Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Taskman' = '%HOMEPATH%\aegvvp.exe'
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
- %HOMEPATH%\aegvvp.exe
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\aegvvp.exe
Network activity:
UDP:
- DNS ASK mu###.###tal-protection.net.ru
- DNS ASK sl###.##fehousenumber.com
- 'mu###.###tal-protection.net.ru':33111
- 'sl###.##fehousenumber.com':33111
Miscellaneous:
Searches for the following windows:
- ClassName: 'Dfsyemkc. Gjsxetsu' WindowName: 'Frprbesy Xbehons'
- ClassName: 'Blruns Txukq Tn. A' WindowName: 'Wwtthxvhp Xu. Wg'
- ClassName: 'Tqanqwj Gf' WindowName: 'Dhgdqk Yvkpca Fxsnf, Fkxiqsh'
- ClassName: 'Fkxiqsh, Tqanqwj Gf' WindowName: 'Dhgdqk Yvkpca Fxsnf'
- ClassName: 'Tyqaoq Fuwjw Jgla' WindowName: 'Hmndu, Qfk Jpoxgtd'
- ClassName: 'Vcrqety. Ipamqvslt' WindowName: 'Bqrllqbr Aoqg J'
- ClassName: 'Xnv' WindowName: 'Wfhgps, Fdph, Iqqhn, Evoejxf Mmru'
- ClassName: 'Tscqvro Qgqfge U' WindowName: 'Ftlxkw Hujfdsb Yc'
- ClassName: 'Ywhyeqq Uclhkqlmyah' WindowName: 'Rwh, Hfwuoqe. Arw'
- ClassName: 'Pfqyap Piehe Ct' WindowName: 'Rckg, Guxwmr Mpah'
- ClassName: 'Uosei Jaclnnb Ypw' WindowName: 'Fwcqt Lyslq. Kdqix'
- ClassName: 'Mrndta Mknab Ilh. J' WindowName: 'Hfxkb. Xlbsmv Fvl'
- ClassName: 'Aggpsd Rnphvlug' WindowName: 'Vydp. Gujn Vlodk'
- ClassName: 'Wwqlpx Xsbx Ixxnea' WindowName: 'Dxqyfol, Ssee Uuex'
- ClassName: 'Ffh' WindowName: 'Qkr. Qvgrofku Rkd, Onhjuas Xv'
- ClassName: 'Onhjuas Xv, Ffh' WindowName: 'Qkr. Qvgrofku Rkd'
- ClassName: 'Sgjydw Xphhlhg Kn' WindowName: 'Tgvmfip, Xw. Gkg'
- ClassName: 'Anskbag Esguiw. Rtw' WindowName: 'Xajdx, Fvbytk F'
- ClassName: 'Evoejxf Mmru, Xnv' WindowName: 'Wfhgps, Fdph, Iqqhn'
- ClassName: 'Nia. Oohkm Akuc' WindowName: 'Nqqjuw. Ahol Jmbg'
- ClassName: 'Rwivscs Rssgyopiul' WindowName: 'Fif. Uoq Peyf, G'
- ClassName: 'Qdy' WindowName: 'Derq Honphyu Whx, Fhjt Tvjdfh'
- ClassName: 'Fhjt Tvjdfh, Qdy' WindowName: 'Derq Honphyu Whx'
- ClassName: 'Wqcstvwp Kmjmplqe' WindowName: 'Ftqrpsj, Nhsuwgahr'
- ClassName: 'Luxtvaa Fjtdkffi' WindowName: 'Qocsya Rnf. Hhlq'
- ClassName: 'Wugte. Voedep Lp' WindowName: 'Nqjhglax Yageknb X'
- ClassName: 'Adqn. Mel Kmaic' WindowName: 'Sakmeaajhs Hrwi'
- ClassName: 'Sckrvvinkn Mqdxas' WindowName: 'Drmb, Ra. Dpy O'
- ClassName: 'Hkvcuitf Ylw. K' WindowName: 'Kkrgnpd, Igrnn, L'
- ClassName: 'Twsfdbg Xrqy Rxbkm' WindowName: 'Mmjs Iqhukx Djek'
- ClassName: 'Yu' WindowName: 'Gcjcvw. Px, Oiqsnt, Mudhj Npaja Wt'
- ClassName: 'Mudhj Npaja Wt, Yu' WindowName: 'Gcjcvw. Px, Oiqsnt'
- ClassName: 'Kqpel Arem Tniqyq' WindowName: 'Pdwitow Pnul, Oc'
- ClassName: 'Eukdyqxk Jmq Qb' WindowName: 'Utkykrx, Th. Sdd'
- ClassName: 'Hwdgspvy Unfkmx' WindowName: 'Eoqljyijc Sl. Qtmsn'
- ClassName: 'Ojup. Cce. Iduu' WindowName: 'Ownytc, Snkb Tlhew'
- ClassName: 'Klknxqv. Nholujriv' WindowName: 'Hvthku. Ajsivks Y'
