Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Tracking Visual Desktop Enumerator' = '%APPDATA%\zmttncjbhs\jhdehooplft.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\zmttncjbhs\hfvtsxh.exe' "%APPDATA%\zmttncjbhs\jhdehooplft.exe"
- '%APPDATA%\zmttncjbhs\jhdehooplft.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\zmttncjbhs\jhdehooplft.qgun
- %APPDATA%\zmttncjbhs\hfvtsxh.exe
- %APPDATA%\zmttncjbhs\jhdehooplft.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\zmttncjbhs\hfvtsxh.exe
- %APPDATA%\zmttncjbhs\jhdehooplft.exe
Network activity:
Connects to:
- 'el####icspecial.net':80
- 're####corner.net':80
- 'el####icminute.net':80
- 're####special.net':80
- 'el####iccorner.net':80
- 'st####minute.net':80
- 'tr###minute.net':80
- 'st####flower.net':80
- 'tr###flower.net':80
- 're####minute.net':80
- 'ca####nminute.net':80
- 'la####pecial.net':80
- 'ca####nflower.net':80
- 'la###minute.net':80
- 'ca####nspecial.net':80
- 're####flower.net':80
- 'el####icflower.net':80
- 'la###corner.net':80
- 'ca####ncorner.net':80
- 'st####special.net':80
- 'br###flower.net':80
- 'fl###minute.net':80
- 'ga####corner.net':80
- 'fl###flower.net':80
- 'br###minute.net':80
- 'fl###corner.net':80
- 'br###corner.net':80
- 'fl####pecial.net':80
- 'br####pecial.net':80
- 'be####corner.net':80
- 'tr###corner.net':80
- 'be####flower.net':80
- 'tr####pecial.net':80
- 'st####corner.net':80
- 'ga####flower.net':80
- 'be####special.net':80
- 'ga####special.net':80
- 'be####minute.net':80
- 'ga####minute.net':80
- 'fl###bottom.net':80
- 'br###bottom.net':80
- 'fl####orever.net':80
- 'br####orever.net':80
- 'qu###beyond.net':80
- 'se###nbeing.net':80
- 'qu####orever.net':80
- 'se####beyond.net':80
- 'qu###being.net':80
- 'br###being.net':80
- 'be####forever.net':80
- 'ga####forever.net':80
- 'be###rbeing.net':80
- 'ga###rbeing.net':80
- 'be####bottom.net':80
- 'br###beyond.net':80
- 'fl###being.net':80
- 'ga####bottom.net':80
- 'fl###beyond.net':80
- 'se####forever.net':80
- 'ni###minute.net':80
- 'de####minute.net':80
- 'ni###flower.net':80
- 'de####flower.net':80
- 'ni####pecial.net':80
- 'de####corner.net':80
- 'la###flower.net':80
- 'de####special.net':80
- 'ni###corner.net':80
- 'do###corner.net':80
- 'ag####tflower.net':80
- 'do###flower.net':80
- 'qu###bottom.net':80
- 'se####bottom.net':80
- 'ag####tminute.net':80
- 'do####pecial.net':80
- 'ag####tcorner.net':80
- 'do###minute.net':80
- 'ag####tspecial.net':80
TCP:
HTTP GET requests:
- http://el####icspecial.net/forum/search.php?em######################################
- http://re####corner.net/forum/search.php?em######################################
- http://el####icminute.net/forum/search.php?em######################################
- http://re####special.net/forum/search.php?em######################################
- http://el####iccorner.net/forum/search.php?em######################################
- http://st####minute.net/forum/search.php?em######################################
- http://tr###minute.net/forum/search.php?em######################################
- http://st####flower.net/forum/search.php?em######################################
- http://tr###flower.net/forum/search.php?em######################################
- http://re####minute.net/forum/search.php?em######################################
- http://ca####nminute.net/forum/search.php?em######################################
- http://la####pecial.net/forum/search.php?em######################################
- http://ca####nflower.net/forum/search.php?em######################################
- http://la###minute.net/forum/search.php?em######################################
- http://ca####nspecial.net/forum/search.php?em######################################
- http://re####flower.net/forum/search.php?em######################################
- http://el####icflower.net/forum/search.php?em######################################
- http://la###corner.net/forum/search.php?em######################################
- http://ca####ncorner.net/forum/search.php?em######################################
- http://st####special.net/forum/search.php?em######################################
- http://br###flower.net/forum/search.php?em######################################
- http://fl###minute.net/forum/search.php?em######################################
- http://ga####corner.net/forum/search.php?em######################################
- http://fl###flower.net/forum/search.php?em######################################
- http://br###minute.net/forum/search.php?em######################################
- http://fl###corner.net/forum/search.php?em######################################
- http://br###corner.net/forum/search.php?em######################################
- http://fl####pecial.net/forum/search.php?em######################################
- http://br####pecial.net/forum/search.php?em######################################
- http://be####corner.net/forum/search.php?em######################################
- http://tr###corner.net/forum/search.php?em######################################
- http://be####flower.net/forum/search.php?em######################################
- http://tr####pecial.net/forum/search.php?em######################################
- http://st####corner.net/forum/search.php?em######################################
- http://ga####flower.net/forum/search.php?em######################################
- http://be####special.net/forum/search.php?em######################################
- http://ga####special.net/forum/search.php?em######################################
