Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Adapter iSCSI Reporting' = '%APPDATA%\nvtzluswo\cuzzudv.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\nvtzluswo\ecxujmpe.exe' "%APPDATA%\nvtzluswo\cuzzudv.exe"
- '%APPDATA%\nvtzluswo\cuzzudv.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\nvtzluswo\cuzzudv.smaj
- %APPDATA%\nvtzluswo\ecxujmpe.exe
- %APPDATA%\nvtzluswo\cuzzudv.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\nvtzluswo\ecxujmpe.exe
- %APPDATA%\nvtzluswo\cuzzudv.exe
Network activity:
Connects to:
- 'or###mayor.net':80
- 're####emayor.net':80
- 're####eperfect.net':80
- 're####eheart.net':80
- 'or####erfect.net':80
- 'he###nheart.net':80
- 'le####perfect.net':80
- 'le###rheart.net':80
- 'or###battle.net':80
- 're####ebattle.net':80
- 'pl####ntperfect.net':80
- 'ne#####ryperfect.net':80
- 'ne####aryheart.net':80
- 'he###battle.net':80
- 'pl####ntheart.net':80
- 'ne####arybattle.net':80
- 'or###heart.net':80
- 'pl####ntbattle.net':80
- 'pl####ntmayor.net':80
- 'ne####arymayor.net':80
- 'va####smayor.net':80
- 're###nmayor.net':80
- 're####perfect.net':80
- 're###nheart.net':80
- 'va####sperfect.net':80
- 'hu#####understand.net':80
- 'jo####ybroad.net':80
- 'jo#####understand.net':80
- 'va####sbattle.net':80
- 're####battle.net':80
- 'le####battle.net':80
- 'he####battle.net':80
- 'he###nmayor.net':80
- 'he####perfect.net':80
- 'le###rmayor.net':80
- 'ge####battle.net':80
- 'va####sheart.net':80
- 'ge###emayor.net':80
- 'ge###eheart.net':80
- 'ge####perfect.net':80
- 'di####ultbattle.net':80
- 're####pleasure.net':80
- 'va####smillion.net':80
- 'va####spleasure.net':80
- 'va####stoward.net':80
- 're####toward.net':80
- 'de###eheart.net':80
- 'fo####dheart.net':80
- 're###nwhite.net':80
- 're####million.net':80
- 'va####swhite.net':80
- 'ge####toward.net':80
- 'he####leasure.net':80
- 'he###toward.net':80
- 'le###rwhite.net':80
- 'he###nwhite.net':80
- 'he###white.net':80
- 'ge###ewhite.net':80
- 'ge####million.net':80
- 'ge####pleasure.net':80
- 'he####illion.net':80
- 'gl###battle.net':80
- 'di####ultheart.net':80
- 'an####battle.net':80
- 'an###rmayor.net':80
- 'gl###mayor.net':80
- 'di####ultmayor.net':80
- 'he###mayor.net':80
- 'he####erfect.net':80
- 'he###heart.net':80
- 'di#####ltperfect.net':80
- 'fo####dmayor.net':80
- 'de####battle.net':80
- 'de###emayor.net':80
- 'de####perfect.net':80
- 'fo####dperfect.net':80
- 'an####perfect.net':80
- 'gl####erfect.net':80
- 'gl###heart.net':80
- 'fo####dbattle.net':80
- 'an###rheart.net':80
TCP:
HTTP GET requests:
- http://or###mayor.net/forum/search.php?em##############################
- http://re####emayor.net/forum/search.php?em##############################
- http://re####eperfect.net/forum/search.php?em##############################
- http://re####eheart.net/forum/search.php?em##############################
- http://or####erfect.net/forum/search.php?em##############################
- http://he###nheart.net/forum/search.php?em##############################
- http://le####perfect.net/forum/search.php?em##############################
- http://le###rheart.net/forum/search.php?em##############################
- http://or###battle.net/forum/search.php?em##############################
- http://re####ebattle.net/forum/search.php?em##############################
- http://pl####ntperfect.net/forum/search.php?em##############################
- http://ne#####ryperfect.net/forum/search.php?em##############################
- http://ne####aryheart.net/forum/search.php?em##############################
- http://he###battle.net/forum/search.php?em##############################
- http://pl####ntheart.net/forum/search.php?em##############################
- http://ne####arybattle.net/forum/search.php?em##############################
- http://or###heart.net/forum/search.php?em##############################
- http://pl####ntbattle.net/forum/search.php?em##############################
- http://pl####ntmayor.net/forum/search.php?em##############################
- http://ne####arymayor.net/forum/search.php?em##############################
- http://va####smayor.net/forum/search.php?em##############################
- http://re###nmayor.net/forum/search.php?em##############################
- http://re####perfect.net/forum/search.php?em##############################
- http://re###nheart.net/forum/search.php?em##############################
- http://va####sperfect.net/forum/search.php?em##############################
- http://hu#####understand.net/forum/search.php?em##############################
- http://jo####ybroad.net/forum/search.php?em##############################
- http://jo#####understand.net/forum/search.php?em##############################
- http://va####sbattle.net/forum/search.php?em##############################
- http://re####battle.net/forum/search.php?em##############################
- http://le####battle.net/forum/search.php?em##############################
- http://he####battle.net/forum/search.php?em##############################
- http://he###nmayor.net/forum/search.php?em##############################
- http://he####perfect.net/forum/search.php?em##############################
- http://le###rmayor.net/forum/search.php?em##############################
- http://ge####battle.net/forum/search.php?em##############################
- http://va####sheart.net/forum/search.php?em##############################
- http://ge###emayor.net/forum/search.php?em##############################
- http://ge###eheart.net/forum/search.php?em##############################
