Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SNMP Task Tracking Block Encrypting DNS' = '<SYSTEM32>\omatixtlt.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Coordinator Base Process] 'ImagePath' = '<SYSTEM32>\omatixtlt.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Coordinator Base Process] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\fufgcmle.exe' "<SYSTEM32>\omatixtlt.exe"
- '%WINDIR%\Temp\opgzfouh2zvoauxdq.exe' -r 43619 tcp
- '%TEMP%\opgzfouh2plgauxdqyeofdo0.exe'
- '<SYSTEM32>\omatixtlt.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\enkfiqypmltu\run
- <SYSTEM32>\enkfiqypmltu\rng
- %WINDIR%\Temp\opgzfouh2zvoauxdq.exe
- <SYSTEM32>\enkfiqypmltu\cfg
- <SYSTEM32>\fufgcmle.exe
- %TEMP%\opgzfouh2plgauxdqyeofdo0.exe
- <SYSTEM32>\enkfiqypmltu\tst
- <SYSTEM32>\omatixtlt.exe
- <SYSTEM32>\enkfiqypmltu\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\fufgcmle.exe
- <SYSTEM32>\omatixtlt.exe
Deletes the following files:
- %WINDIR%\Temp\opgzfouh2zvoauxdq.exe
- <DRIVERS>\etc\hosts
- %TEMP%\opgzfouh2plgauxdqyeofdo0.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'so###wild.net':80
- 'fa###hurry.net':80
- 'so###june.net':80
- 'fi###wild.net':80
- 'ri###urry.net':80
- 'fa###left.net':80
- 'ri###eft.net':80
- 'fa####hirteen.net':80
- 'ri####irteen.net':80
- 'li###ild.net':80
- 'th###wild.net':80
- 'li###une.net':80
- 'th###june.net':80
- 'fi###kind.net':80
- 'so###began.net':80
- 'fi###june.net':80
- 'so###kind.net':80
- 'fi###began.net':80
- 'ab###ell.net':80
- 'mi###hown.net':80
- 'pr####tbottom.net':80
- 'mo###olor.net':80
- 'mo###ugust.net':80
- 'jo####ymeasure.net':80
- 'ef###tbuilt.net':80
- 'le###form.net':80
- 'cr#####onaraminta.net':80
- 'no###urry.net':80
- 'we###urry.net':80
- 'fa###hope.net':80
- 'ri###ope.net':80
- 'no####irteen.net':80
- 'al###being.net':80
- 'ca####nbring.net':80
- 'we####irteen.net':80
- 'ri###nstorm.net':80
TCP:
HTTP GET requests:
- http://so###wild.net/index.php
- http://fa###hurry.net/index.php
- http://so###june.net/index.php
- http://fi###wild.net/index.php
- http://ri###urry.net/index.php
- http://fa###left.net/index.php
- http://ri###eft.net/index.php
- http://fa####hirteen.net/index.php
- http://ri####irteen.net/index.php
- http://li###ild.net/index.php
- http://th###wild.net/index.php
- http://li###une.net/index.php
- http://th###june.net/index.php
- http://fi###kind.net/index.php
- http://so###began.net/index.php
- http://fi###june.net/index.php
- http://so###kind.net/index.php
- http://fi###began.net/index.php
- http://ab###ell.net/index.php
- http://mi###hown.net/index.php
- http://pr####tbottom.net/index.php
- http://mo###olor.net/index.php
- http://mo###ugust.net/index.php
- http://jo####ymeasure.net/index.php
- http://ef###tbuilt.net/index.php
- http://le###form.net/index.php
- http://cr#####onaraminta.net/index.php
- http://no###urry.net/index.php
- http://we###urry.net/index.php
- http://fa###hope.net/index.php
- http://ri###ope.net/index.php
- http://no####irteen.net/index.php
- http://al###being.net/index.php
- http://ca####nbring.net/index.php
- http://we####irteen.net/index.php
- http://ri###nstorm.net/index.php
UDP:
- DNS ASK so###wild.net
- DNS ASK fa###hurry.net
- DNS ASK so###june.net
- DNS ASK fi###wild.net
- DNS ASK ri###urry.net
- DNS ASK fa###left.net
- DNS ASK ri###eft.net
- DNS ASK fa####hirteen.net
- DNS ASK ri####irteen.net
- DNS ASK fi###june.net
- DNS ASK th###june.net
- DNS ASK li###ild.net
- DNS ASK th###began.net
- DNS ASK li###une.net
- DNS ASK th###wild.net
- DNS ASK fi###began.net
- DNS ASK so###began.net
- DNS ASK fi###kind.net
- DNS ASK so###kind.net
- DNS ASK fa###hope.net
- DNS ASK mi###hown.net
- DNS ASK mo###ugust.net
- DNS ASK mo###olor.net
- DNS ASK ab###ell.net
- DNS ASK le###form.net
- DNS ASK th###while.net
- DNS ASK ef###tbuilt.net
- DNS ASK cr#####onaraminta.net
- DNS ASK jo####ymeasure.net
- DNS ASK we###urry.net
- DNS ASK no####irteen.net
- DNS ASK ri###ope.net
- DNS ASK no###urry.net
- DNS ASK we####irteen.net
- DNS ASK ca####nbring.net
- DNS ASK pr####tbottom.net
- DNS ASK ri###nstorm.net
- DNS ASK al###being.net
- '23#.#55.255.250':1900
