Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Solutions Publication WinHTTP' = '%APPDATA%\srkigyiri\qlkbiddkj.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\srkigyiri\mcjwweovpdx.exe' "%APPDATA%\srkigyiri\qlkbiddkj.exe"
- '%APPDATA%\srkigyiri\qlkbiddkj.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\srkigyiri\qlkbiddkj.alrw
- %APPDATA%\srkigyiri\mcjwweovpdx.exe
- %APPDATA%\srkigyiri\qlkbiddkj.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\srkigyiri\mcjwweovpdx.exe
- %APPDATA%\srkigyiri\qlkbiddkj.exe
Network activity:
Connects to:
- 'cl###listen.net':80
- 'th###listen.net':80
- 'cl###bring.net':80
- 'th###shout.net':80
- 'cl###demand.net':80
- 'th###demand.net':80
- 'th###bring.net':80
- 'am####demand.net':80
- 'we####rlisten.net':80
- 'am####listen.net':80
- 'we####rshout.net':80
- 'am###tshout.net':80
- 'we####rdemand.net':80
- 'ch####tation.net':80
- 'pr#####childhood.net':80
- 'th####hildhood.net':80
- 'co####ethird.net':80
- 'ch###third.net':80
- 'co####estation.net':80
- 'pr####tobject.net':80
- 'pr####tstation.net':80
- 'th####tation.net':80
- 'cl###shout.net':80
- 'th###object.net':80
- 'pr####tthird.net':80
- 'th###third.net':80
- 'we####rbring.net':80
- 'ra###rbring.net':80
- 'tw###eshout.net':80
- 'mi###eshout.net':80
- 'mo####glisten.net':80
- 'ra####listen.net':80
- 'mo####gbring.net':80
- 'tw####demand.net':80
- 'tw###ebring.net':80
- 'mi###ebring.net':80
- 'al###shout.net':80
- 'mi####demand.net':80
- 'tw####listen.net':80
- 'mi####listen.net':80
- 'hi####ydemand.net':80
- 'st####edemand.net':80
- 'hi####ylisten.net':80
- 'am###tbring.net':80
- 'hi####yshout.net':80
- 'st####eshout.net':80
- 'st####elisten.net':80
- 'ra###rshout.net':80
- 'mo####gdemand.net':80
- 'ra####demand.net':80
- 'hi####ybring.net':80
- 'st####ebring.net':80
- 'mo####gshout.net':80
TCP:
HTTP GET requests:
- http://cl###listen.net/forum/search.php?em##################################
- http://th###listen.net/forum/search.php?em##################################
- http://cl###bring.net/forum/search.php?em##################################
- http://th###shout.net/forum/search.php?em##################################
- http://cl###demand.net/forum/search.php?em##################################
- http://th###demand.net/forum/search.php?em##################################
- http://th###bring.net/forum/search.php?em##################################
- http://am####demand.net/forum/search.php?em##################################
- http://we####rlisten.net/forum/search.php?em##################################
- http://am####listen.net/forum/search.php?em##################################
- http://we####rshout.net/forum/search.php?em##################################
- http://am###tshout.net/forum/search.php?em##################################
- http://we####rdemand.net/forum/search.php?em##################################
- http://ch####tation.net/forum/search.php?em##################################
- http://pr#####childhood.net/forum/search.php?em##################################
- http://th####hildhood.net/forum/search.php?em##################################
- http://co####ethird.net/forum/search.php?em##################################
- http://ch###third.net/forum/search.php?em##################################
- http://co####estation.net/forum/search.php?em##################################
- http://pr####tobject.net/forum/search.php?em##################################
- http://pr####tstation.net/forum/search.php?em##################################
- http://th####tation.net/forum/search.php?em##################################
- http://cl###shout.net/forum/search.php?em##################################
- http://th###object.net/forum/search.php?em##################################
- http://pr####tthird.net/forum/search.php?em##################################
- http://th###third.net/forum/search.php?em##################################
- http://we####rbring.net/forum/search.php?em##################################
- http://ra###rbring.net/forum/search.php?em##################################
- http://tw###eshout.net/forum/search.php?em##################################
- http://mi###eshout.net/forum/search.php?em##################################
- http://mo####glisten.net/forum/search.php?em##################################
- http://ra####listen.net/forum/search.php?em##################################
- http://mo####gbring.net/forum/search.php?em##################################
- http://tw####demand.net/forum/search.php?em##################################
- http://tw###ebring.net/forum/search.php?em##################################
- http://mi###ebring.net/forum/search.php?em##################################
- http://al###shout.net/forum/search.php?em##################################
- http://mi####demand.net/forum/search.php?em##################################
- http://tw####listen.net/forum/search.php?em##################################
- http://mi####listen.net/forum/search.php?em##################################
- http://hi####ydemand.net/forum/search.php?em##################################
- http://st####edemand.net/forum/search.php?em##################################
- http://hi####ylisten.net/forum/search.php?em##################################
- http://am###tbring.net/forum/search.php?em##################################
- http://hi####yshout.net/forum/search.php?em##################################
- http://st####eshout.net/forum/search.php?em##################################
- http://st####elisten.net/forum/search.php?em##################################
- http://ra###rshout.net/forum/search.php?em##################################
- http://mo####gdemand.net/forum/search.php?em##################################
- http://ra####demand.net/forum/search.php?em##################################
- http://hi####ybring.net/forum/search.php?em##################################
- http://st####ebring.net/forum/search.php?em##################################
- http://mo####gshout.net/forum/search.php?em##################################
UDP:
- DNS ASK cl###listen.net
- DNS ASK th###listen.net
- DNS ASK cl###bring.net
- DNS ASK th###shout.net
- DNS ASK cl###demand.net
- DNS ASK th###demand.net
- DNS ASK th###bring.net
- DNS ASK am####demand.net
- DNS ASK we####rlisten.net
- DNS ASK am####listen.net
- DNS ASK we####rshout.net
- DNS ASK am###tshout.net
- DNS ASK we####rdemand.net
- DNS ASK cl###shout.net
- DNS ASK co####estation.net
- DNS ASK ch####tation.net
- DNS ASK pr#####childhood.net
- DNS ASK ch###object.net
- DNS ASK co####ethird.net
- DNS ASK ch###third.net
- DNS ASK th####hildhood.net
- DNS ASK th###third.net
- DNS ASK pr####tstation.net
- DNS ASK th####tation.net
- DNS ASK pr####tobject.net
- DNS ASK th###object.net
- DNS ASK pr####tthird.net
- DNS ASK ra###rbring.net
- DNS ASK tw###eshout.net
- DNS ASK mi###eshout.net
- DNS ASK mo####glisten.net
- DNS ASK ra####listen.net
- DNS ASK mo####gbring.net
- DNS ASK tw####demand.net
- DNS ASK tw###ebring.net
- DNS ASK mi###ebring.net
- DNS ASK al###shout.net
- DNS ASK mi####demand.net
- DNS ASK tw####listen.net
- DNS ASK mi####listen.net
- DNS ASK ra####demand.net
- DNS ASK st####eshout.net
- DNS ASK hi####ydemand.net
- DNS ASK st####edemand.net
- DNS ASK we####rbring.net
- DNS ASK am###tbring.net
- DNS ASK hi####yshout.net
- DNS ASK hi####ylisten.net
- DNS ASK mo####gshout.net
- DNS ASK ra###rshout.net
- DNS ASK mo####gdemand.net
- DNS ASK st####elisten.net
- DNS ASK hi####ybring.net
- DNS ASK st####ebring.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
