Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Driver Quality Bus UPnP WWAN Health List' = '<SYSTEM32>\cafnfovdqkx.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Themes TPM PNRP TP PC Media Assistant] 'ImagePath' = '<SYSTEM32>\cafnfovdqkx.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Themes TPM PNRP TP PC Media Assistant] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\kappdwkymw.exe' "<SYSTEM32>\cafnfovdqkx.exe"
- '%WINDIR%\Temp\bwtspe2zi8hbk9a.exe' -r 39411 tcp
- '%TEMP%\bwtspe2v85hbk9axu5ymb.exe'
- '<SYSTEM32>\cafnfovdqkx.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\ggzygpqua\run
- <SYSTEM32>\ggzygpqua\rng
- %WINDIR%\Temp\bwtspe2zi8hbk9a.exe
- <SYSTEM32>\ggzygpqua\cfg
- <SYSTEM32>\kappdwkymw.exe
- %TEMP%\bwtspe2v85hbk9axu5ymb.exe
- <SYSTEM32>\ggzygpqua\tst
- <SYSTEM32>\cafnfovdqkx.exe
- <SYSTEM32>\ggzygpqua\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\kappdwkymw.exe
- <SYSTEM32>\cafnfovdqkx.exe
Deletes the following files:
- %WINDIR%\Temp\bwtspe2zi8hbk9a.exe
- <DRIVERS>\etc\hosts
- %TEMP%\bwtspe2v85hbk9axu5ymb.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'so###ear.net':80
- 'pi###ear.net':80
- 'so###row.net':80
- 'pi###hank.net':80
- 'so###ity.net':80
- 'pi###ity.net':80
- 'so###hank.net':80
- 'kn###hank.net':80
- 'ab###ear.net':80
- 'kn###ear.net':80
- 'ab###hank.net':80
- 'pi###row.net':80
- 'ab###ity.net':80
- 'kn###ity.net':80
- 'ro###row.net':80
- 'mo###ear.net':80
- 'ju###row.net':80
- 'mo###row.net':80
- 'ju###ear.net':80
- 'mo###ity.net':80
- 'ju###hank.net':80
- 'mo###hank.net':80
- 'si###ear.net':80
- 'ro###ear.net':80
- 'si###row.net':80
- 'ro###hank.net':80
- 'si###ity.net':80
- 'ro###ity.net':80
- 'si###hank.net':80
- 'ab###row.net':80
- 'ri###nstorm.net':80
- 'al###being.net':80
- 'ca####nbring.net':80
- 'be##lxc.com':80
- 'si###low.net':80
- 'me###low.net':80
- 'mo####vember.net':80
- 'mo###ugust.net':80
- 'le###form.net':80
- 'cr#####onaraminta.net':80
- 'mi###hown.net':80
- 'pr####tbottom.net':80
- 'mo###olor.net':80
- 'ab###ell.net':80
- 'me####bruary.net':80
- 'cl###help.net':80
- 'da####bruary.net':80
- 'cl####ebruary.net':80
- 'da###elp.net':80
- 'kn###row.net':80
- 'da####vember.net':80
- 'cl####ovember.net':80
- 'si###elp.net':80
- 'me###elp.net':80
- 'si####bruary.net':80
- 'me####vember.net':80
- 'da###low.net':80
- 'cl###slow.net':80
- 'si####vember.net':80
TCP:
HTTP GET requests:
- http://so###ear.net/index.php
- http://pi###ear.net/index.php
- http://so###row.net/index.php
- http://pi###hank.net/index.php
- http://so###ity.net/index.php
- http://pi###ity.net/index.php
- http://so###hank.net/index.php
- http://kn###hank.net/index.php
- http://ab###ear.net/index.php
- http://kn###ear.net/index.php
- http://ab###hank.net/index.php
- http://pi###row.net/index.php
- http://ab###ity.net/index.php
- http://kn###ity.net/index.php
- http://ro###row.net/index.php
- http://mo###ear.net/index.php
