Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Protected Modules Alerts SSDP ActiveX' = '%APPDATA%\eiowjgclmtlhqv\uwjwxoe.exe'
Malicious functions:
Executes the following:
- '%APPDATA%\eiowjgclmtlhqv\bitjnflxsse.exe' "%APPDATA%\eiowjgclmtlhqv\uwjwxoe.exe"
- '%APPDATA%\eiowjgclmtlhqv\uwjwxoe.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\eiowjgclmtlhqv\uwjwxoe.kqud
- %APPDATA%\eiowjgclmtlhqv\bitjnflxsse.exe
- %APPDATA%\eiowjgclmtlhqv\uwjwxoe.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\eiowjgclmtlhqv\bitjnflxsse.exe
- %APPDATA%\eiowjgclmtlhqv\uwjwxoe.exe
Network activity:
Connects to:
- 'qu###animal.net':80
- 'se####escape.net':80
- 'qu###escape.net':80
- 'se####problem.net':80
- 'qu####roblem.net':80
- 'se####animal.net':80
- 'br###modern.net':80
- 'br###animal.net':80
- 'fl###animal.net':80
- 'br###escape.net':80
- 'fl###modern.net':80
- 'br####roblem.net':80
- 'fl####roblem.net':80
- 'qu###modern.net':80
- 'ni###silver.net':80
- 'do###labor.net':80
- 'ag####tlabor.net':80
- 'de####sister.net':80
- 'ni###sister.net':80
- 'de####silver.net':80
- 'do###valley.net':80
- 'do###silver.net':80
- 'ag####tsilver.net':80
- 'se####modern.net':80
- 'ag####tvalley.net':80
- 'do###sister.net':80
- 'ag####tsister.net':80
- 'fl###escape.net':80
- 're####modern.net':80
- 'el####icproblem.net':80
- 're####problem.net':80
- 'tr###escape.net':80
- 'st####escape.net':80
- 'el####icmodern.net':80
- 'el####icanimal.net':80
- 'ca####nmodern.net':80
- 'la###modern.net':80
- 'ca####nproblem.net':80
- 're####animal.net':80
- 'el####icescape.net':80
- 're####escape.net':80
- 'st####animal.net':80
- 'be####problem.net':80
- 'ga####animal.net':80
- 'be####animal.net':80
- 'ga####modern.net':80
- 'be####modern.net':80
- 'ga####problem.net':80
- 'ga####escape.net':80
- 'tr####roblem.net':80
- 'st####problem.net':80
- 'tr###animal.net':80
- 'be####escape.net':80
- 'tr###modern.net':80
- 'st####modern.net':80
TCP:
HTTP GET requests:
- http://qu###animal.net/forum/search.php?em############################
- http://se####escape.net/forum/search.php?em############################
- http://qu###escape.net/forum/search.php?em############################
- http://se####problem.net/forum/search.php?em############################
- http://qu####roblem.net/forum/search.php?em############################
- http://se####animal.net/forum/search.php?em############################
- http://br###modern.net/forum/search.php?em############################
- http://br###animal.net/forum/search.php?em############################
- http://fl###animal.net/forum/search.php?em############################
- http://br###escape.net/forum/search.php?em############################
- http://fl###modern.net/forum/search.php?em############################
- http://br####roblem.net/forum/search.php?em############################
- http://fl####roblem.net/forum/search.php?em############################
- http://qu###modern.net/forum/search.php?em############################
- http://ni###silver.net/forum/search.php?em############################
- http://do###labor.net/forum/search.php?em############################
- http://ag####tlabor.net/forum/search.php?em############################
- http://de####sister.net/forum/search.php?em############################
- http://ni###sister.net/forum/search.php?em############################
- http://de####silver.net/forum/search.php?em############################
- http://do###valley.net/forum/search.php?em############################
- http://do###silver.net/forum/search.php?em############################
- http://ag####tsilver.net/forum/search.php?em############################
- http://se####modern.net/forum/search.php?em############################
- http://ag####tvalley.net/forum/search.php?em############################
