Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Visual Human Builder Windows TP BranchCache' = '<SYSTEM32>\rgmpkdo.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Internet Program Publication SNMP] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\umozjtuuctw.exe' "<SYSTEM32>\rgmpkdo.exe"
- '%WINDIR%\Temp\nnxzaxr73gwygif.exe' -r 22242 tcp
- '%TEMP%\nnxzaxr73ax9gifhzn3gq.exe'
- '<SYSTEM32>\rgmpkdo.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\aqvntgouprp\run
- <SYSTEM32>\aqvntgouprp\rng
- %WINDIR%\Temp\nnxzaxr73gwygif.exe
- <SYSTEM32>\aqvntgouprp\cfg
- <SYSTEM32>\umozjtuuctw.exe
- %TEMP%\nnxzaxr73ax9gifhzn3gq.exe
- <SYSTEM32>\aqvntgouprp\tst
- <SYSTEM32>\rgmpkdo.exe
- <SYSTEM32>\aqvntgouprp\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\umozjtuuctw.exe
- <SYSTEM32>\rgmpkdo.exe
Deletes the following files:
- %WINDIR%\Temp\nnxzaxr73gwygif.exe
- <DRIVERS>\etc\hosts
- %TEMP%\nnxzaxr73ax9gifhzn3gq.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'wi###orn.net':80
- 'kn###rice.net':80
- 'wi###ugust.net':80
- 'dr###born.net':80
- 'ab###roud.net':80
- 'kn###aise.net':80
- 'ab###rice.net':80
- 'kn###roud.net':80
- 'th###born.net':80
- 'dr###cloth.net':80
- 'th###paid.net':80
- 'th###august.net':80
- 'wi###aid.net':80
- 'dr###august.net':80
- 'wi###loth.net':80
- 'dr###paid.net':80
- 'ab###aise.net':80
- 'ro###rice.net':80
- 'si###rice.net':80
- 'pi###each.net':80
- 'so###each.net':80
- 'ro###aise.net':80
- 'si###aise.net':80
- 'ro###roud.net':80
- 'si###roud.net':80
- 'pi###rice.net':80
- 'so###rice.net':80
- 'kn###each.net':80
- 'ab###each.net':80
- 'pi###aise.net':80
- 'so###aise.net':80
- 'pi###roud.net':80
- 'so###roud.net':80
- 'mo###aid.net':80
- 'ju###aid.net':80
- 'mo###loth.net':80
- 'ju###loth.net':80
- 'mo###orn.net':80
- 'ju###orn.net':80
- 'mo###ugust.net':80
- 'ju###ugust.net':80
- 'be##lxc.com':80
- 'de###lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'ro###orn.net':80
- 'si###orn.net':80
- 'ro###ugust.net':80
- 'si###ugust.net':80
- 'hi###loth.net':80
- 'lo###aid.net':80
- 'fe###ugust.net':80
- 'lo###loth.net':80
- 'fe###aid.net':80
- 'lo###orn.net':80
- 'th###cloth.net':80
- 'lo###ugust.net':80
- 'fe###orn.net':80
- 'wh###aid.net':80
- 'hi###ugust.net':80
- 'wh###loth.net':80
- 'hi###aid.net':80
- 'wh###orn.net':80
- 'fe###loth.net':80
- 'wh###ugust.net':80
- 'hi###orn.net':80
TCP:
HTTP GET requests:
- http://wi###orn.net/index.php
- http://kn###rice.net/index.php
- http://wi###ugust.net/index.php
- http://dr###born.net/index.php
- http://ab###roud.net/index.php
- http://kn###aise.net/index.php
- http://ab###rice.net/index.php
- http://kn###roud.net/index.php
- http://th###born.net/index.php
- http://dr###cloth.net/index.php
- http://th###paid.net/index.php
- http://th###august.net/index.php
- http://wi###aid.net/index.php
- http://dr###august.net/index.php
- http://wi###loth.net/index.php
- http://dr###paid.net/index.php
- http://ab###aise.net/index.php
- http://ro###rice.net/index.php
- http://si###rice.net/index.php
- http://pi###each.net/index.php
- http://so###each.net/index.php
