Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Process Adapter Shadow Manager' = '<SYSTEM32>\qqsmxpakr.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\qqsmxpakr.exe
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Enumerator Key Parental Foundation Portable] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\tnaxgbij.exe' "<SYSTEM32>\qqsmxpakr.exe"
- '%WINDIR%\Temp\qegusdf5v5zdotsw.exe' -r 43020 tcp
- '%TEMP%\qegusdf5lq5dotsfzoia1.exe'
- '<SYSTEM32>\qqsmxpakr.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\alcyfyyzkybesj\run
- <SYSTEM32>\alcyfyyzkybesj\rng
- <SYSTEM32>\alcyfyyzkybesj\cfg
- <SYSTEM32>\alcyfyyzkybesj\por
- %WINDIR%\Temp\qegusdf5v5zdotsw.exe
- %TEMP%\qegusdf5lq5dotsfzoia1.exe
- <SYSTEM32>\alcyfyyzkybesj\tst
- <SYSTEM32>\alcyfyyzkybesj\etc
- <SYSTEM32>\tnaxgbij.exe
- <SYSTEM32>\qqsmxpakr.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\tnaxgbij.exe
- <SYSTEM32>\qqsmxpakr.exe
Deletes the following files:
- %WINDIR%\Temp\qegusdf5v5zdotsw.exe
- %TEMP%\qegusdf5lq5dotsfzoia1.exe
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'fi###news.net':80
- 'th###state.net':80
- 'fi###mark.net':80
- 'so###news.net':80
- 'li###tate.net':80
- 'th###mark.net':80
- 'li###ark.net':80
- 'th###broke.net':80
- 'li###roke.net':80
- 'so###mark.net':80
- 'fa###teach.net':80
- 'ri###rave.net':80
- 'fa###could.net':80
- 'ri###each.net':80
- 'fa###grave.net':80
- 'so###broke.net':80
- 'fi###broke.net':80
- 'so###state.net':80
- 'fi###state.net':80
- 'th###news.net':80
- 'le###roke.net':80
- 'ta###mark.net':80
- 'le###tate.net':80
- 'ta###broke.net':80
- 'le###ark.net':80
- 'po###state.net':80
- 'ca###tate.net':80
- 'ta###news.net':80
- 'le###ews.net':80
- 'ta###state.net':80
- 'we###tate.net':80
- 'fe###roke.net':80
- 'li###ews.net':80
- 'fe###tate.net':80
- 'we###roke.net':80
- 'fe###ews.net':80
- 'we###ews.net':80
- 'fe###ark.net':80
- 'we###ark.net':80
- 'ri###ould.net':80
- 'we###each.net':80
- 'fe###rave.net':80
- 'we###ould.net':80
- 'fe###each.net':80
- 'we###rave.net':80
- 'ta###could.net':80
- 'le###ould.net':80
- 'ta###usual.net':80
- 'le###sual.net':80
- 'fe###ould.net':80
- 'ja###uter.com':80
- 'go#####everytime.com':80
- 'do####club-grup.com':80
- 'el#####arimagine.com':80
- 'li###each.net':80
- 'fe###sual.net':80
- 'we###sual.net':80
- 'th###grave.net':80
- 'li###rave.net':80
- 'ta###teach.net':80
- 'li###sual.net':80
- 'no###ould.net':80
- 'ca###rave.net':80
- 'no###sual.net':80
- 'li###ould.net':80
- 'ri###sual.net':80
- 'fa###usual.net':80
- 'no###each.net':80
- 'no###rave.net':80
- 'po###grave.net':80
- 'le###rave.net':80
- 'po###usual.net':80
- 'le###each.net':80
- 'ta###grave.net':80
- 'ca###sual.net':80
- 'po###teach.net':80
- 'ca###each.net':80
- 'po###could.net':80
- 'ca###ould.net':80
TCP:
HTTP GET requests:
- fi###news.net/forum/search.php?me#########################################
- th###state.net/forum/search.php?me#########################################
- fi###mark.net/forum/search.php?me#########################################
- so###news.net/forum/search.php?me#########################################
- li###tate.net/forum/search.php?me#########################################
- th###mark.net/forum/search.php?me#########################################
- li###ark.net/forum/search.php?me#########################################
- th###broke.net/forum/search.php?me#########################################
- li###roke.net/forum/search.php?me#########################################
- so###mark.net/forum/search.php?me#########################################
- fa###teach.net/forum/search.php?me#########################################
- ri###rave.net/forum/search.php?me#########################################
- fa###could.net/forum/search.php?me#########################################
- ri###each.net/forum/search.php?me#########################################
- fa###grave.net/forum/search.php?me#########################################
- so###broke.net/forum/search.php?me#########################################
- fi###broke.net/forum/search.php?me#########################################
- so###state.net/forum/search.php?me#########################################
- fi###state.net/forum/search.php?me#########################################
- th###news.net/forum/search.php?me#########################################
- le###roke.net/forum/search.php?me#########################################
- ta###mark.net/forum/search.php?me#########################################
- le###tate.net/forum/search.php?me#########################################
- ta###broke.net/forum/search.php?me#########################################
- le###ark.net/forum/search.php?me#########################################
- po###state.net/forum/search.php?me#########################################
- ca###tate.net/forum/search.php?me#########################################
- ta###news.net/forum/search.php?me#########################################
- le###ews.net/forum/search.php?me#########################################
- ta###state.net/forum/search.php?me#########################################
- we###tate.net/forum/search.php?me#########################################
- fe###roke.net/forum/search.php?me#########################################
- li###ews.net/forum/search.php?me#########################################
- fe###tate.net/forum/search.php?me#########################################