- http://ge####perfect.net/forum/search.php?em##############################
- http://di####ultbattle.net/forum/search.php?em##############################
- http://re####pleasure.net/forum/search.php?em##############################
- http://va####smillion.net/forum/search.php?em##############################
- http://va####spleasure.net/forum/search.php?em##############################
- http://va####stoward.net/forum/search.php?em##############################
- http://re####toward.net/forum/search.php?em##############################
- http://de###eheart.net/forum/search.php?em##############################
- http://fo####dheart.net/forum/search.php?em##############################
- http://re###nwhite.net/forum/search.php?em##############################
- http://re####million.net/forum/search.php?em##############################
- http://va####swhite.net/forum/search.php?em##############################
- http://ge####toward.net/forum/search.php?em##############################
- http://he####leasure.net/forum/search.php?em##############################
- http://he###toward.net/forum/search.php?em##############################
- http://le###rwhite.net/forum/search.php?em##############################
- http://he###nwhite.net/forum/search.php?em##############################
- http://he###white.net/forum/search.php?em##############################
- http://ge###ewhite.net/forum/search.php?em##############################
- http://ge####million.net/forum/search.php?em##############################
- http://ge####pleasure.net/forum/search.php?em##############################
- http://he####illion.net/forum/search.php?em##############################
- http://gl###battle.net/forum/search.php?em##############################
- http://di####ultheart.net/forum/search.php?em##############################
- http://an####battle.net/forum/search.php?em##############################
- http://an###rmayor.net/forum/search.php?em##############################
- http://gl###mayor.net/forum/search.php?em##############################
- http://di####ultmayor.net/forum/search.php?em##############################
- http://he###mayor.net/forum/search.php?em##############################
- http://he####erfect.net/forum/search.php?em##############################
- http://he###heart.net/forum/search.php?em##############################
- http://di#####ltperfect.net/forum/search.php?em##############################
- http://fo####dmayor.net/forum/search.php?em##############################
- http://de####battle.net/forum/search.php?em##############################
- http://de###emayor.net/forum/search.php?em##############################
- http://de####perfect.net/forum/search.php?em##############################
- http://fo####dperfect.net/forum/search.php?em##############################
- http://an####perfect.net/forum/search.php?em##############################
- http://gl####erfect.net/forum/search.php?em##############################
- http://gl###heart.net/forum/search.php?em##############################
- http://fo####dbattle.net/forum/search.php?em##############################
- http://an###rheart.net/forum/search.php?em##############################
UDP:
- DNS ASK or###mayor.net
- DNS ASK re####emayor.net
- DNS ASK re####eperfect.net
- DNS ASK re####eheart.net
- DNS ASK or####erfect.net
- DNS ASK he###nheart.net
- DNS ASK le####perfect.net
- DNS ASK le###rheart.net
- DNS ASK or###battle.net
- DNS ASK re####ebattle.net
- DNS ASK pl####ntperfect.net
- DNS ASK ne#####ryperfect.net
- DNS ASK ne####aryheart.net
- DNS ASK he###battle.net
- DNS ASK pl####ntheart.net
- DNS ASK ne####arybattle.net
- DNS ASK or###heart.net
- DNS ASK pl####ntbattle.net
- DNS ASK pl####ntmayor.net
- DNS ASK ne####arymayor.net
- DNS ASK va####smayor.net
- DNS ASK re###nmayor.net
- DNS ASK re####perfect.net
- DNS ASK re###nheart.net
- DNS ASK va####sperfect.net
- DNS ASK hu#####understand.net
- DNS ASK jo####ybroad.net
- DNS ASK jo#####understand.net
- DNS ASK va####sbattle.net
- DNS ASK re####battle.net
- DNS ASK le####battle.net
- DNS ASK he####battle.net
- DNS ASK he###nmayor.net
- DNS ASK he####perfect.net
- DNS ASK le###rmayor.net
- DNS ASK ge####battle.net
- DNS ASK va####sheart.net
- DNS ASK ge###emayor.net
- DNS ASK ge###eheart.net
- DNS ASK ge####perfect.net
- DNS ASK di####ultbattle.net
- DNS ASK re####pleasure.net
- DNS ASK va####smillion.net
- DNS ASK va####spleasure.net
- DNS ASK va####stoward.net
- DNS ASK re####toward.net
- DNS ASK de###eheart.net
- DNS ASK fo####dheart.net
- DNS ASK re###nwhite.net
- DNS ASK re####million.net
- DNS ASK va####swhite.net
- DNS ASK ge####toward.net
- DNS ASK he####leasure.net
- DNS ASK he###toward.net
- DNS ASK le###rwhite.net
- DNS ASK he###nwhite.net
- DNS ASK he###white.net
- DNS ASK ge###ewhite.net
- DNS ASK ge####million.net
- DNS ASK ge####pleasure.net
- DNS ASK he####illion.net
- DNS ASK gl###battle.net
- DNS ASK di####ultheart.net
- DNS ASK an####battle.net
- DNS ASK an###rmayor.net
- DNS ASK gl###mayor.net
- DNS ASK di####ultmayor.net
- DNS ASK he###mayor.net
- DNS ASK he####erfect.net
- DNS ASK he###heart.net
- DNS ASK di#####ltperfect.net
- DNS ASK fo####dmayor.net
- DNS ASK de####battle.net
- DNS ASK de###emayor.net
- DNS ASK de####perfect.net
- DNS ASK fo####dperfect.net
- DNS ASK an####perfect.net
- DNS ASK gl####erfect.net
- DNS ASK gl###heart.net
- DNS ASK fo####dbattle.net
- DNS ASK an###rheart.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
