ASK fr###please.net
- DNS ASK fr####oldier.net
- DNS ASK fr###nation.net
- DNS ASK ex#####ncenation.net
- DNS ASK pa###brown.net
- DNS ASK sm###brown.net
- DNS ASK wo###people.net
- DNS ASK wo###brown.net
- DNS ASK wo###ready.net
- DNS ASK sm###ready.net
- DNS ASK pa###ready.net
- DNS ASK fi###ready.net
- DNS ASK sm####aughter.net
- DNS ASK sm###people.net
- DNS ASK wo####aughter.net
- DNS ASK me####soldier.net
- DNS ASK fo####please.net
- DNS ASK fo####soldier.net
- DNS ASK fo####nation.net
- DNS ASK me####nation.net
- DNS ASK be###nation.net
- DNS ASK kn###nation.net
- DNS ASK me####condition.net
- DNS ASK me####please.net
- DNS ASK fo####condition.net
- DNS ASK al#####condition.net
- DNS ASK ge####mannation.net
- DNS ASK al####ynation.net
- DNS ASK ex#####ncecondition.net
- DNS ASK ex#####nceplease.net
- DNS ASK fr####ondition.net
- DNS ASK al####yplease.net
- DNS ASK ge#####ancondition.net
- DNS ASK ge####manplease.net
- DNS ASK ge#####ansoldier.net
- DNS ASK al####ysoldier.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
