Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Visual Volume Redirector Interactive' = '<SYSTEM32>\kruvihquzoe.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\System Class Gateway] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\uogawmgd.exe' "<SYSTEM32>\kruvihquzoe.exe"
- '%WINDIR%\Temp\apbcqy375epf.exe' -r 48196 tcp
- '%TEMP%\apbcqy2u0bpfmgcpdy.exe'
- '<SYSTEM32>\kruvihquzoe.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\cfxfjwaujhoynpu\run
- <SYSTEM32>\cfxfjwaujhoynpu\rng
- %WINDIR%\Temp\apbcqy375epf.exe
- <SYSTEM32>\cfxfjwaujhoynpu\cfg
- <SYSTEM32>\uogawmgd.exe
- %TEMP%\apbcqy2u0bpfmgcpdy.exe
- <SYSTEM32>\cfxfjwaujhoynpu\tst
- <SYSTEM32>\kruvihquzoe.exe
- <SYSTEM32>\cfxfjwaujhoynpu\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\uogawmgd.exe
- <SYSTEM32>\kruvihquzoe.exe
Deletes the following files:
- %WINDIR%\Temp\apbcqy375epf.exe
- <DRIVERS>\etc\hosts
- %TEMP%\apbcqy2u0bpfmgcpdy.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'so###dare.net':80
- 'ar###dance.net':80
- 'ar###dare.net':80
- 'dr###such.net':80
- 'th###uch.net':80
- 'ar###tell.net':80
- 'so###tell.net':80
- 'so###body.net':80
- 'so###dance.net':80
- 'ar###body.net':80
- 'th###oday.net':80
- 'wa###such.net':80
- 'fa###uch.net':80
- 'fa###oday.net':80
- 'fa###even.net':80
- 'wa###today.net':80
- 'th###even.net':80
- 'dr###today.net':80
- 'dr###seven.net':80
- 'dr###some.net':80
- 'th###ome.net':80
- 'sp###ell.net':80
- 'sa###ell.net':80
- 'sa###ody.net':80
- 'sa###ance.net':80
- 'sp###ody.net':80
- 'ta###dance.net':80
- 'gl###ody.net':80
- 'gl###ance.net':80
- 'gl###are.net':80
- 'ta###dare.net':80
- 'sp###ance.net':80
- 'wh###dance.net':80
- 'up###ody.net':80
- 'up###ance.net':80
- 'up###are.net':80
- 'wh###dare.net':80
- 'sp###are.net':80
- 'sa###are.net':80
- 'wh###tell.net':80
- 'wh###body.net':80
- 'up###ell.net':80
- 'wa###seven.net':80
- 'sp###uch.net':80
- 'sa###uch.net':80
- 'sa###oday.net':80
- 'sa###even.net':80
- 'sp###oday.net':80
- 'ta###seven.net':80
- 'gl###oday.net':80
- 'gl###even.net':80
- 'gl###ome.net':80
- 'ta###some.net':80
- 'sp###even.net':80
- 'de###lxc.com':80
- 'up###oday.net':80
- 'be##lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'sp###ome.net':80
- 'sa###ome.net':80
- 'wh###such.net':80
- 'wh###today.net':80
- 'up###uch.net':80
- 'vi###seven.net':80
- 'sp###today.net':80
- 'sp###seven.net':80
- 'sp###some.net':80
- 'vi###some.net':80
- 'wa###some.net':80
- 'fa###ome.net':80
- 'vi###such.net':80
- 'vi###today.net':80
- 'sp###such.net':80
- 'gr###such.net':80
- 'eq###some.net':80
- 'gr###some.net':80
- 'ta###such.net':80
- 'ta###today.net':80
- 'gl###uch.net':80
- 'gr###today.net':80
- 'eq###such.net':80
- 'eq###today.net':80
- 'eq###seven.net':80
- 'gr###seven.net':80
TCP:
HTTP GET requests:
- http://so###dare.net/index.php
- http://ar###dance.net/index.php
- http://ar###dare.net/index.php
- http://dr###such.net/index.php
- http://th###uch.net/index.php
- http://ar###tell.net/index.php
- http://so###tell.net/index.php
- http://so###body.net/index.php
- http://so###dance.net/index.php
- http://ar###body.net/index.php
- http://th###oday.net/index.php
- http://wa###such.net/index.php
- http://fa###uch.net/index.php
- http://fa###oday.net/index.php
- http://fa###even.net/index.php
- http://wa###today.net/index.php
- http://th###even.net/index.php
- http://dr###today.net/index.php
- http://dr###seven.net/index.php
- http://dr###some.net/index.php
- http://th###ome.net/index.php
- http://sp###ell.net/index.php
- http://sa###ell.net/index.php
- http://sa###ody.net/index.php
- http://sa###ance.net/index.php
- http://sp###ody.net/index.php
- http://ta###dance.net/index.php
- http://gl###ody.net/index.php
- http://gl###ance.net/index.php
- http://gl###are.net/index.php
- http://ta###dare.net/index.php
