Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%LOCALAPPDATA%\iwpqijby\qahdsmkp.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'QahDsmkp' = '%LOCALAPPDATA%\iwpqijby\qahdsmkp.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\qahdsmkp.exe
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Micorsoft Windows Service] 'ImagePath' = '%TEMP%\xofkvjdc.sys'
Creates the following services
- 'Micorsoft Windows Service' %TEMP%\xofkvjdc.sys
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
- Windows Update
- Windows Security Center
- Windows Defender
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\iicbulmv.exe
- %ALLUSERSPROFILE%\fhctjajk.log
- %LOCALAPPDATA%\rgtylibx.log
- %LOCALAPPDATA%\iwpqijby\qahdsmkp.exe
- %TEMP%\xofkvjdc.sys
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\qahdsmkp.exe
Deletes the following files
- %TEMP%\xofkvjdc.sys
Network activity
Connects to
- 'google.com':80
- 'yf####qbsnghyln.com':443
- 'kt####sckypuxwq.com':443
- 'sr####tydkmgvrp.com':443
- 'ee###vadm.com':443
- 'ue#####acktsvcunoh.com':443
- 'pa###pelike.com':443
TCP
Other
- 'yf####qbsnghyln.com':443
- 'ee###vadm.com':443
- 'pa###pelike.com':443
UDP
- DNS ASK google.com
- DNS ASK nm###wnr.com
- DNS ASK vj###vvqhwr.com
- DNS ASK sb#####xbudqmqtj.com
- DNS ASK gj###grfba.com
- DNS ASK ru#####tnlwlxdhxplo.com
- DNS ASK et#####grjnnxjou.com
- DNS ASK jd###dhq.com
- DNS ASK ev#####oxhtqbpuemm.com
- DNS ASK yv###hjcwk.com
- DNS ASK xj#####movbogifpnx.com
- DNS ASK hb####sgvedcu.com
- DNS ASK ix####klgqhixri.com
- DNS ASK wh###vdk.com
- DNS ASK yt###anjjb.com
- DNS ASK aq####cqihrpnp.com
- DNS ASK hn###fjivs.com
- DNS ASK yd###jtxa.com
- DNS ASK vk####uqmgylxcc.com
- DNS ASK na#####kgfeknyoe.com
- DNS ASK oi####fveenb.com
- DNS ASK ws#####mqlmqxgce.com
- DNS ASK gk####vpcwpl.com
- DNS ASK dq###ocuhdd.com
- DNS ASK oy#####pstvepdrhx.com
- DNS ASK pm###fvsym.com
- DNS ASK uk#####tjqfpkejbvd.com
- DNS ASK ep###dtu.com
- DNS ASK xm####pejell.com
- DNS ASK fv#####waixxtwhx.com
- DNS ASK tp####rkxdox.com
- DNS ASK iq####ilnxnojc.com
- DNS ASK sw#####acybaaetxsvt.com
- DNS ASK sf#####mrgfgsiylic.com
- DNS ASK ao#####ertpbotyb.com
- DNS ASK cs####celbjj.com
- DNS ASK cf####borxbjrjj.com
- DNS ASK kl###klvl.com
- DNS ASK kd####lnwpuxck.com
- DNS ASK xh#####yoaeguonvrpt.com
- DNS ASK aw#####xhdrdbxficu.com
- DNS ASK ul####sdldtcg.com
- DNS ASK xm####nbpoxg.com
- DNS ASK vg###oboahb.com
- DNS ASK yo###neoani.com
- DNS ASK po####fakdbutx.com
- DNS ASK mr###bvwaq.com
- DNS ASK oq###itv.com
- DNS ASK xg###osi.com
- DNS ASK ex####ryyioyt.com
- DNS ASK dj###jea.com
- DNS ASK pa###pelike.com
- DNS ASK sj####lwpjrryb.com
- DNS ASK cg###yjnq.com
- DNS ASK wu###byhauu.com
- DNS ASK bx#####wnbrqilaawj.com
- DNS ASK cf###jfuf.com
- DNS ASK jr#####bmyawoqmxawa.com
- DNS ASK un#####klfdombjhb.com
- DNS ASK fw###ryshl.com
- DNS ASK nh###uatf.com
- DNS ASK nu#####uhsqvaeqscki.com
- DNS ASK wi####lourbwrn.com
- DNS ASK vj#####xcuovefmnm.com
- DNS ASK ms####pxfxxyyg.com
- DNS ASK dk#####wxjpkpahm.com
- DNS ASK pt###xqd.com
- DNS ASK ug#####rhyfpvstlrtp.com
- DNS ASK nr####cvocmyqb.com
- DNS ASK un###ccbb.com
- DNS ASK uq###cktmgd.com
- DNS ASK fl###elho.com
- DNS ASK dw#####tybclvbjld.com
- DNS ASK td###deqsjt.com
- DNS ASK gg###gam.com
- DNS ASK fs###vrooq.com
- DNS ASK mk#####qtxpvlnpuiba.com
- DNS ASK bt###hpr.com
- DNS ASK on#####djsjupowpsp.com
- DNS ASK hh####wawqcdhux.com
- DNS ASK yo#####egkjvhytxvq.com
- DNS ASK fh###hrfkd.com
- DNS ASK ab#####lylgwpyxbamw.com
- DNS ASK wx#####ixetbdteppc.com
- DNS ASK ba####gvuyonjlx.com
- DNS ASK bu#####qyroficsxsw.com
- DNS ASK vu####tmmudmgcj.com
