Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AutoConnect TP Host SPP Panel Control Program' = '<SYSTEM32>\uuvsykbnbp.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Software Counter Protection Identity] 'ImagePath' = '<SYSTEM32>\uuvsykbnbp.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Software Counter Protection Identity] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\ofvouqjqwm.exe' "<SYSTEM32>\uuvsykbnbp.exe"
- '%WINDIR%\Temp\o6gskwo39dphjb.exe' -r 21137 tcp
- '%TEMP%\o6gskwo30obhjbme1mez.exe'
- '<SYSTEM32>\uuvsykbnbp.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\hozypisuskftmlx\run
- <SYSTEM32>\hozypisuskftmlx\rng
- %WINDIR%\Temp\o6gskwo39dphjb.exe
- <SYSTEM32>\hozypisuskftmlx\cfg
- <SYSTEM32>\ofvouqjqwm.exe
- %TEMP%\o6gskwo30obhjbme1mez.exe
- <SYSTEM32>\hozypisuskftmlx\tst
- <SYSTEM32>\uuvsykbnbp.exe
- <SYSTEM32>\hozypisuskftmlx\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\ofvouqjqwm.exe
- <SYSTEM32>\uuvsykbnbp.exe
Deletes the following files:
- %WINDIR%\Temp\o6gskwo39dphjb.exe
- <DRIVERS>\etc\hosts
- %TEMP%\o6gskwo30obhjbme1mez.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'kn###alf.net':80
- 'wi###nly.net':80
- 'dr###only.net':80
- 'ab###alf.net':80
- 'kn###uide.net':80
- 'ab###ame.net':80
- 'kn###ame.net':80
- 'wi###olor.net':80
- 'dr###feel.net':80
- 'th###only.net':80
- 'th###color.net':80
- 'wi###eel.net':80
- 'dr###color.net':80
- 'wi###igh.net':80
- 'dr###high.net':80
- 'so###ate.net':80
- 'pi###ate.net':80
- 'so###uide.net':80
- 'ro###alf.net':80
- 'si###ame.net':80
- 'ro###ame.net':80
- 'si###alf.net':80
- 'pi###uide.net':80
- 'ab###ate.net':80
- 'kn###ate.net':80
- 'ab###uide.net':80
- 'pi###alf.net':80
- 'so###ame.net':80
- 'pi###ame.net':80
- 'so###alf.net':80
- 'ca####nbring.net':80
- 'pr####tbottom.net':80
- 'mo###olor.net':80
- 'al###being.net':80
- 'hi###igh.net':80
- 'wh###eel.net':80
- 'ri###nstorm.net':80
- 'ab###ell.net':80
- 'jo####ymeasure.net':80
- 'th###while.net':80
- 'ef###tbuilt.net':80
- 'cr#####onaraminta.net':80
- 'mi###hown.net':80
- 'mo###ugust.net':80
- 'le###form.net':80
- 'lo###olor.net':80
- 'fe###olor.net':80
- 'lo###igh.net':80
- 'fe###nly.net':80
- 'th###high.net':80
- 'th###feel.net':80
- 'lo###nly.net':80
- 'fe###igh.net':80
- 'wh###olor.net':80
- 'hi###olor.net':80
- 'wh###igh.net':80
- 'hi###nly.net':80
- 'lo###eel.net':80
- 'fe###eel.net':80
- 'wh###nly.net':80
TCP:
HTTP GET requests:
- http://kn###alf.net/index.php
- http://wi###nly.net/index.php
- http://dr###only.net/index.php
- http://ab###alf.net/index.php
- http://kn###uide.net/index.php
- http://ab###ame.net/index.php
- http://kn###ame.net/index.php
- http://wi###olor.net/index.php
- http://dr###feel.net/index.php
- http://th###only.net/index.php
- http://th###color.net/index.php
- http://wi###eel.net/index.php
- http://dr###color.net/index.php
- http://wi###igh.net/index.php
- http://dr###high.net/index.php
- http://so###ate.net/index.php