- http://sp###ance.net/index.php
- http://wh###dance.net/index.php
- http://up###ody.net/index.php
- http://up###ance.net/index.php
- http://up###are.net/index.php
- http://wh###dare.net/index.php
- http://sp###are.net/index.php
- http://sa###are.net/index.php
- http://wh###tell.net/index.php
- http://wh###body.net/index.php
- http://up###ell.net/index.php
- http://wa###seven.net/index.php
- http://sp###uch.net/index.php
- http://sa###uch.net/index.php
- http://sa###oday.net/index.php
- http://sa###even.net/index.php
- http://sp###oday.net/index.php
- http://ta###seven.net/index.php
- http://gl###oday.net/index.php
- http://gl###even.net/index.php
- http://gl###ome.net/index.php
- http://ta###some.net/index.php
- http://sp###even.net/index.php
- http://de###lxc.com/index.php
- http://up###oday.net/index.php
- http://be##lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://sp###ome.net/index.php
- http://sa###ome.net/index.php
- http://wh###such.net/index.php
- http://wh###today.net/index.php
- http://up###uch.net/index.php
- http://vi###seven.net/index.php
- http://sp###today.net/index.php
- http://sp###seven.net/index.php
- http://sp###some.net/index.php
- http://vi###some.net/index.php
- http://wa###some.net/index.php
- http://fa###ome.net/index.php
- http://vi###such.net/index.php
- http://vi###today.net/index.php
- http://sp###such.net/index.php
- http://gr###such.net/index.php
- http://eq###some.net/index.php
- http://gr###some.net/index.php
- http://ta###such.net/index.php
- http://ta###today.net/index.php
- http://gl###uch.net/index.php
- http://gr###today.net/index.php
- http://eq###such.net/index.php
- http://eq###today.net/index.php
- http://eq###seven.net/index.php
- http://gr###seven.net/index.php
UDP:
- DNS ASK so###dare.net
- DNS ASK ar###dance.net
- DNS ASK ar###dare.net
- DNS ASK dr###such.net
- DNS ASK th###uch.net
- DNS ASK ar###tell.net
- DNS ASK so###tell.net
- DNS ASK so###body.net
- DNS ASK so###dance.net
- DNS ASK ar###body.net
- DNS ASK th###oday.net
- DNS ASK wa###such.net
- DNS ASK fa###uch.net
- DNS ASK fa###oday.net
- DNS ASK fa###even.net
- DNS ASK wa###today.net
- DNS ASK th###even.net
- DNS ASK dr###today.net
- DNS ASK dr###seven.net
- DNS ASK dr###some.net
- DNS ASK th###ome.net
- DNS ASK up###are.net
- DNS ASK sa###ell.net
- DNS ASK gl###are.net
- DNS ASK sp###ell.net
- DNS ASK sp###ody.net
- DNS ASK sa###ody.net
- DNS ASK gl###ody.net
- DNS ASK ta###body.net
- DNS ASK ta###dance.net
- DNS ASK ta###dare.net
- DNS ASK gl###ance.net
- DNS ASK sa###ance.net
- DNS ASK up###ody.net
- DNS ASK wh###body.net
- DNS ASK wh###dance.net
- DNS ASK wh###dare.net
- DNS ASK up###ance.net
- DNS ASK sa###are.net
- DNS ASK sp###ance.net
- DNS ASK sp###are.net
- DNS ASK up###ell.net
- DNS ASK wh###tell.net
- DNS ASK wa###seven.net
- DNS ASK sp###uch.net
- DNS ASK sa###uch.net
- DNS ASK sa###oday.net
- DNS ASK sa###even.net
- DNS ASK sp###oday.net
- DNS ASK ta###seven.net
- DNS ASK gl###oday.net
- DNS ASK gl###even.net
- DNS ASK gl###ome.net
- DNS ASK ta###some.net
- DNS ASK sp###even.net
- DNS ASK de###lxc.com
- DNS ASK up###oday.net
- DNS ASK be##lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK sp###ome.net
- DNS ASK sa###ome.net
- DNS ASK wh###such.net
- DNS ASK wh###today.net
- DNS ASK up###uch.net
- DNS ASK vi###seven.net
- DNS ASK sp###today.net
- DNS ASK sp###seven.net
- DNS ASK sp###some.net
- DNS ASK vi###some.net
- DNS ASK wa###some.net
- DNS ASK fa###ome.net
- DNS ASK vi###such.net
- DNS ASK vi###today.net
- DNS ASK sp###such.net
- DNS ASK gr###such.net
- DNS ASK eq###some.net
- DNS ASK gr###some.net
- DNS ASK ta###such.net
- DNS ASK ta###today.net
- DNS ASK gl###uch.net
- DNS ASK gr###today.net
- DNS ASK eq###such.net
- DNS ASK eq###today.net
- DNS ASK eq###seven.net
- DNS ASK gr###seven.net
- '23#.#55.255.250':1900