- http://ju###row.net/index.php
- http://mo###row.net/index.php
- http://ju###ear.net/index.php
- http://mo###ity.net/index.php
- http://ju###hank.net/index.php
- http://mo###hank.net/index.php
- http://si###ear.net/index.php
- http://ro###ear.net/index.php
- http://si###row.net/index.php
- http://ro###hank.net/index.php
- http://si###ity.net/index.php
- http://ro###ity.net/index.php
- http://si###hank.net/index.php
- http://ab###row.net/index.php
- http://ri###nstorm.net/index.php
- http://al###being.net/index.php
- http://ca####nbring.net/index.php
- http://be##lxc.com/index.php
- http://si###low.net/index.php
- http://me###low.net/index.php
- http://mo####vember.net/index.php
- http://mo###ugust.net/index.php
- http://le###form.net/index.php
- http://cr#####onaraminta.net/index.php
- http://mi###hown.net/index.php
- http://pr####tbottom.net/index.php
- http://mo###olor.net/index.php
- http://ab###ell.net/index.php
- http://me####bruary.net/index.php
- http://cl###help.net/index.php
- http://da####bruary.net/index.php
- http://cl####ebruary.net/index.php
- http://da###elp.net/index.php
- http://kn###row.net/index.php
- http://da####vember.net/index.php
- http://cl####ovember.net/index.php
- http://si###elp.net/index.php
- http://me###elp.net/index.php
- http://si####bruary.net/index.php
- http://me####vember.net/index.php
- http://da###low.net/index.php
- http://cl###slow.net/index.php
- http://si####vember.net/index.php
UDP:
- DNS ASK pi###hank.net
- DNS ASK so###ear.net
- DNS ASK pi###ear.net
- DNS ASK so###hank.net
- DNS ASK ro###row.net
- DNS ASK so###ity.net
- DNS ASK pi###ity.net
- DNS ASK so###row.net
- DNS ASK kn###hank.net
- DNS ASK ab###ear.net
- DNS ASK kn###ear.net
- DNS ASK ab###hank.net
- DNS ASK pi###row.net
- DNS ASK ab###ity.net
- DNS ASK kn###ity.net
- DNS ASK ju###ear.net
- DNS ASK mo###ear.net
- DNS ASK ju###row.net
- DNS ASK mo###hank.net
- DNS ASK ju###ity.net
- DNS ASK mo###ity.net
- DNS ASK ju###hank.net
- DNS ASK mo###row.net
- DNS ASK si###ear.net
- DNS ASK ro###ear.net
- DNS ASK si###row.net
- DNS ASK ro###hank.net
- DNS ASK si###ity.net
- DNS ASK ro###ity.net
- DNS ASK si###hank.net
- DNS ASK ab###row.net
- DNS ASK ri###nstorm.net
- DNS ASK al###being.net
- DNS ASK ca####nbring.net
- DNS ASK be##lxc.com
- DNS ASK si###low.net
- DNS ASK me###low.net
- DNS ASK mo####vember.net
- DNS ASK mo###ugust.net
- DNS ASK le###form.net
- DNS ASK cr#####onaraminta.net
- DNS ASK mi###hown.net
- DNS ASK pr####tbottom.net
- DNS ASK mo###olor.net
- DNS ASK ab###ell.net
- DNS ASK me####bruary.net
- DNS ASK cl###help.net
- DNS ASK da####bruary.net
- DNS ASK cl####ebruary.net
- DNS ASK da###elp.net
- DNS ASK kn###row.net
- DNS ASK da####vember.net
- DNS ASK cl####ovember.net
- DNS ASK si###elp.net
- DNS ASK me###elp.net
- DNS ASK si####bruary.net
- DNS ASK me####vember.net
- DNS ASK da###low.net
- DNS ASK cl###slow.net
- DNS ASK si####vember.net
- '23#.#55.255.250':1900