- we###roke.net/forum/search.php?me#########################################
- fe###ews.net/forum/search.php?me#########################################
- we###ews.net/forum/search.php?me#########################################
- fe###ark.net/forum/search.php?me#########################################
- we###ark.net/forum/search.php?me#########################################
- ri###ould.net/forum/search.php?me#########################################
- we###each.net/forum/search.php?me#########################################
- fe###rave.net/forum/search.php?me#########################################
- we###ould.net/forum/search.php?me#########################################
- fe###each.net/forum/search.php?me#########################################
- we###rave.net/forum/search.php?me#########################################
- ta###could.net/forum/search.php?me#########################################
- le###ould.net/forum/search.php?me#########################################
- ta###usual.net/forum/search.php?me#########################################
- le###sual.net/forum/search.php?me#########################################
- fe###ould.net/forum/search.php?me#########################################
- ja###uter.com/forum/search.php?me#########################################
- go#####everytime.com/forum/search.php?me#########################################
- do####club-grup.com/forum/search.php?me#########################################
- el#####arimagine.com/forum/search.php?me#########################################
- li###each.net/forum/search.php?me#########################################
- fe###sual.net/forum/search.php?me#########################################
- we###sual.net/forum/search.php?me#########################################
- th###grave.net/forum/search.php?me#########################################
- li###rave.net/forum/search.php?me#########################################
- ta###teach.net/forum/search.php?me#########################################
- li###sual.net/forum/search.php?me#########################################
- no###ould.net/forum/search.php?me#########################################
- ca###rave.net/forum/search.php?me#########################################
- no###sual.net/forum/search.php?me#########################################
- li###ould.net/forum/search.php?me#########################################
- ri###sual.net/forum/search.php?me#########################################
- fa###usual.net/forum/search.php?me#########################################
- no###each.net/forum/search.php?me#########################################
- no###rave.net/forum/search.php?me#########################################
- po###grave.net/forum/search.php?me#########################################
- le###rave.net/forum/search.php?me#########################################
- po###usual.net/forum/search.php?me#########################################
- le###each.net/forum/search.php?me#########################################
- ta###grave.net/forum/search.php?me#########################################
- ca###sual.net/forum/search.php?me#########################################
- po###teach.net/forum/search.php?me#########################################
- ca###each.net/forum/search.php?me#########################################
- po###could.net/forum/search.php?me#########################################
- ca###ould.net/forum/search.php?me#########################################
UDP:
- DNS ASK fi###news.net
- DNS ASK th###state.net
- DNS ASK so###news.net
- DNS ASK so###mark.net
- DNS ASK fi###mark.net
- DNS ASK th###mark.net
- DNS ASK li###ark.net
- DNS ASK li###roke.net
- DNS ASK li###tate.net
- DNS ASK th###broke.net
- DNS ASK fa###teach.net
- DNS ASK ri###rave.net
- DNS ASK ri###each.net
- DNS ASK ri###ould.net
- DNS ASK fa###could.net
- DNS ASK so###broke.net
- DNS ASK fi###broke.net
- DNS ASK fi###state.net
- DNS ASK fa###grave.net
- DNS ASK so###state.net
- DNS ASK le###roke.net
- DNS ASK ta###mark.net
- DNS ASK ta###broke.net
- DNS ASK ta###state.net
- DNS ASK le###tate.net
- DNS ASK po###state.net
- DNS ASK ca###tate.net
- DNS ASK le###ews.net
- DNS ASK le###ark.net
- DNS ASK ta###news.net
- DNS ASK we###tate.net
- DNS ASK fe###roke.net
- DNS ASK fe###tate.net
- DNS ASK th###news.net
- DNS ASK li###ews.net
- DNS ASK fe###ews.net
- DNS ASK we###ews.net
- DNS ASK we###ark.net
- DNS ASK we###roke.net
- DNS ASK fe###ark.net
- DNS ASK we###each.net
- DNS ASK fe###rave.net
- DNS ASK we###ould.net
- DNS ASK fe###each.net
- DNS ASK we###rave.net
- DNS ASK ta###could.net
- DNS ASK le###ould.net
- DNS ASK ta###usual.net
- DNS ASK le###sual.net
- DNS ASK fe###ould.net
- DNS ASK ja###uter.com
- DNS ASK go#####everytime.com
- DNS ASK do####club-grup.com
- DNS ASK el#####arimagine.com
- DNS ASK li###each.net
- DNS ASK fe###sual.net
- DNS ASK we###sual.net
- DNS ASK th###grave.net
- DNS ASK li###rave.net
- DNS ASK ta###teach.net
- DNS ASK li###sual.net
- DNS ASK no###ould.net
- DNS ASK ca###rave.net
- DNS ASK no###sual.net
- DNS ASK li###ould.net
- DNS ASK ri###sual.net
- DNS ASK fa###usual.net
- DNS ASK no###each.net
- DNS ASK no###rave.net
- DNS ASK po###grave.net
- DNS ASK le###rave.net
- DNS ASK po###usual.net
- DNS ASK le###each.net
- DNS ASK ta###grave.net
- DNS ASK ca###sual.net
- DNS ASK po###teach.net
- DNS ASK ca###each.net
- DNS ASK po###could.net
- DNS ASK ca###ould.net
- '23#.#55.255.250':1900