- http://do###sister.net/forum/search.php?em############################
- http://ag####tsister.net/forum/search.php?em############################
- http://fl###escape.net/forum/search.php?em############################
- http://re####modern.net/forum/search.php?em############################
- http://el####icproblem.net/forum/search.php?em############################
- http://re####problem.net/forum/search.php?em############################
- http://tr###escape.net/forum/search.php?em############################
- http://st####escape.net/forum/search.php?em############################
- http://el####icmodern.net/forum/search.php?em############################
- http://el####icanimal.net/forum/search.php?em############################
- http://ca####nmodern.net/forum/search.php?em############################
- http://la###modern.net/forum/search.php?em############################
- http://ca####nproblem.net/forum/search.php?em############################
- http://re####animal.net/forum/search.php?em############################
- http://el####icescape.net/forum/search.php?em############################
- http://re####escape.net/forum/search.php?em############################
- http://st####animal.net/forum/search.php?em############################
- http://be####problem.net/forum/search.php?em############################
- http://ga####animal.net/forum/search.php?em############################
- http://be####animal.net/forum/search.php?em############################
- http://ga####modern.net/forum/search.php?em############################
- http://be####modern.net/forum/search.php?em############################
- http://ga####problem.net/forum/search.php?em############################
- http://ga####escape.net/forum/search.php?em############################
- http://tr####roblem.net/forum/search.php?em############################
- http://st####problem.net/forum/search.php?em############################
- http://tr###animal.net/forum/search.php?em############################
- http://be####escape.net/forum/search.php?em############################
- http://tr###modern.net/forum/search.php?em############################
- http://st####modern.net/forum/search.php?em############################
UDP:
- DNS ASK qu###animal.net
- DNS ASK se####escape.net
- DNS ASK qu###escape.net
- DNS ASK se####animal.net
- DNS ASK qu###modern.net
- DNS ASK se####problem.net
- DNS ASK qu####roblem.net
- DNS ASK br###animal.net
- DNS ASK fl###animal.net
- DNS ASK br###escape.net
- DNS ASK fl####roblem.net
- DNS ASK br###modern.net
- DNS ASK fl###modern.net
- DNS ASK br####roblem.net
- DNS ASK ni###silver.net
- DNS ASK do###labor.net
- DNS ASK ag####tlabor.net
- DNS ASK de####silver.net
- DNS ASK ni###valley.net
- DNS ASK de####sister.net
- DNS ASK ni###sister.net
- DNS ASK do###silver.net
- DNS ASK ag####tsilver.net
- DNS ASK se####modern.net
- DNS ASK ag####tsister.net
- DNS ASK do###valley.net
- DNS ASK ag####tvalley.net
- DNS ASK do###sister.net
- DNS ASK re####modern.net
- DNS ASK el####icproblem.net
- DNS ASK re####problem.net
- DNS ASK el####icmodern.net
- DNS ASK st####animal.net
- DNS ASK tr###escape.net
- DNS ASK st####escape.net
- DNS ASK ca####nmodern.net
- DNS ASK la###modern.net
- DNS ASK ca####nproblem.net
- DNS ASK re####escape.net
- DNS ASK el####icanimal.net
- DNS ASK re####animal.net
- DNS ASK el####icescape.net
- DNS ASK be####problem.net
- DNS ASK ga####animal.net
- DNS ASK be####animal.net
- DNS ASK ga####problem.net
- DNS ASK fl###escape.net
- DNS ASK ga####modern.net
- DNS ASK be####modern.net
- DNS ASK tr####roblem.net
- DNS ASK st####problem.net
- DNS ASK tr###animal.net
- DNS ASK st####modern.net
- DNS ASK ga####escape.net
- DNS ASK be####escape.net
- DNS ASK tr###modern.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
