Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NetBIOS TP PNRP Solutions Extender' = '<SYSTEM32>\agmvzzsr.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\IP IPsec Storage Copy Services Port Logon] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\snzdkjhjzgc.exe' "<SYSTEM32>\agmvzzsr.exe"
- '%WINDIR%\Temp\xmxulc33iyqetwcq.exe' -r 28357 tcp
- '%TEMP%\xmxulc33denetwcqsokmog.exe'
- '<SYSTEM32>\agmvzzsr.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\dtiugvs\run
- <SYSTEM32>\dtiugvs\rng
- %WINDIR%\Temp\xmxulc33iyqetwcq.exe
- <SYSTEM32>\dtiugvs\cfg
- <SYSTEM32>\snzdkjhjzgc.exe
- %TEMP%\xmxulc33denetwcqsokmog.exe
- <SYSTEM32>\dtiugvs\tst
- <SYSTEM32>\agmvzzsr.exe
- <SYSTEM32>\dtiugvs\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\snzdkjhjzgc.exe
- <SYSTEM32>\agmvzzsr.exe
Deletes the following files:
- %WINDIR%\Temp\xmxulc33iyqetwcq.exe
- <DRIVERS>\etc\hosts
- %TEMP%\xmxulc33denetwcqsokmog.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'tr###mile.net':80
- 'mi###ile.net':80
- 'mi###ing.net':80
- 'wi###han.net':80
- 'tr###king.net':80
- 'mi###han.net':80
- 'da###ews.net':80
- 'tr###than.net':80
- 'tr###read.net':80
- 'mi###ead.net':80
- 'du###han.net':80
- 'th###than.net':80
- 'du###ing.net':80
- 'si###than.net':80
- 'si###read.net':80
- 'th###read.net':80
- 'du###ead.net':80
- 'wi###ead.net':80
- 'wi###ile.net':80
- 'wi###ing.net':80
- 'du###ile.net':80
- 'pr####tbottom.net':80
- 'mo###olor.net':80
- 'ca####nbring.net':80
- 'ri###nstorm.net':80
- 'al###being.net':80
- 'le###form.net':80
- 'cr#####onaraminta.net':80
- 'mo###ugust.net':80
- 'ab###ell.net':80
- 'mi###hown.net':80
- 'be##lxc.com':80
- 'da###roke.net':80
- 'cl###broke.net':80
- 'cl###mark.net':80
- 'cl###news.net':80
- 'da###ark.net':80
- 'me###ews.net':80
- 'si###ark.net':80
- 'si###ews.net':80
- 'da###tate.net':80
- 'cl###state.net':80
TCP:
HTTP GET requests:
- http://tr###mile.net/index.php
- http://mi###ile.net/index.php
- http://mi###ing.net/index.php
- http://wi###han.net/index.php
- http://tr###king.net/index.php
- http://mi###han.net/index.php
- http://da###ews.net/index.php
- http://tr###than.net/index.php
- http://tr###read.net/index.php
- http://mi###ead.net/index.php
- http://du###han.net/index.php
- http://th###than.net/index.php
- http://du###ing.net/index.php
- http://si###than.net/index.php
- http://si###read.net/index.php
- http://th###read.net/index.php
- http://du###ead.net/index.php
- http://wi###ead.net/index.php
- http://wi###ile.net/index.php
- http://wi###ing.net/index.php
- http://du###ile.net/index.php
- http://pr####tbottom.net/index.php
- http://mo###olor.net/index.php
- http://ca####nbring.net/index.php
- http://ri###nstorm.net/index.php
- http://al###being.net/index.php
- http://le###form.net/index.php
- http://cr#####onaraminta.net/index.php
- http://mo###ugust.net/index.php
- http://ab###ell.net/index.php
- http://mi###hown.net/index.php
- http://be##lxc.com/index.php
- http://da###roke.net/index.php
- http://cl###broke.net/index.php
- http://cl###mark.net/index.php
- http://cl###news.net/index.php
- http://da###ark.net/index.php
- http://me###ews.net/index.php
- http://si###ark.net/index.php
- http://si###ews.net/index.php
- http://da###tate.net/index.php
- http://cl###state.net/index.php
UDP:
- DNS ASK mi###ing.net
- DNS ASK tr###mile.net
- DNS ASK tr###king.net
- DNS ASK du###han.net
- DNS ASK wi###han.net
- DNS ASK mi###ile.net
- DNS ASK mi###han.net
- DNS ASK da###ews.net
- DNS ASK tr###than.net
- DNS ASK tr###read.net
- DNS ASK mi###ead.net
- DNS ASK si###than.net
- DNS ASK th###than.net
- DNS ASK th###read.net
- DNS ASK th###mile.net
- DNS ASK si###read.net
- DNS ASK du###ing.net
- DNS ASK du###ead.net
- DNS ASK wi###ead.net
- DNS ASK wi###ile.net
- DNS ASK wi###ing.net
- DNS ASK du###ile.net
- DNS ASK pr####tbottom.net
- DNS ASK mo###olor.net
- DNS ASK ca####nbring.net
- DNS ASK ri###nstorm.net
- DNS ASK al###being.net
- DNS ASK le###form.net
- DNS ASK cr#####onaraminta.net
- DNS ASK mo###ugust.net
- DNS ASK ab###ell.net
- DNS ASK mi###hown.net
- DNS ASK be##lxc.com
- DNS ASK da###roke.net
- DNS ASK cl###broke.net
- DNS ASK cl###mark.net
- DNS ASK cl###news.net
- DNS ASK da###ark.net
- DNS ASK me###ews.net
- DNS ASK si###ark.net
- DNS ASK si###ews.net
- DNS ASK da###tate.net
- DNS ASK cl###state.net
- '23#.#55.255.250':1900