- http://pi###ate.net/index.php
- http://so###uide.net/index.php
- http://ro###alf.net/index.php
- http://si###ame.net/index.php
- http://ro###ame.net/index.php
- http://si###alf.net/index.php
- http://pi###uide.net/index.php
- http://ab###ate.net/index.php
- http://kn###ate.net/index.php
- http://ab###uide.net/index.php
- http://pi###alf.net/index.php
- http://so###ame.net/index.php
- http://pi###ame.net/index.php
- http://so###alf.net/index.php
- http://ca####nbring.net/index.php
- http://pr####tbottom.net/index.php
- http://mo###olor.net/index.php
- http://al###being.net/index.php
- http://hi###igh.net/index.php
- http://wh###eel.net/index.php
- http://ri###nstorm.net/index.php
- http://ab###ell.net/index.php
- http://jo####ymeasure.net/index.php
- http://th###while.net/index.php
- http://ef###tbuilt.net/index.php
- http://cr#####onaraminta.net/index.php
- http://mi###hown.net/index.php
- http://mo###ugust.net/index.php
- http://le###form.net/index.php
- http://lo###olor.net/index.php
- http://fe###olor.net/index.php
- http://lo###igh.net/index.php
- http://fe###nly.net/index.php
- http://th###high.net/index.php
- http://th###feel.net/index.php
- http://lo###nly.net/index.php
- http://fe###igh.net/index.php
- http://wh###olor.net/index.php
- http://hi###olor.net/index.php
- http://wh###igh.net/index.php
- http://hi###nly.net/index.php
- http://lo###eel.net/index.php
- http://fe###eel.net/index.php
- http://wh###nly.net/index.php
UDP:
- DNS ASK kn###alf.net
- DNS ASK wi###nly.net
- DNS ASK dr###only.net
- DNS ASK ab###alf.net
- DNS ASK kn###uide.net
- DNS ASK ab###ame.net
- DNS ASK kn###ame.net
- DNS ASK wi###olor.net
- DNS ASK dr###feel.net
- DNS ASK th###only.net
- DNS ASK th###color.net
- DNS ASK wi###eel.net
- DNS ASK dr###color.net
- DNS ASK wi###igh.net
- DNS ASK dr###high.net
- DNS ASK ab###uide.net
- DNS ASK ro###alf.net
- DNS ASK so###ate.net
- DNS ASK pi###ate.net
- DNS ASK si###alf.net
- DNS ASK ro###uide.net
- DNS ASK si###ame.net
- DNS ASK ro###ame.net
- DNS ASK so###uide.net
- DNS ASK pi###alf.net
- DNS ASK ab###ate.net
- DNS ASK kn###ate.net
- DNS ASK so###alf.net
- DNS ASK pi###uide.net
- DNS ASK so###ame.net
- DNS ASK pi###ame.net
- DNS ASK ca####nbring.net
- DNS ASK pr####tbottom.net
- DNS ASK mo###olor.net
- DNS ASK al###being.net
- DNS ASK hi###igh.net
- DNS ASK wh###eel.net
- DNS ASK ri###nstorm.net
- DNS ASK ab###ell.net
- DNS ASK jo####ymeasure.net
- DNS ASK th###while.net
- DNS ASK ef###tbuilt.net
- DNS ASK cr#####onaraminta.net
- DNS ASK mi###hown.net
- DNS ASK mo###ugust.net
- DNS ASK le###form.net
- DNS ASK lo###olor.net
- DNS ASK fe###olor.net
- DNS ASK lo###igh.net
- DNS ASK fe###nly.net
- DNS ASK th###high.net
- DNS ASK th###feel.net
- DNS ASK lo###nly.net
- DNS ASK fe###igh.net
- DNS ASK wh###olor.net
- DNS ASK hi###olor.net
- DNS ASK wh###igh.net
- DNS ASK hi###nly.net
- DNS ASK lo###eel.net
- DNS ASK fe###eel.net
- DNS ASK wh###nly.net
- '23#.#55.255.250':1900