- http://ro###aise.net/index.php
- http://si###aise.net/index.php
- http://ro###roud.net/index.php
- http://si###roud.net/index.php
- http://pi###rice.net/index.php
- http://so###rice.net/index.php
- http://kn###each.net/index.php
- http://ab###each.net/index.php
- http://pi###aise.net/index.php
- http://so###aise.net/index.php
- http://pi###roud.net/index.php
- http://so###roud.net/index.php
- http://mo###aid.net/index.php
- http://ju###aid.net/index.php
- http://mo###loth.net/index.php
- http://ju###loth.net/index.php
- http://mo###orn.net/index.php
- http://ju###orn.net/index.php
- http://mo###ugust.net/index.php
- http://ju###ugust.net/index.php
- http://be##lxc.com/index.php
- http://de###lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://ro###orn.net/index.php
- http://si###orn.net/index.php
- http://ro###ugust.net/index.php
- http://si###ugust.net/index.php
- http://hi###loth.net/index.php
- http://lo###aid.net/index.php
- http://fe###ugust.net/index.php
- http://lo###loth.net/index.php
- http://fe###aid.net/index.php
- http://lo###orn.net/index.php
- http://th###cloth.net/index.php
- http://lo###ugust.net/index.php
- http://fe###orn.net/index.php
- http://wh###aid.net/index.php
- http://hi###ugust.net/index.php
- http://wh###loth.net/index.php
- http://hi###aid.net/index.php
- http://wh###orn.net/index.php
- http://fe###loth.net/index.php
- http://wh###ugust.net/index.php
- http://hi###orn.net/index.php
UDP:
- DNS ASK kn###rice.net
- DNS ASK ab###rice.net
- DNS ASK dr###born.net
- DNS ASK wi###orn.net
- DNS ASK kn###aise.net
- DNS ASK ab###aise.net
- DNS ASK kn###roud.net
- DNS ASK ab###roud.net
- DNS ASK wi###ugust.net
- DNS ASK th###born.net
- DNS ASK dr###cloth.net
- DNS ASK th###paid.net
- DNS ASK th###august.net
- DNS ASK wi###aid.net
- DNS ASK dr###august.net
- DNS ASK wi###loth.net
- DNS ASK dr###paid.net
- DNS ASK si###rice.net
- DNS ASK ro###roud.net
- DNS ASK so###each.net
- DNS ASK ro###rice.net
- DNS ASK si###aise.net
- DNS ASK ro###each.net
- DNS ASK si###roud.net
- DNS ASK ro###aise.net
- DNS ASK pi###each.net
- DNS ASK pi###rice.net
- DNS ASK so###rice.net
- DNS ASK kn###each.net
- DNS ASK ab###each.net
- DNS ASK pi###aise.net
- DNS ASK so###aise.net
- DNS ASK pi###roud.net
- DNS ASK so###roud.net
- DNS ASK mo###aid.net
- DNS ASK ju###aid.net
- DNS ASK mo###loth.net
- DNS ASK ju###loth.net
- DNS ASK mo###orn.net
- DNS ASK ju###orn.net
- DNS ASK mo###ugust.net
- DNS ASK ju###ugust.net
- DNS ASK be##lxc.com
- DNS ASK de###lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK ro###orn.net
- DNS ASK si###orn.net
- DNS ASK ro###ugust.net
- DNS ASK si###ugust.net
- DNS ASK hi###loth.net
- DNS ASK lo###aid.net
- DNS ASK fe###ugust.net
- DNS ASK lo###loth.net
- DNS ASK fe###aid.net
- DNS ASK lo###orn.net
- DNS ASK th###cloth.net
- DNS ASK lo###ugust.net
- DNS ASK fe###orn.net
- DNS ASK wh###aid.net
- DNS ASK hi###ugust.net
- DNS ASK wh###loth.net
- DNS ASK hi###aid.net
- DNS ASK wh###orn.net
- DNS ASK fe###loth.net
- DNS ASK wh###ugust.net
- DNS ASK hi###orn.net
- '23#.#55.255.250':1900
