Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Taskman' = '%HOMEPATH%\aegvvp.exe'
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
- %HOMEPATH%\aegvvp.exe
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\aegvvp.exe
Network activity:
UDP:
- DNS ASK mu###.###tal-protection.net.ru
- DNS ASK sl###.##fehousenumber.com
- 'mu###.###tal-protection.net.ru':27001
- 'sl###.##fehousenumber.com':27001
Miscellaneous:
Searches for the following windows:
- ClassName: 'Ladetf' WindowName: 'Blarguobi. Xgv X, Bgfxi Vtij'
- ClassName: 'Xylokd Sttoi Nmnw' WindowName: 'Srovfl, Smxh, Droe'
- ClassName: 'Bgfxi Vtij, Ladetf' WindowName: 'Blarguobi. Xgv X'
- ClassName: 'Xexwsqtybk, Ywy. Fn' WindowName: 'Yxmxtpx Eoqf Tjic'
- ClassName: 'Ywy. Fn' WindowName: 'Yxmxtpx Eoqf Tjic, Xexwsqtybk'
- ClassName: 'Docpkixgy. Vtklwcn' WindowName: 'Ihjnau Fq, Xtadt'
- ClassName: 'Dddfmut' WindowName: 'Opliatde Rifpd Ufv, Afspg Lbie'
- ClassName: 'Qwrjysakl Jeggqkfqf' WindowName: 'Ycgrruv Lrwvybtx'
- ClassName: 'Afspg Lbie, Dddfmut' WindowName: 'Opliatde Rifpd Ufv'
- ClassName: 'Renpja, Uoj, Mkq' WindowName: 'Fqyoabm Qgp Tarrn'
- ClassName: 'Mkq' WindowName: 'Fqyoabm Qgp Tarrn, Renpja, Uoj'
- ClassName: 'Xku. Lucwr Djsbf Q' WindowName: 'Ydre Kvtglcxfpi'
- ClassName: 'Njv. Ynymn' WindowName: 'Swnyxe Xysxs Fdjt, Lwspx'
- ClassName: 'Kxhbfk Gfilfw E' WindowName: 'Flq, Ttxn Umpola'
- ClassName: 'Lwspx, Njv. Ynymn' WindowName: 'Swnyxe Xysxs Fdjt'
- ClassName: 'Rasglud Hvutpin' WindowName: 'Cvjdflok Opiqkp'
- ClassName: 'Vybin. Plm Prybnahd' WindowName: 'Ypdtucog Mviy R'
- ClassName: 'Lctlb Uth. Vvxjnj' WindowName: 'Sejbbd Rtwdd Aopehq'
- ClassName: 'Arccuj. Lrju Eeijnl' WindowName: 'Heoqjb Bedbol. Spmx'
- ClassName: 'Kemmiik Dvrtrhjkm' WindowName: 'Siecoak Jtdmhprrg L'
- ClassName: 'Mhvrgvq Fyab. Nn' WindowName: 'Raiioamy, Praxqsd R'
- ClassName: 'Ofajwxlq Wsrmgh. Ph' WindowName: 'Fjjspuj Apsmduj Sr'
- ClassName: 'Vhqq. Fmewska Yi' WindowName: 'Lnvgd. Fv, Onxi J'
