Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RPC List Information Network Connect' = 'C:\sktugcfl\etuimmwr.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\iSCSI Reports Gateway NGEN Presentation Background] 'ImagePath' = 'C:\sktugcfl\etuimmwr.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\iSCSI Reports Gateway NGEN Presentation Background] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\sktugcfl\eaasbtw.exe' "c:\sktugcfl\etuimmwr.exe"
- 'C:\sktugcfl\etuimmwr.exe'
- 'C:\sktugcfl\i1to2qe3jystdnqmftt.exe'
Modifies file system:
Creates the following files:
- C:\sktugcfl\etuimmwr.exe
- C:\sktugcfl\eaasbtw.exe
- C:\sktugcfl\bmmdhagjdc
- %WINDIR%\sktugcfl\sqlay3kn5r
- C:\sktugcfl\sqlay3kn5r
- C:\sktugcfl\i1to2qe3jystdnqmftt.exe
Sets the 'hidden' attribute to the following files:
- C:\sktugcfl\eaasbtw.exe
- C:\sktugcfl\etuimmwr.exe
Deletes the following files:
- C:\sktugcfl\i1to2qe3jystdnqmftt.exe
- %WINDIR%\sktugcfl\sqlay3kn5r
Network activity:
Connects to:
- 'wo###speak.net':80
- 'wa###oclock.net':80
- 'sm###speak.net':80
- 'sm###niece.net':80
- 'wo###niece.net':80
- 'th####toclock.net':80
- 'th####tniece.net':80
- 'wa###speak.net':80
- 'wa###niece.net':80
- 'wa###write.net':80
- 'th####twrite.net':80
- 'wo###write.net':80
- 'pa###write.net':80
- 'fi###niece.net':80
- 'fi###write.net':80
- 'fi###oclock.net':80
- 'pa###oclock.net':80
- 'pa###niece.net':80
- 'wo###oclock.net':80
- 'sm###write.net':80
- 'sm###oclock.net':80
- 'fi###speak.net':80
- 'pa###speak.net':80
- 'th####tspeak.net':80
- 'be###speak.net':80
- 'me####oclock.net':80
- 'kn###speak.net':80
- 'kn###niece.net':80
- 'be###niece.net':80
- 'fo####oclock.net':80
- 'fo###wniece.net':80
- 'me###rspeak.net':80
- 'me###rniece.net':80
- 'me###rwrite.net':80
- 'fo###wwrite.net':80
- 'be###write.net':80
- 'su###rwrite.net':80
- 'cr###niece.net':80
- 'cr###write.net':80
- 'cr###oclock.net':80
- 'su####oclock.net':80
- 'su###rniece.net':80
- 'be###oclock.net':80
- 'kn###write.net':80
- 'kn###oclock.net':80
- 'cr###speak.net':80
- 'su###rspeak.net':80
TCP:
HTTP GET requests:
- http://wo###speak.net/index.php
- http://wa###oclock.net/index.php
- http://sm###speak.net/index.php
- http://sm###niece.net/index.php
- http://wo###niece.net/index.php
- http://th####toclock.net/index.php
- http://th####tniece.net/index.php
- http://wa###speak.net/index.php
- http://wa###niece.net/index.php
- http://wa###write.net/index.php
- http://th####twrite.net/index.php
- http://wo###write.net/index.php
- http://pa###write.net/index.php
- http://fi###niece.net/index.php
- http://fi###write.net/index.php
- http://fi###oclock.net/index.php
- http://pa###oclock.net/index.php
- http://pa###niece.net/index.php
- http://wo###oclock.net/index.php
- http://sm###write.net/index.php
- http://sm###oclock.net/index.php
- http://fi###speak.net/index.php
- http://pa###speak.net/index.php
- http://th####tspeak.net/index.php
- http://be###speak.net/index.php
- http://me####oclock.net/index.php
- http://kn###speak.net/index.php
- http://kn###niece.net/index.php
- http://be###niece.net/index.php
- http://fo####oclock.net/index.php
- http://fo###wniece.net/index.php
- http://me###rspeak.net/index.php
- http://me###rniece.net/index.php
- http://me###rwrite.net/index.php
- http://fo###wwrite.net/index.php
- http://be###write.net/index.php
- http://su###rwrite.net/index.php
- http://cr###niece.net/index.php
- http://cr###write.net/index.php
- http://cr###oclock.net/index.php
- http://su####oclock.net/index.php
- http://su###rniece.net/index.php
- http://be###oclock.net/index.php
- http://kn###write.net/index.php
- http://kn###oclock.net/index.php
- http://cr###speak.net/index.php
- http://su###rspeak.net/index.php
UDP:
- DNS ASK sm###speak.net
- DNS ASK wo###speak.net
- DNS ASK wa###oclock.net
- DNS ASK wo###write.net
- DNS ASK sm###niece.net
- DNS ASK wo###niece.net
- DNS ASK wa###niece.net
- DNS ASK th####tniece.net
- DNS ASK wa###speak.net
- DNS ASK th####toclock.net
- DNS ASK wa###write.net
- DNS ASK th####twrite.net
- DNS ASK fi###write.net
- DNS ASK pa###write.net
- DNS ASK fi###niece.net
- DNS ASK se#####nderstand.net
- DNS ASK fi###oclock.net
- DNS ASK pa###oclock.net
- DNS ASK sm###oclock.net
- DNS ASK wo###oclock.net
- DNS ASK sm###write.net
- DNS ASK pa###niece.net
- DNS ASK fi###speak.net
- DNS ASK pa###speak.net
- DNS ASK kn###speak.net
- DNS ASK be###speak.net
- DNS ASK me####oclock.net
- DNS ASK be###write.net
- DNS ASK kn###niece.net
- DNS ASK be###niece.net
- DNS ASK me###rniece.net
- DNS ASK fo###wniece.net
- DNS ASK me###rspeak.net
- DNS ASK fo####oclock.net
- DNS ASK me###rwrite.net
- DNS ASK fo###wwrite.net
- DNS ASK cr###write.net
- DNS ASK su###rwrite.net
- DNS ASK cr###niece.net
- DNS ASK th####tspeak.net
- DNS ASK cr###oclock.net
- DNS ASK su####oclock.net
- DNS ASK kn###oclock.net
- DNS ASK be###oclock.net
- DNS ASK kn###write.net
- DNS ASK su###rniece.net
- DNS ASK cr###speak.net
- DNS ASK su###rspeak.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
