Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Intelligent Image Foundation Time' = 'C:\ofamuqq\nsqspudchcx.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Machine Service Drive Copy] 'ImagePath' = 'C:\ofamuqq\nsqspudchcx.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Machine Service Drive Copy] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\ofamuqq\wpodaavyanu.exe' "c:\ofamuqq\nsqspudchcx.exe"
- 'C:\ofamuqq\nsqspudchcx.exe'
- 'C:\ofamuqq\uqokk2g4brbirqibv.exe'
Modifies file system:
Creates the following files:
- C:\ofamuqq\nsqspudchcx.exe
- C:\ofamuqq\wpodaavyanu.exe
- C:\ofamuqq\uqokk2g4brbirqibv.exe
- %WINDIR%\ofamuqq\tezpible2r
- C:\ofamuqq\tezpible2r
Sets the 'hidden' attribute to the following files:
- C:\ofamuqq\wpodaavyanu.exe
- C:\ofamuqq\nsqspudchcx.exe
Deletes the following files:
- C:\ofamuqq\uqokk2g4brbirqibv.exe
- %WINDIR%\ofamuqq\tezpible2r
Network activity:
Connects to:
- 'ex####divide.net':80
- 'be####ebottle.net':80
- 'be####edivide.net':80
- 'ma####estream.net':80
- 'pe####stream.net':80
- 'be####estream.net':80
- 'ex####stream.net':80
- 'ex####nothing.net':80
- 'ex####bottle.net':80
- 'be####enothing.net':80
- 'su####stream.net':80
- 'ma####edivide.net':80
- 'fo####nstream.net':80
- 'fo####nnothing.net':80
- 'su####nothing.net':80
- 'ma####enothing.net':80
- 'pe####nothing.net':80
- 'pe####bottle.net':80
- 'pe####divide.net':80
- 'ma####ebottle.net':80
- 'ch####enpaint.net':80
- 'fa###yclean.net':80
- 'fa###ypaint.net':80
- 'fa####course.net':80
- 'ch####encourse.net':80
- 'ci####ttecourse.net':80
- 'pi####ecourse.net':80
- 'pi####ewomen.net':80
- 'ch####enclean.net':80
- 'ci####ttewomen.net':80
- 'ei####course.net':80
- 'en####hpaint.net':80
- 'en####hcourse.net':80
- 'en####hwomen.net':80
- 'ei###rwomen.net':80
- 'fa###ywomen.net':80
- 'ch####enwomen.net':80
- 'ei###rclean.net':80
- 'ei###rpaint.net':80
- 'en####hclean.net':80
TCP:
HTTP GET requests:
- http://ex####divide.net/index.php
- http://be####ebottle.net/index.php
- http://be####edivide.net/index.php
- http://ma####estream.net/index.php
- http://pe####stream.net/index.php
- http://be####estream.net/index.php
- http://ex####stream.net/index.php
- http://ex####nothing.net/index.php
- http://ex####bottle.net/index.php
- http://be####enothing.net/index.php
- http://su####stream.net/index.php
- http://ma####edivide.net/index.php
- http://fo####nstream.net/index.php
- http://fo####nnothing.net/index.php
- http://su####nothing.net/index.php
- http://ma####enothing.net/index.php
- http://pe####nothing.net/index.php
- http://pe####bottle.net/index.php
- http://pe####divide.net/index.php
- http://ma####ebottle.net/index.php
- http://ch####enpaint.net/index.php
- http://fa###yclean.net/index.php
- http://fa###ypaint.net/index.php
- http://fa####course.net/index.php
- http://ch####encourse.net/index.php
- http://ci####ttecourse.net/index.php
- http://pi####ecourse.net/index.php
- http://pi####ewomen.net/index.php
- http://ch####enclean.net/index.php
- http://ci####ttewomen.net/index.php
- http://ei####course.net/index.php
- http://en####hpaint.net/index.php
- http://en####hcourse.net/index.php
- http://en####hwomen.net/index.php
- http://ei###rwomen.net/index.php
- http://fa###ywomen.net/index.php
- http://ch####enwomen.net/index.php
- http://ei###rclean.net/index.php
- http://ei###rpaint.net/index.php
- http://en####hclean.net/index.php
UDP:
- DNS ASK be####edivide.net
- DNS ASK ex####divide.net
- DNS ASK pe####stream.net
- DNS ASK pe####nothing.net
- DNS ASK ma####estream.net
- DNS ASK ex####nothing.net
- DNS ASK be####estream.net
- DNS ASK be####enothing.net
- DNS ASK be####ebottle.net
- DNS ASK ex####bottle.net
- DNS ASK fo####nstream.net
- DNS ASK su####stream.net
- DNS ASK su####nothing.net
- DNS ASK su####bottle.net
- DNS ASK fo####nnothing.net
- DNS ASK pe####bottle.net
- DNS ASK ma####enothing.net
- DNS ASK ma####ebottle.net
- DNS ASK ma####edivide.net
- DNS ASK pe####divide.net
- DNS ASK ex####stream.net
- DNS ASK ch####enpaint.net
- DNS ASK fa###yclean.net
- DNS ASK fa###ypaint.net
- DNS ASK fa####course.net
- DNS ASK ch####encourse.net
- DNS ASK ci####ttecourse.net
- DNS ASK pi####ecourse.net
- DNS ASK pi####ewomen.net
- DNS ASK ch####enclean.net
- DNS ASK ci####ttewomen.net
- DNS ASK ei####course.net
- DNS ASK en####hpaint.net
- DNS ASK en####hcourse.net
- DNS ASK en####hwomen.net
- DNS ASK ei###rwomen.net
- DNS ASK fa###ywomen.net
- DNS ASK ch####enwomen.net
- DNS ASK ei###rclean.net
- DNS ASK ei###rpaint.net
- DNS ASK en####hclean.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
