Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SNMP User Bluetooth Card' = 'C:\usapvsw\hlienegvazd.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Debugger Spooler Store Registry Themes] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\usapvsw\vfubqfviankx.exe' "c:\usapvsw\hlienegvazd.exe"
- 'C:\usapvsw\hlienegvazd.exe'
- 'C:\usapvsw\dfua2ufiqkzpzksbyse.exe'
Modifies file system :
Creates the following files:
- C:\usapvsw\hlienegvazd.exe
- C:\usapvsw\vfubqfviankx.exe
- C:\usapvsw\bgny6r9e
- %WINDIR%\usapvsw\pvp3qlnehjap
- C:\usapvsw\pvp3qlnehjap
- C:\usapvsw\dfua2ufiqkzpzksbyse.exe
Sets the 'hidden' attribute to the following files:
- C:\usapvsw\vfubqfviankx.exe
- C:\usapvsw\hlienegvazd.exe
Deletes the following files:
- C:\usapvsw\dfua2ufiqkzpzksbyse.exe
- %WINDIR%\usapvsw\pvp3qlnehjap
Network activity:
Connects to:
- 'ch###arrive.net':80
- 'co####earrive.net':80
- 'ch###office.net':80
- 'co####eoffice.net':80
- 'of###supply.net':80
- 'al####istance.net':80
- 'of###office.net':80
- 'al###supply.net':80
- 'of####istance.net':80
- 'pr####toffice.net':80
- 'th###arrive.net':80
- 'pr####tdistance.net':80
- 'th###office.net':80
- 'pr####tarrive.net':80
- 'ch####istance.net':80
- 'co####edistance.net':80
- 'ch###supply.net':80
- 'co####esupply.net':80
- 'al###office.net':80
- 'mo####gsupply.net':80
- 'ra####distance.net':80
- 'tw####arrive.net':80
- 'ra####supply.net':80
- 'mo####gdistance.net':80
- 'ra####arrive.net':80
- 'mo####garrive.net':80
- 'ra####office.net':80
- 'mo####goffice.net':80
- 'mi####supply.net':80
- 'tw####supply.net':80
- 'of###arrive.net':80
- 'al###arrive.net':80
- 'mi####distance.net':80
- 'tw####office.net':80
- 'mi####arrive.net':80
- 'tw####distance.net':80
- 'mi####office.net':80
- 'hi####yshould.net':80
- 'st####eshort.net':80
- 'mo####gpromise.net':80
- 'st####eshould.net':80
- 'hi####yshort.net':80
- 'st####epromise.net':80
- 'hi####ypromise.net':80
- 'st####eopinion.net':80
- 'hi####yopinion.net':80
- 'ra####should.net':80
- 'mo####gshould.net':80
- 'mi####promise.net':80
- 'tw####promise.net':80
- 'ra###rshort.net':80
- 'mo####gopinion.net':80
- 'ra####promise.net':80
- 'mo####gshort.net':80
- 'ra####opinion.net':80
- 'am####should.net':80
- 'th####pinion.net':80
- 'cl####pinion.net':80
- 'th###short.net':80
- 'cl###short.net':80
- 'th####romise.net':80
- 'pr####tsupply.net':80
- 'th####istance.net':80
- 'cl####romise.net':80
- 'th###supply.net':80
- 'we####rshort.net':80
- 'am####opinion.net':80
- 'we####rshould.net':80
- 'am###tshort.net':80
- 'we####ropinion.net':80
- 'th###should.net':80
- 'cl###should.net':80
- 'am####promise.net':80
- 'we####rpromise.net':80
TCP:
HTTP GET requests:
- http://ch###arrive.net/index.php?me########
- http://co####earrive.net/index.php?me########
- http://ch###office.net/index.php?me########
- http://co####eoffice.net/index.php?me########
- http://of###supply.net/index.php?me########
- http://al####istance.net/index.php?me########
- http://of###office.net/index.php?me########
- http://al###supply.net/index.php?me########
- http://of####istance.net/index.php?me########
- http://pr####toffice.net/index.php?me########
- http://th###arrive.net/index.php?me########
- http://pr####tdistance.net/index.php?me########
- http://th###office.net/index.php?me########
- http://pr####tarrive.net/index.php?me########
- http://ch####istance.net/index.php?me########
- http://co####edistance.net/index.php?me########
- http://ch###supply.net/index.php?me########
- http://co####esupply.net/index.php?me########
- http://al###office.net/index.php?me########
- http://mo####gsupply.net/index.php?me########
- http://ra####distance.net/index.php?me########
- http://tw####arrive.net/index.php?me########
- http://ra####supply.net/index.php?me########
- http://mo####gdistance.net/index.php?me########
- http://ra####arrive.net/index.php?me########
- http://mo####garrive.net/index.php?me########
- http://ra####office.net/index.php?me########
- http://mo####goffice.net/index.php?me########
- http://mi####supply.net/index.php?me########
- http://tw####supply.net/index.php?me########
- http://of###arrive.net/index.php?me########
