Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Net.Tcp Socket IKE Management Services Framework' = 'C:\lqjr8eqgyff\mausxeqhj.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Net.Tcp Bluetooth Wired WinHTTP Launcher] 'ImagePath' = 'C:\lqjr8eqgyff\mausxeqhj.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Net.Tcp Bluetooth Wired WinHTTP Launcher] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\lqjr8eqgyff\koezdmpa7t.exe' "c:\lqjr8eqgyff\mausxeqhj.exe"
- 'C:\lqjr8eqgyff\mausxeqhj.exe'
- 'C:\lqjr8eqgyff\mpdh4ad3aswvguclpjuqeec.exe'
Modifies file system:
Creates the following files:
- C:\lqjr8eqgyff\mausxeqhj.exe
- C:\lqjr8eqgyff\koezdmpa7t.exe
- C:\lqjr8eqgyff\xnnvekt
- %WINDIR%\lqjr8eqgyff\j6nflihuf
- C:\lqjr8eqgyff\j6nflihuf
- C:\lqjr8eqgyff\mpdh4ad3aswvguclpjuqeec.exe
Sets the 'hidden' attribute to the following files:
- C:\lqjr8eqgyff\koezdmpa7t.exe
- C:\lqjr8eqgyff\mausxeqhj.exe
Deletes the following files:
- C:\lqjr8eqgyff\mpdh4ad3aswvguclpjuqeec.exe
- %WINDIR%\lqjr8eqgyff\j6nflihuf
Network activity:
Connects to:
- 'gw#####recallista.net':80
- 'ch#####ancaileigh.net':80
- 'gw#####recaileigh.net':80
- 'ch#####ancallista.net':80
- 'gw#####recamellia.net':80
- 'ch#####anmarianne.net':80
- 'gw#####remarianne.net':80
- 'gu#####encallista.net':80
- 'an#####lecallista.net':80
- 'gu#####encaileigh.net':80
- 'an#####lemarianne.net':80
- 'gu#####encamellia.net':80
- 'an#####lecamellia.net':80
- 'gu#####enmarianne.net':80
- 'ma#####naharmonie.net':80
- 'al#####erveronica.net':80
- 'ka#####neveronica.net':80
- 'al#####raharmonie.net':80
- 'ma#####naanjelica.net':80
- 'al#####rashaniqua.net':80
- 'ma#####nashaniqua.net':80
- 'al#####erharmonie.net':80
- 'ka#####neharmonie.net':80
- 'ch#####ancamellia.net':80
- 'ka#####neshaniqua.net':80
- 'al#####eranjelica.net':80
- 'ka#####neanjelica.net':80
- 'al#####ershaniqua.net':80
- 'ch#####necamellia.net':80
- 'sh#####lemarianne.net':80
- 'ch#####nemarianne.net':80
- 'sh#####lecamellia.net':80
- 'ar#####ldcallista.net':80
- 'za#####ahcaileigh.net':80
- 'ar#####ldcaileigh.net':80
- 'ce#####necamellia.net':80
- 'am#####necamellia.net':80
- 'ce#####nemarianne.net':80
- 'ch#####necaileigh.net':80
- 'sh#####lecallista.net':80
- 'ch#####necallista.net':80
- 'sh#####lecaileigh.net':80
- 'ge#####namarianne.net':80
- 'ch#####lecallista.net':80
- 'ge#####nacallista.net':80
- 'ch#####lemarianne.net':80
- 'an#####lecaileigh.net':80
- 'ch#####lecamellia.net':80
- 'ge#####nacamellia.net':80
- 'za#####ahmarianne.net':80
- 'ar#####ldmarianne.net':80
- 'za#####ahcallista.net':80
- 'ar#####ldcamellia.net':80
- 'ch#####lecaileigh.net':80
- 'ge#####nacaileigh.net':80
- 'za#####ahcamellia.net':80
TCP:
HTTP GET requests:
- http://gw#####recallista.net/index.php
- http://ch#####ancaileigh.net/index.php
- http://gw#####recaileigh.net/index.php
- http://ch#####ancallista.net/index.php
- http://gw#####recamellia.net/index.php
- http://ch#####anmarianne.net/index.php
- http://gw#####remarianne.net/index.php
- http://gu#####encallista.net/index.php
- http://an#####lecallista.net/index.php
- http://gu#####encaileigh.net/index.php
- http://an#####lemarianne.net/index.php
- http://gu#####encamellia.net/index.php
- http://an#####lecamellia.net/index.php
- http://gu#####enmarianne.net/index.php
- http://ma#####naharmonie.net/index.php
- http://al#####erveronica.net/index.php
- http://ka#####neveronica.net/index.php
