Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Credential Background Endpoint Installer Process' = '<SYSTEM32>\xngeqobku.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\System PNRP Class IKE Copy Link] 'ImagePath' = '<SYSTEM32>\xngeqobku.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\System PNRP Class IKE Copy Link] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\sloysyepni.exe' "<SYSTEM32>\xngeqobku.exe"
- '%WINDIR%\Temp\gpifmr3ppdobn4.exe' -r 22818 tcp
- '%TEMP%\gpifmr3jd2obn4twvjiz.exe'
- '<SYSTEM32>\xngeqobku.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\prrdqwpfwbdk\run
- <SYSTEM32>\prrdqwpfwbdk\rng
- %WINDIR%\Temp\gpifmr3ppdobn4.exe
- <SYSTEM32>\prrdqwpfwbdk\cfg
- <SYSTEM32>\sloysyepni.exe
- %TEMP%\gpifmr3jd2obn4twvjiz.exe
- <SYSTEM32>\prrdqwpfwbdk\tst
- <SYSTEM32>\xngeqobku.exe
- <SYSTEM32>\prrdqwpfwbdk\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\sloysyepni.exe
- <SYSTEM32>\xngeqobku.exe
Deletes the following files:
- %WINDIR%\Temp\gpifmr3ppdobn4.exe
- <DRIVERS>\etc\hosts
- %TEMP%\gpifmr3jd2obn4twvjiz.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'ri###ear.net':80
- 'fa###find.net':80
- 'ri###ind.net':80
- 'fa###hurt.net':80
- 'ri###urt.net':80
- 'fa###wear.net':80
- 'fa###told.net':80
- 'we###old.net':80
- 'li###urt.net':80
- 'no###urt.net':80
- 'ri###old.net':80
- 'we###ear.net':80
- 'we###ind.net':80
- 'so###slow.net':80
- 'th####ebruary.net':80
- 'li###low.net':80
- 'th###slow.net':80
- 'li###elp.net':80
- 'th###help.net':80
- 'li####bruary.net':80
- 'fi####ovember.net':80
- 'fi####ebruary.net':80
- 'so####ebruary.net':80
- 'fi###slow.net':80
- 'so####ovember.net':80
- 'fi###help.net':80
- 'so###help.net':80
- 'ta###wear.net':80
- 'le###ind.net':80
- 'ta###find.net':80
- 'le###urt.net':80
- 'ta###hurt.net':80
- 'le###ear.net':80
- 'le###old.net':80
- 'be##lxc.com':80
- 'af###sllc.com':80
- 'ri###nstorm.net':80
- 'ta###told.net':80
- 'we###urt.net':80
- 'de###lxc.com':80
- 'po###told.net':80
- 'no###ind.net':80
- 'li###old.net':80
- 'no###old.net':80
- 'li###ear.net':80
- 'no###ear.net':80
- 'li###ind.net':80
- 'ca###urt.net':80
- 'ca###ind.net':80
- 'po###find.net':80
- 'ca###old.net':80
- 'po###hurt.net':80
- 'ca###ear.net':80
- 'po###wear.net':80
TCP:
HTTP GET requests:
- http://ri###ear.net/index.php
- http://fa###find.net/index.php
- http://ri###ind.net/index.php
- http://fa###hurt.net/index.php
- http://ri###urt.net/index.php
- http://fa###wear.net/index.php
- http://fa###told.net/index.php
- http://we###old.net/index.php
- http://li###urt.net/index.php
- http://no###urt.net/index.php
- http://ri###old.net/index.php
- http://we###ear.net/index.php
- http://we###ind.net/index.php
- http://so###slow.net/index.php
- http://th####ebruary.net/index.php
- http://li###low.net/index.php
- http://th###slow.net/index.php
- http://li###elp.net/index.php
- http://th###help.net/index.php
- http://li####bruary.net/index.php
- http://fi####ovember.net/index.php
- http://fi####ebruary.net/index.php
- http://so####ebruary.net/index.php
- http://fi###slow.net/index.php
- http://so####ovember.net/index.php
- http://fi###help.net/index.php
- http://so###help.net/index.php
- http://ta###wear.net/index.php
- http://le###ind.net/index.php
- http://ta###find.net/index.php
- http://le###urt.net/index.php
- http://ta###hurt.net/index.php
- http://le###ear.net/index.php
- http://le###old.net/index.php
- http://be##lxc.com/index.php
- http://af###sllc.com/index.php
- http://ri###nstorm.net/index.php
- http://ta###told.net/index.php
- http://we###urt.net/index.php
- http://de###lxc.com/index.php
- http://po###told.net/index.php
- http://no###ind.net/index.php
- http://li###old.net/index.php
- http://no###old.net/index.php
- http://li###ear.net/index.php
- http://no###ear.net/index.php
- http://li###ind.net/index.php
- http://ca###urt.net/index.php
- http://ca###ind.net/index.php
- http://po###find.net/index.php
- http://ca###old.net/index.php
- http://po###hurt.net/index.php
- http://ca###ear.net/index.php
- http://po###wear.net/index.php
UDP:
- DNS ASK ri###ear.net
- DNS ASK fa###find.net
- DNS ASK ri###ind.net
- DNS ASK fa###hurt.net
- DNS ASK ri###urt.net
- DNS ASK fa###wear.net
- DNS ASK fa###told.net
- DNS ASK we###old.net
- DNS ASK li###urt.net
- DNS ASK no###urt.net
- DNS ASK ri###old.net
- DNS ASK we###ear.net
- DNS ASK we###ind.net
- DNS ASK so###slow.net
- DNS ASK th####ebruary.net
- DNS ASK li###low.net
- DNS ASK th###slow.net
- DNS ASK li###elp.net
- DNS ASK th###help.net
- DNS ASK li####bruary.net
- DNS ASK fi####ovember.net
- DNS ASK fi####ebruary.net
- DNS ASK so####ebruary.net
- DNS ASK fi###slow.net
- DNS ASK so####ovember.net
- DNS ASK fi###help.net
- DNS ASK so###help.net
- DNS ASK li###ear.net
- DNS ASK ta###wear.net
- DNS ASK le###ind.net
- DNS ASK ta###find.net
- DNS ASK le###urt.net
- DNS ASK ta###hurt.net
- DNS ASK le###ear.net
- DNS ASK le###old.net
- DNS ASK be##lxc.com
- DNS ASK af###sllc.com
- DNS ASK ri###nstorm.net
- DNS ASK ta###told.net
- DNS ASK we###urt.net
- DNS ASK de###lxc.com
- DNS ASK li###old.net
- DNS ASK no###old.net
- DNS ASK ca###urt.net
- DNS ASK no###ear.net
- DNS ASK li###ind.net
- DNS ASK no###ind.net
- DNS ASK po###hurt.net
- DNS ASK po###find.net
- DNS ASK ca###old.net
- DNS ASK po###told.net
- DNS ASK ca###ear.net
- DNS ASK po###wear.net
- DNS ASK ca###ind.net
- '23#.#55.255.250':1900