- http://al###arrive.net/index.php?me########
- http://mi####distance.net/index.php?me########
- http://tw####office.net/index.php?me########
- http://mi####arrive.net/index.php?me########
- http://tw####distance.net/index.php?me########
- http://mi####office.net/index.php?me########
- http://hi####yshould.net/index.php?me########
- http://st####eshort.net/index.php?me########
- http://mo####gpromise.net/index.php?me########
- http://st####eshould.net/index.php?me########
- http://hi####yshort.net/index.php?me########
- http://st####epromise.net/index.php?me########
- http://hi####ypromise.net/index.php?me########
- http://st####eopinion.net/index.php?me########
- http://hi####yopinion.net/index.php?me########
- http://ra####should.net/index.php?me########
- http://mo####gshould.net/index.php?me########
- http://mi####promise.net/index.php?me########
- http://tw####promise.net/index.php?me########
- http://ra###rshort.net/index.php?me########
- http://mo####gopinion.net/index.php?me########
- http://ra####promise.net/index.php?me########
- http://mo####gshort.net/index.php?me########
- http://ra####opinion.net/index.php?me########
- http://am####should.net/index.php?me########
- http://th####pinion.net/index.php?me########
- http://cl####pinion.net/index.php?me########
- http://th###short.net/index.php?me########
- http://cl###short.net/index.php?me########
- http://th####romise.net/index.php?me########
- http://pr####tsupply.net/index.php?me########
- http://th####istance.net/index.php?me########
- http://cl####romise.net/index.php?me########
- http://th###supply.net/index.php?me########
- http://we####rshort.net/index.php?me########
- http://am####opinion.net/index.php?me########
- http://we####rshould.net/index.php?me########
- http://am###tshort.net/index.php?me########
- http://we####ropinion.net/index.php?me########
- http://th###should.net/index.php?me########
- http://cl###should.net/index.php?me########
- http://am####promise.net/index.php?me########
- http://we####rpromise.net/index.php?me########
UDP:
- DNS ASK co####earrive.net
- DNS ASK of###supply.net
- DNS ASK co####eoffice.net
- DNS ASK ch###arrive.net
- DNS ASK al###supply.net
- DNS ASK of###office.net
- DNS ASK al###office.net
- DNS ASK of####istance.net
- DNS ASK al####istance.net
- DNS ASK th###arrive.net
- DNS ASK pr####tarrive.net
- DNS ASK th###office.net
- DNS ASK pr####toffice.net
- DNS ASK ch###supply.net
- DNS ASK co####edistance.net
- DNS ASK ch###office.net
- DNS ASK co####esupply.net
- DNS ASK ch####istance.net
- DNS ASK of###arrive.net
- DNS ASK ra####distance.net
- DNS ASK mo####gdistance.net
- DNS ASK ra####supply.net
- DNS ASK mo####gsupply.net
- DNS ASK ra####office.net
- DNS ASK mo####garrive.net
- DNS ASK st####esupply.net
- DNS ASK mo####goffice.net
- DNS ASK ra####arrive.net
- DNS ASK tw####supply.net
- DNS ASK mi####distance.net
- DNS ASK al###arrive.net
- DNS ASK mi####supply.net
- DNS ASK tw####distance.net
- DNS ASK mi####arrive.net
- DNS ASK tw####arrive.net
- DNS ASK mi####office.net
- DNS ASK tw####office.net
- DNS ASK pr####tdistance.net
- DNS ASK hi####yshould.net
- DNS ASK st####eshort.net
- DNS ASK mo####gpromise.net
- DNS ASK st####eshould.net
- DNS ASK hi####yshort.net
- DNS ASK st####epromise.net
- DNS ASK hi####ypromise.net
- DNS ASK st####eopinion.net
- DNS ASK hi####yopinion.net
- DNS ASK ra####should.net
- DNS ASK mo####gshould.net
- DNS ASK mi####promise.net
- DNS ASK tw####promise.net
- DNS ASK ra###rshort.net
- DNS ASK mo####gopinion.net
- DNS ASK ra####promise.net
- DNS ASK mo####gshort.net
- DNS ASK ra####opinion.net
- DNS ASK am####should.net
- DNS ASK th####pinion.net
- DNS ASK cl####pinion.net
- DNS ASK th###short.net
- DNS ASK cl###short.net
- DNS ASK th####romise.net
- DNS ASK pr####tsupply.net
- DNS ASK th####istance.net
- DNS ASK cl####romise.net
- DNS ASK th###supply.net
- DNS ASK we####rshort.net
- DNS ASK am####opinion.net
- DNS ASK we####rshould.net
- DNS ASK am###tshort.net
- DNS ASK we####ropinion.net
- DNS ASK th###should.net
- DNS ASK cl###should.net
- DNS ASK am####promise.net
- DNS ASK we####rpromise.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