- http://al#####raharmonie.net/index.php
- http://ma#####naanjelica.net/index.php
- http://al#####rashaniqua.net/index.php
- http://ma#####nashaniqua.net/index.php
- http://al#####erharmonie.net/index.php
- http://ka#####neharmonie.net/index.php
- http://ch#####ancamellia.net/index.php
- http://ka#####neshaniqua.net/index.php
- http://al#####eranjelica.net/index.php
- http://ka#####neanjelica.net/index.php
- http://al#####ershaniqua.net/index.php
- http://ch#####necamellia.net/index.php
- http://sh#####lemarianne.net/index.php
- http://ch#####nemarianne.net/index.php
- http://sh#####lecamellia.net/index.php
- http://ar#####ldcallista.net/index.php
- http://za#####ahcaileigh.net/index.php
- http://ar#####ldcaileigh.net/index.php
- http://ce#####necamellia.net/index.php
- http://am#####necamellia.net/index.php
- http://ce#####nemarianne.net/index.php
- http://ch#####necaileigh.net/index.php
- http://sh#####lecallista.net/index.php
- http://ch#####necallista.net/index.php
- http://sh#####lecaileigh.net/index.php
- http://ge#####namarianne.net/index.php
- http://ch#####lecallista.net/index.php
- http://ge#####nacallista.net/index.php
- http://ch#####lemarianne.net/index.php
- http://an#####lecaileigh.net/index.php
- http://ch#####lecamellia.net/index.php
- http://ge#####nacamellia.net/index.php
- http://za#####ahmarianne.net/index.php
- http://ar#####ldmarianne.net/index.php
- http://za#####ahcallista.net/index.php
- http://ar#####ldcamellia.net/index.php
- http://ch#####lecaileigh.net/index.php
- http://ge#####nacaileigh.net/index.php
- http://za#####ahcamellia.net/index.php
UDP:
- DNS ASK ch#####ancallista.net
- DNS ASK gw#####recallista.net
- DNS ASK ch#####ancaileigh.net
- DNS ASK gw#####remarianne.net
- DNS ASK ch#####ancamellia.net
- DNS ASK gw#####recamellia.net
- DNS ASK ch#####anmarianne.net
- DNS ASK an#####lemarianne.net
- DNS ASK gu#####encallista.net
- DNS ASK an#####lecallista.net
- DNS ASK gu#####enmarianne.net
- DNS ASK gw#####recaileigh.net
- DNS ASK gu#####encamellia.net
- DNS ASK an#####lecamellia.net
- DNS ASK al#####raharmonie.net
- DNS ASK ma#####naharmonie.net
- DNS ASK al#####erveronica.net
- DNS ASK ma#####nashaniqua.net
- DNS ASK al#####raanjelica.net
- DNS ASK ma#####naanjelica.net
- DNS ASK al#####rashaniqua.net
- DNS ASK ka#####neshaniqua.net
- DNS ASK al#####erharmonie.net
- DNS ASK ka#####neharmonie.net
- DNS ASK al#####ershaniqua.net
- DNS ASK ka#####neveronica.net
- DNS ASK al#####eranjelica.net
- DNS ASK ka#####neanjelica.net
- DNS ASK gu#####encaileigh.net
- DNS ASK ch#####necamellia.net
- DNS ASK sh#####lemarianne.net
- DNS ASK ch#####nemarianne.net
- DNS ASK sh#####lecamellia.net
- DNS ASK ar#####ldcallista.net
- DNS ASK za#####ahcaileigh.net
- DNS ASK ar#####ldcaileigh.net
- DNS ASK ce#####necamellia.net
- DNS ASK am#####necamellia.net
- DNS ASK ce#####nemarianne.net
- DNS ASK ch#####necaileigh.net
- DNS ASK sh#####lecallista.net
- DNS ASK ch#####necallista.net
- DNS ASK sh#####lecaileigh.net
- DNS ASK ge#####namarianne.net
- DNS ASK ch#####lecallista.net
- DNS ASK ge#####nacallista.net
- DNS ASK ch#####lemarianne.net
- DNS ASK an#####lecaileigh.net
- DNS ASK ch#####lecamellia.net
- DNS ASK ge#####nacamellia.net
- DNS ASK za#####ahmarianne.net
- DNS ASK ar#####ldmarianne.net
- DNS ASK za#####ahcallista.net
- DNS ASK ar#####ldcamellia.net
- DNS ASK ch#####lecaileigh.net
- DNS ASK ge#####nacaileigh.net
- DNS ASK za#####ahcamellia.net
