Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Provider Publication Collector' = '<SYSTEM32>\hgconrzvkmk.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Drive Foundation Removal Card Volume NGEN] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\mbncfeuj.exe' "<SYSTEM32>\hgconrzvkmk.exe"
- '%WINDIR%\Temp\p1yhzxz2zqhdo8e7.exe' -r 34262 tcp
- '%TEMP%\p1yhzxz2p12do8e7l7ehecty.exe'
- '<SYSTEM32>\hgconrzvkmk.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\dqpiwzctmub\run
- <SYSTEM32>\dqpiwzctmub\rng
- %WINDIR%\Temp\p1yhzxz2zqhdo8e7.exe
- <SYSTEM32>\dqpiwzctmub\cfg
- <SYSTEM32>\mbncfeuj.exe
- %TEMP%\p1yhzxz2p12do8e7l7ehecty.exe
- <SYSTEM32>\dqpiwzctmub\tst
- <SYSTEM32>\hgconrzvkmk.exe
- <SYSTEM32>\dqpiwzctmub\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\mbncfeuj.exe
- <SYSTEM32>\hgconrzvkmk.exe
Deletes the following files:
- %WINDIR%\Temp\p1yhzxz2zqhdo8e7.exe
- <DRIVERS>\etc\hosts
- %TEMP%\p1yhzxz2p12do8e7l7ehecty.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'wa###food.net':80
- 'fa###hown.net':80
- 'wa###shown.net':80
- 'fa###eet.net':80
- 'wa###meet.net':80
- 'fa###ood.net':80
- 'fa###eck.net':80
- 'vi###food.net':80
- 'sp###food.net':80
- 'vi###shown.net':80
- 'wa###neck.net':80
- 'vi###meet.net':80
- 'sp###meet.net':80
- 'so###some.net':80
- 'ar###some.net':80
- 'th###eet.net':80
- 'ar###today.net':80
- 'so###seven.net':80
- 'ar###seven.net':80
- 'dr###meet.net':80
- 'dr###shown.net':80
- 'th###eck.net':80
- 'dr###neck.net':80
- 'th###ood.net':80
- 'dr###food.net':80
- 'th###hown.net':80
- 'sp###shown.net':80
- 'ta###neck.net':80
- 'gl###eck.net':80
- 'sa###eet.net':80
- 'gl###ood.net':80
- 'ta###shown.net':80
- 'gl###hown.net':80
- 'sp###eet.net':80
- 'de###lxc.com':80
- 'be##lxc.com':80
- 'ri###nstorm.net':80
- 'sa###ood.net':80
- 'sp###ood.net':80
- 'sa###hown.net':80
- 'eq###meet.net':80
- 'gr###food.net':80
- 'eq###food.net':80
- 'vi###neck.net':80
- 'sp###neck.net':80
- 'gr###meet.net':80
- 'gr###shown.net':80
- 'ta###meet.net':80
- 'gl###eet.net':80
- 'ta###food.net':80
- 'eq###shown.net':80
- 'gr###neck.net':80
- 'eq###neck.net':80
TCP:
HTTP GET requests:
- http://wa###food.net/index.php
- http://fa###hown.net/index.php
- http://wa###shown.net/index.php
- http://fa###eet.net/index.php
- http://wa###meet.net/index.php
- http://fa###ood.net/index.php
- http://fa###eck.net/index.php
- http://vi###food.net/index.php
- http://sp###food.net/index.php
- http://vi###shown.net/index.php
- http://wa###neck.net/index.php
- http://vi###meet.net/index.php
- http://sp###meet.net/index.php
- http://so###some.net/index.php
- http://ar###some.net/index.php
- http://th###eet.net/index.php
- http://ar###today.net/index.php
- http://so###seven.net/index.php
- http://ar###seven.net/index.php
- http://dr###meet.net/index.php
- http://dr###shown.net/index.php
- http://th###eck.net/index.php
- http://dr###neck.net/index.php
- http://th###ood.net/index.php
- http://dr###food.net/index.php
- http://th###hown.net/index.php
- http://sp###shown.net/index.php
- http://ta###neck.net/index.php
- http://gl###eck.net/index.php
- http://sa###eet.net/index.php
- http://gl###ood.net/index.php
- http://ta###shown.net/index.php
- http://gl###hown.net/index.php
- http://sp###eet.net/index.php
- http://de###lxc.com/index.php
- http://be##lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://sa###ood.net/index.php
- http://sp###ood.net/index.php
- http://sa###hown.net/index.php
- http://eq###meet.net/index.php
- http://gr###food.net/index.php
- http://eq###food.net/index.php
- http://vi###neck.net/index.php
- http://sp###neck.net/index.php
- http://gr###meet.net/index.php
- http://gr###shown.net/index.php
- http://ta###meet.net/index.php
- http://gl###eet.net/index.php
- http://ta###food.net/index.php
- http://eq###shown.net/index.php
- http://gr###neck.net/index.php
- http://eq###neck.net/index.php
UDP:
- DNS ASK fa###hown.net
- DNS ASK wa###shown.net
- DNS ASK fa###eck.net
- DNS ASK wa###food.net
- DNS ASK fa###eet.net
- DNS ASK wa###meet.net
- DNS ASK fa###ood.net
- DNS ASK sp###food.net
- DNS ASK vi###shown.net
- DNS ASK sp###shown.net
- DNS ASK vi###food.net
- DNS ASK wa###neck.net
- DNS ASK vi###meet.net
- DNS ASK sp###meet.net
- DNS ASK so###some.net
- DNS ASK ar###some.net
- DNS ASK th###eet.net
- DNS ASK ar###seven.net
- DNS ASK so###today.net
- DNS ASK ar###today.net
- DNS ASK so###seven.net
- DNS ASK dr###shown.net
- DNS ASK th###eck.net
- DNS ASK dr###neck.net
- DNS ASK th###hown.net
- DNS ASK dr###meet.net
- DNS ASK th###ood.net
- DNS ASK dr###food.net
- DNS ASK gl###eck.net
- DNS ASK sa###eet.net
- DNS ASK sp###eet.net
- DNS ASK ta###shown.net
- DNS ASK gl###hown.net
- DNS ASK ta###neck.net
- DNS ASK sa###ood.net
- DNS ASK be##lxc.com
- DNS ASK af###sllc.com
- DNS ASK ri###nstorm.net
- DNS ASK sp###ood.net
- DNS ASK sa###hown.net
- DNS ASK de###lxc.com
- DNS ASK gl###ood.net
- DNS ASK eq###meet.net
- DNS ASK gr###food.net
- DNS ASK eq###food.net
- DNS ASK vi###neck.net
- DNS ASK sp###neck.net
- DNS ASK gr###meet.net
- DNS ASK gr###shown.net
- DNS ASK ta###meet.net
- DNS ASK gl###eet.net
- DNS ASK ta###food.net
- DNS ASK eq###shown.net
- DNS ASK gr###neck.net
- DNS ASK eq###neck.net
- '23#.#55.255.250':1900