- DNS ASK pd###vyvbxc.com
- DNS ASK av#####gnmnubdtdo.com
- DNS ASK pr#####qqguixclk.com
- DNS ASK xe###agcn.com
- DNS ASK xp####neolgwc.com
- DNS ASK gs####eohogiao.com
- DNS ASK wg#####oguhekies.com
- DNS ASK pf####sryfloj.com
- DNS ASK xp#####unoaaradjyaa.com
- DNS ASK cy####qjrvvscbj.com
- DNS ASK og#####uggaajyqo.com
- DNS ASK mo####rvcuet.com
- DNS ASK vt###ntjx.com
- DNS ASK sl####ndjklhgnj.com
- DNS ASK bd###pqm.com
- DNS ASK fd#####isladjlfoj.com
- DNS ASK bq#####sanfwqlgkws.com
- DNS ASK ch####kswlax.com
- DNS ASK tn####qcplpmyr.com
- DNS ASK or#####tqgppnmwyhkv.com
- DNS ASK xa###abf.com
- DNS ASK ue#####acktsvcunoh.com
- DNS ASK xt###hurjk.com
- DNS ASK db#####ohbhckuegu.com
- DNS ASK yl#####vpllovqwm.com
- DNS ASK vx####mndbwdlh.com
- DNS ASK hv###ppig.com
- DNS ASK vm####qngjqi.com
- DNS ASK qg#####gnslvbywpv.com
- DNS ASK ed####xnoqvkg.com
- DNS ASK sb####mupbsjk.com
- DNS ASK mt#####pbnfklqel.com
- DNS ASK mn#####ljpiivcmwxw.com
- DNS ASK ws#####oyrcmyhymna.com
- DNS ASK ca####vrwptpnq.com
- DNS ASK cl#####vfjagolwifam.com
- DNS ASK dk####mlimcerh.com
- DNS ASK ms####xrowicgf.com
- DNS ASK fw#####pivbagijwrd.com
- DNS ASK da###isp.com
- DNS ASK sa###hunter.com
- DNS ASK yf####qbsnghyln.com
- DNS ASK av#####blpliagjma.com
- DNS ASK sr####tydkmgvrp.com
- DNS ASK ee###vadm.com
- DNS ASK kt####sckypuxwq.com
- DNS ASK ty###wnkq.com
- DNS ASK ev###pofko.com
- DNS ASK hv#####frskcivax.com
- DNS ASK wa#####rfsvfomse.com
- DNS ASK bq###ulm.com
- DNS ASK dp####ucfiec.com
- DNS ASK pe###piltvr.com
- DNS ASK fj###uwl.com
- DNS ASK rw###rwo.com
- DNS ASK eg#####krexhkxjuyu.com
- DNS ASK vy###vxgj.com
- DNS ASK uc###utcvsi.com
- DNS ASK jq####fwbicx.com
- DNS ASK ht#####rekiobxxyoy.com
- DNS ASK jb####niewkkdbv.com
- DNS ASK ri#####ydnqpostrt.com
- DNS ASK hs###plirk.com
- DNS ASK eu####mndmkklho.com
- DNS ASK mj###ufp.com
- DNS ASK iu###bfjxvw.com
- DNS ASK tb####ctjxiq.com
- DNS ASK jr#####mbjfxeyorlrx.com
- DNS ASK fk####crbsoeqq.com
- DNS ASK kx###mbeqos.com
- DNS ASK rn#####itwbvjrepl.com
- DNS ASK ja####faxsyrid.com
- DNS ASK op###hhchw.com
- DNS ASK up#####gpmypcugarj.com
- DNS ASK qb###cnha.com
- DNS ASK ok#####aljjrphwdur.com
- DNS ASK wu#####wpowxakrq.com
- DNS ASK gf#####jjglcgtmedrk.com
- DNS ASK nf####plhntpm.com
- DNS ASK uw###tum.com
- DNS ASK kw####dbviso.com
- DNS ASK vg####safawkfha.com
- DNS ASK bh###hegq.com
- DNS ASK ds####aesgpl.com
- DNS ASK fc###cybe.com
- DNS ASK wo####pwmakrynt.com
- DNS ASK st####mwylvsxy.com
- DNS ASK cl####awruruhei.com
- DNS ASK uw#####dffognvgj.com
- DNS ASK hp####ylmqqh.com
- DNS ASK gg###iryh.com
- DNS ASK qe####molasyefx.com
- DNS ASK os###fdbvu.com
- DNS ASK nq####cbrpynvh.com
- DNS ASK kb#####ojfdoufjcjw.com
- DNS ASK wv#####iyjqivdtmfq.com
- DNS ASK mt#####dllawoubnt.com
- DNS ASK ct#####hntqwltsg.com
- DNS ASK io#####hsbqhqiwl.com
- DNS ASK pg###woure.com
- DNS ASK nj####rcijwg.com
- DNS ASK jd####jihcuk.com
- DNS ASK jj###gmx.com
- DNS ASK ey#####jtdvitvce.com
- DNS ASK ej#####rsllnvpms.com
- DNS ASK gu####ejafimbn.com
- DNS ASK as#####mrumqprqq.com
- DNS ASK sk#####vwjmhhbcpc.com
- DNS ASK rm###okeoha.com
- DNS ASK bh####otwosh.com
- DNS ASK uc####xdoalhtt.com
- DNS ASK yt###xta.com
- DNS ASK fp####fisuekk.com
- DNS ASK hq###tcv.com
- DNS ASK ti#####nmnptigje.com
- 'localhost':58994
- 'localhost':64050
Miscellaneous
Creates and executes the following
- '%TEMP%\iicbulmv.exe' elevate
- '%TEMP%\iicbulmv.exe' admin
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\iicbulmv.exe"" admin
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\iicbulmv.exe"" admin' (with hidden window)
