Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Reporting Resource Management' = 'C:\xxvlxuymll\qnvbykwgsq.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ActiveX Process Coordinator Software Windows TP] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\xxvlxuymll\utpfclnnsjp.exe' "c:\xxvlxuymll\qnvbykwgsq.exe"
- 'C:\xxvlxuymll\qnvbykwgsq.exe'
- 'C:\xxvlxuymll\zws7p48taxbc96fjlph.exe'
Modifies file system :
Creates the following files:
- C:\xxvlxuymll\qnvbykwgsq.exe
- C:\xxvlxuymll\utpfclnnsjp.exe
- C:\xxvlxuymll\zyfynhbh
- %WINDIR%\xxvlxuymll\jxhfpfmzmkfp
- C:\xxvlxuymll\jxhfpfmzmkfp
- C:\xxvlxuymll\zws7p48taxbc96fjlph.exe
Sets the 'hidden' attribute to the following files:
- C:\xxvlxuymll\utpfclnnsjp.exe
- C:\xxvlxuymll\qnvbykwgsq.exe
Deletes the following files:
- C:\xxvlxuymll\zws7p48taxbc96fjlph.exe
- %WINDIR%\xxvlxuymll\jxhfpfmzmkfp
Network activity:
Connects to:
- 'he###safety.net':80
- 'ge###eearly.net':80
- 'he###future.net':80
- 'ge####safety.net':80
- 'he###early.net':80
- 'he####future.net':80
- 'le####future.net':80
- 'ge###esmell.net':80
- 'he###smell.net':80
- 'ge####future.net':80
- 'va####sfuture.net':80
- 're####safety.net':80
- 'de####separate.net':80
- 're####future.net':80
- 'va####ssafety.net':80
- 're###nsmell.net':80
- 'va####ssmell.net':80
- 're###nearly.net':80
- 'va####searly.net':80
- 'he####safety.net':80
- 'or###smell.net':80
- 'ne####aryfuture.net':80
- 'or###early.net':80
- 're####esmell.net':80
- 'pl####ntfuture.net':80
- 'ne####aryearly.net':80
- 'pl####ntearly.net':80
- 'ne####arysafety.net':80
- 'pl####ntsafety.net':80
- 're####eearly.net':80
- 'le###rearly.net':80
- 'he###nsmell.net':80
- 'le####safety.net':80
- 'he###nearly.net':80
- 'le###rsmell.net':80
- 're####esafety.net':80
- 'or###safety.net':80
- 're####efuture.net':80
- 'or###future.net':80
TCP:
HTTP GET requests:
- http://he###safety.net/index.php?me########
- http://ge###eearly.net/index.php?me########
- http://he###future.net/index.php?me########
- http://ge####safety.net/index.php?me########
- http://he###early.net/index.php?me########
- http://he####future.net/index.php?me########
- http://le####future.net/index.php?me########
- http://ge###esmell.net/index.php?me########
- http://he###smell.net/index.php?me########
- http://ge####future.net/index.php?me########
- http://va####sfuture.net/index.php?me########
- http://re####safety.net/index.php?me########
- http://de####separate.net/index.php?me########
- http://re####future.net/index.php?me########
- http://va####ssafety.net/index.php?me########
- http://re###nsmell.net/index.php?me########
- http://va####ssmell.net/index.php?me########
- http://re###nearly.net/index.php?me########
- http://va####searly.net/index.php?me########
- http://he####safety.net/index.php?me########
- http://or###smell.net/index.php?me########
- http://ne####aryfuture.net/index.php?me########
- http://or###early.net/index.php?me########
- http://re####esmell.net/index.php?me########
- http://pl####ntfuture.net/index.php?me########
- http://ne####aryearly.net/index.php?me########
- http://pl####ntearly.net/index.php?me########
- http://ne####arysafety.net/index.php?me########
- http://pl####ntsafety.net/index.php?me########
- http://re####eearly.net/index.php?me########
- http://le###rearly.net/index.php?me########
- http://he###nsmell.net/index.php?me########
- http://le####safety.net/index.php?me########
- http://he###nearly.net/index.php?me########
- http://le###rsmell.net/index.php?me########
- http://re####esafety.net/index.php?me########
- http://or###safety.net/index.php?me########
- http://re####efuture.net/index.php?me########
- http://or###future.net/index.php?me########
UDP:
- DNS ASK he###safety.net
- DNS ASK ge###eearly.net
- DNS ASK ge####safety.net
- DNS ASK ge####future.net
- DNS ASK he###future.net
- DNS ASK he####future.net
- DNS ASK le####future.net
- DNS ASK he###smell.net
- DNS ASK he###early.net
- DNS ASK ge###esmell.net
- DNS ASK va####sfuture.net
- DNS ASK re####safety.net
- DNS ASK re####future.net
- DNS ASK fo####dseparate.net
- DNS ASK de####separate.net
- DNS ASK re###nsmell.net
- DNS ASK va####ssmell.net
- DNS ASK va####searly.net
- DNS ASK va####ssafety.net
- DNS ASK re###nearly.net
- DNS ASK or###smell.net
- DNS ASK ne####aryfuture.net
- DNS ASK re####esmell.net
- DNS ASK re####eearly.net
- DNS ASK or###early.net
- DNS ASK ne####aryearly.net
- DNS ASK pl####ntearly.net
- DNS ASK pl####ntsafety.net
- DNS ASK pl####ntfuture.net
- DNS ASK ne####arysafety.net
- DNS ASK le###rearly.net
- DNS ASK he###nsmell.net
- DNS ASK he###nearly.net
- DNS ASK he####safety.net
- DNS ASK le####safety.net
- DNS ASK re####esafety.net
- DNS ASK or###safety.net
- DNS ASK or###future.net
- DNS ASK le###rsmell.net
- DNS ASK re####efuture.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