- http://be####minute.net/forum/search.php?em######################################
- http://ga####minute.net/forum/search.php?em######################################
- http://fl###bottom.net/forum/search.php?em######################################
- http://br###bottom.net/forum/search.php?em######################################
- http://fl####orever.net/forum/search.php?em######################################
- http://br####orever.net/forum/search.php?em######################################
- http://qu###beyond.net/forum/search.php?em######################################
- http://se###nbeing.net/forum/search.php?em######################################
- http://qu####orever.net/forum/search.php?em######################################
- http://se####beyond.net/forum/search.php?em######################################
- http://qu###being.net/forum/search.php?em######################################
- http://br###being.net/forum/search.php?em######################################
- http://be####forever.net/forum/search.php?em######################################
- http://ga####forever.net/forum/search.php?em######################################
- http://be###rbeing.net/forum/search.php?em######################################
- http://ga###rbeing.net/forum/search.php?em######################################
- http://be####bottom.net/forum/search.php?em######################################
- http://br###beyond.net/forum/search.php?em######################################
- http://fl###being.net/forum/search.php?em######################################
- http://ga####bottom.net/forum/search.php?em######################################
- http://fl###beyond.net/forum/search.php?em######################################
- http://se####forever.net/forum/search.php?em######################################
- http://ni###minute.net/forum/search.php?em######################################
- http://de####minute.net/forum/search.php?em######################################
- http://ni###flower.net/forum/search.php?em######################################
- http://de####flower.net/forum/search.php?em######################################
- http://ni####pecial.net/forum/search.php?em######################################
- http://de####corner.net/forum/search.php?em######################################
- http://la###flower.net/forum/search.php?em######################################
- http://de####special.net/forum/search.php?em######################################
- http://ni###corner.net/forum/search.php?em######################################
- http://do###corner.net/forum/search.php?em######################################
- http://ag####tflower.net/forum/search.php?em######################################
- http://do###flower.net/forum/search.php?em######################################
- http://qu###bottom.net/forum/search.php?em######################################
- http://se####bottom.net/forum/search.php?em######################################
- http://ag####tminute.net/forum/search.php?em######################################
- http://do####pecial.net/forum/search.php?em######################################
- http://ag####tcorner.net/forum/search.php?em######################################
- http://do###minute.net/forum/search.php?em######################################
- http://ag####tspecial.net/forum/search.php?em######################################
UDP:
- DNS ASK re####corner.net
- DNS ASK el####iccorner.net
- DNS ASK re####special.net
- DNS ASK el####icspecial.net
- DNS ASK st####flower.net
- DNS ASK tr###minute.net
- DNS ASK st####special.net
- DNS ASK tr###flower.net
- DNS ASK st####minute.net
- DNS ASK el####icminute.net
- DNS ASK la####pecial.net
- DNS ASK ca####nspecial.net
- DNS ASK la###minute.net
- DNS ASK ca####nminute.net
- DNS ASK la###corner.net
- DNS ASK el####icflower.net
- DNS ASK re####minute.net
- DNS ASK ca####ncorner.net
- DNS ASK re####flower.net
- DNS ASK tr####pecial.net
- DNS ASK fl###minute.net
- DNS ASK br###minute.net
- DNS ASK fl###flower.net
- DNS ASK br###flower.net
- DNS ASK fl####pecial.net
- DNS ASK br###corner.net
- DNS ASK qu###flower.net
- DNS ASK br####pecial.net
- DNS ASK fl###corner.net
- DNS ASK ga####corner.net
- DNS ASK be####flower.net
- DNS ASK ga####flower.net
- DNS ASK st####corner.net
- DNS ASK tr###corner.net
- DNS ASK be####minute.net
- DNS ASK ga####special.net
- DNS ASK be####corner.net
- DNS ASK ga####minute.net
- DNS ASK be####special.net
- DNS ASK ca####nflower.net
- DNS ASK fl###bottom.net
- DNS ASK br###bottom.net
- DNS ASK fl####orever.net
- DNS ASK br####orever.net
- DNS ASK qu###beyond.net
- DNS ASK se###nbeing.net
- DNS ASK qu####orever.net
- DNS ASK se####beyond.net
- DNS ASK qu###being.net
- DNS ASK br###being.net
- DNS ASK be####forever.net
- DNS ASK ga####forever.net
- DNS ASK be###rbeing.net
- DNS ASK ga###rbeing.net
- DNS ASK be####bottom.net
- DNS ASK br###beyond.net
- DNS ASK fl###being.net
- DNS ASK ga####bottom.net
- DNS ASK fl###beyond.net
- DNS ASK se####forever.net
- DNS ASK ni###minute.net
- DNS ASK de####minute.net
- DNS ASK ni###flower.net
- DNS ASK de####flower.net
- DNS ASK ni####pecial.net
- DNS ASK de####corner.net
- DNS ASK la###flower.net
- DNS ASK de####special.net
- DNS ASK ni###corner.net
- DNS ASK do###corner.net
- DNS ASK ag####tflower.net
- DNS ASK do###flower.net
- DNS ASK qu###bottom.net
- DNS ASK se####bottom.net
- DNS ASK ag####tminute.net
- DNS ASK do####pecial.net
- DNS ASK ag####tcorner.net
- DNS ASK do###minute.net
- DNS ASK ag####tspecial.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
