Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'User-mode Browser Performance' = 'C:\alzjays\nivwgpoog.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Reports Play Services Virtual SPP Card Logon] 'ImagePath' = 'C:\alzjays\nivwgpoog.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Reports Play Services Virtual SPP Card Logon] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\alzjays\hcqfhrtn.exe' "c:\alzjays\nivwgpoog.exe"
- 'C:\alzjays\nivwgpoog.exe'
- 'C:\alzjays\owm2m98xjpyqlklax.exe'
Modifies file system:
Creates the following files:
- C:\alzjays\nivwgpoog.exe
- C:\alzjays\hcqfhrtn.exe
- C:\alzjays\owm2m98xjpyqlklax.exe
- %WINDIR%\alzjays\nuaj6kxe
- C:\alzjays\nuaj6kxe
Sets the 'hidden' attribute to the following files:
- C:\alzjays\hcqfhrtn.exe
- C:\alzjays\nivwgpoog.exe
Deletes the following files:
- C:\alzjays\owm2m98xjpyqlklax.exe
- %WINDIR%\alzjays\nuaj6kxe
Network activity:
Connects to:
- 'th####haracter.net':80
- 'cl####ealize.net':80
- 'th####ealize.net':80
- 'pr####tladder.net':80
- 'th###ladder.net':80
- 'pr#####character.net':80
- 'th####ritten.net':80
- 'cl###shore.net':80
- 'th###shore.net':80
- 'cl###dollar.net':80
- 'th###dollar.net':80
- 'cl####ritten.net':80
- 'th###board.net':80
- 'co####eboard.net':80
- 'ch###board.net':80
- 'co####eladder.net':80
- 'of####haracter.net':80
- 'co####eenter.net':80
- 'ch###enter.net':80
- 'pr####tenter.net':80
- 'th###enter.net':80
- 'pr####tboard.net':80
- 'ch###ladder.net':80
- 'co#####character.net':80
- 'ch####haracter.net':80
- 'mo####grealize.net':80
- 'ra####realize.net':80
- 'mo####gdollar.net':80
- 'st####ewritten.net':80
- 'hi####yshore.net':80
- 'st####eshore.net':80
- 'mo####gshore.net':80
- 'ra###rshore.net':80
- 'tw####realize.net':80
- 'ra####dollar.net':80
- 'mo####gwritten.net':80
- 'ra####written.net':80
- 'hi####ywritten.net':80
- 'am####dollar.net':80
- 'we####rwritten.net':80
- 'am####written.net':80
- 'we####rrealize.net':80
- 'am####realize.net':80
- 'we####rdollar.net':80
- 'st####erealize.net':80
- 'hi####ydollar.net':80
- 'st####edollar.net':80
- 'we####rshore.net':80
- 'am###tshore.net':80
- 'hi####yrealize.net':80
TCP:
HTTP GET requests:
- http://th####haracter.net/index.php
- http://cl####ealize.net/index.php
- http://th####ealize.net/index.php
- http://pr####tladder.net/index.php
- http://th###ladder.net/index.php
- http://pr#####character.net/index.php
- http://th####ritten.net/index.php
- http://cl###shore.net/index.php
- http://th###shore.net/index.php
- http://cl###dollar.net/index.php
- http://th###dollar.net/index.php
- http://cl####ritten.net/index.php
- http://th###board.net/index.php
- http://co####eboard.net/index.php
- http://ch###board.net/index.php
- http://co####eladder.net/index.php
- http://of####haracter.net/index.php
- http://co####eenter.net/index.php
- http://ch###enter.net/index.php
- http://pr####tenter.net/index.php
- http://th###enter.net/index.php
- http://pr####tboard.net/index.php
- http://ch###ladder.net/index.php
- http://co#####character.net/index.php
- http://ch####haracter.net/index.php
- http://mo####grealize.net/index.php
- http://ra####realize.net/index.php
- http://mo####gdollar.net/index.php
- http://st####ewritten.net/index.php
- http://hi####yshore.net/index.php
- http://st####eshore.net/index.php
- http://mo####gshore.net/index.php
- http://ra###rshore.net/index.php
- http://tw####realize.net/index.php
- http://ra####dollar.net/index.php
- http://mo####gwritten.net/index.php
- http://ra####written.net/index.php
- http://hi####ywritten.net/index.php
- http://am####dollar.net/index.php
- http://we####rwritten.net/index.php
- http://am####written.net/index.php
- http://we####rrealize.net/index.php
- http://am####realize.net/index.php
- http://we####rdollar.net/index.php
- http://st####erealize.net/index.php
- http://hi####ydollar.net/index.php
- http://st####edollar.net/index.php
- http://we####rshore.net/index.php
- http://am###tshore.net/index.php
- http://hi####yrealize.net/index.php
UDP:
- DNS ASK pr#####character.net
- DNS ASK th####haracter.net
- DNS ASK cl####ealize.net
- DNS ASK th###board.net
- DNS ASK pr####tladder.net
- DNS ASK th###ladder.net
- DNS ASK cl####ritten.net
- DNS ASK th####ritten.net
- DNS ASK cl###shore.net
- DNS ASK th####ealize.net
- DNS ASK cl###dollar.net
- DNS ASK th###dollar.net
- DNS ASK pr####tboard.net
- DNS ASK ch###enter.net
- DNS ASK co####eboard.net
- DNS ASK ch###board.net
- DNS ASK al####haracter.net
- DNS ASK of####haracter.net
- DNS ASK co####eenter.net
- DNS ASK ch####haracter.net
- DNS ASK pr####tenter.net
- DNS ASK th###enter.net
- DNS ASK co####eladder.net
- DNS ASK ch###ladder.net
- DNS ASK co#####character.net
- DNS ASK th###shore.net
- DNS ASK mo####grealize.net
- DNS ASK ra####realize.net
- DNS ASK mo####gdollar.net
- DNS ASK st####ewritten.net
- DNS ASK hi####yshore.net
- DNS ASK st####eshore.net
- DNS ASK mo####gshore.net
- DNS ASK ra###rshore.net
- DNS ASK tw####realize.net
- DNS ASK ra####dollar.net
- DNS ASK mo####gwritten.net
- DNS ASK ra####written.net
- DNS ASK hi####ywritten.net
- DNS ASK am####dollar.net
- DNS ASK we####rwritten.net
- DNS ASK am####written.net
- DNS ASK we####rrealize.net
- DNS ASK am####realize.net
- DNS ASK we####rdollar.net
- DNS ASK st####erealize.net
- DNS ASK hi####ydollar.net
- DNS ASK st####edollar.net
- DNS ASK we####rshore.net
- DNS ASK am###tshore.net
- DNS ASK hi####yrealize.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
