Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Topology Shell Services Peer' = '<SYSTEM32>\rjwyjwhzhh.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Protected Provider Windows Tracking Cache PnP-X] 'ImagePath' = '<SYSTEM32>\rjwyjwhzhh.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Protected Provider Windows Tracking Cache PnP-X] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Executes the following:
- '<SYSTEM32>\uatebcgdfxbb.exe' "<SYSTEM32>\rjwyjwhzhh.exe"
- '%WINDIR%\Temp\lqob4uy633wnnzrd.exe' -r 52674 tcp
- '%TEMP%\lqob4uy62ylonzrdspugei.exe'
- '<SYSTEM32>\rjwyjwhzhh.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\mxzlhdyz\run
- <SYSTEM32>\mxzlhdyz\rng
- %WINDIR%\Temp\lqob4uy633wnnzrd.exe
- <SYSTEM32>\mxzlhdyz\cfg
- <SYSTEM32>\uatebcgdfxbb.exe
- %TEMP%\lqob4uy62ylonzrdspugei.exe
- <SYSTEM32>\mxzlhdyz\tst
- <SYSTEM32>\rjwyjwhzhh.exe
- <SYSTEM32>\mxzlhdyz\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\uatebcgdfxbb.exe
- <SYSTEM32>\rjwyjwhzhh.exe
Deletes the following files:
- %WINDIR%\Temp\lqob4uy633wnnzrd.exe
- <DRIVERS>\etc\hosts
- %TEMP%\lqob4uy62ylonzrdspugei.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'ta###hello.net':80
- 'gl###ello.net':80
- 'sa###erve.net':80
- 'gl###ive.net':80
- 'ta###mine.net':80
- 'gl###ine.net':80
- 'sp###erve.net':80
- 'sp###ine.net':80
- 'sa###ello.net':80
- 'sp###ello.net':80
- 'sa###ive.net':80
- 'sp###ive.net':80
- 'sa###ine.net':80
- 'eq###serve.net':80
- 'gr###live.net':80
- 'eq###live.net':80
- 'vi###hello.net':80
- 'sp###hello.net':80
- 'gr###serve.net':80
- 'gr###mine.net':80
- 'ta###serve.net':80
- 'gl###erve.net':80
- 'ta###live.net':80
- 'eq###mine.net':80
- 'gr###hello.net':80
- 'eq###hello.net':80
- 'ri###nstorm.net':80
- 'al###being.net':80
- 'ca####nbring.net':80
- 'ar###mine.net':80
- 'so###hello.net':80
- 'be##lxc.com':80
- 'pr####tbottom.net':80
- 'mo###ugust.net':80
- 'le###form.net':80
- 'cr#####onaraminta.net':80
- 'mo###olor.net':80
- 'ab###ell.net':80
- 'mi###hown.net':80
- 'up###ive.net':80
- 'wh###mine.net':80
- 'up###ine.net':80
- 'wh###serve.net':80
- 'up###erve.net':80
- 'wh###live.net':80
- 'wh###hello.net':80
- 'so###live.net':80
- 'ar###live.net':80
- 'so###mine.net':80
- 'up###ello.net':80
- 'so###serve.net':80
- 'ar###serve.net':80
TCP:
HTTP GET requests:
- http://ta###hello.net/index.php
- http://gl###ello.net/index.php
- http://sa###erve.net/index.php
- http://gl###ive.net/index.php
- http://ta###mine.net/index.php
- http://gl###ine.net/index.php
- http://sp###erve.net/index.php
- http://sp###ine.net/index.php
- http://sa###ello.net/index.php
- http://sp###ello.net/index.php
- http://sa###ive.net/index.php
- http://sp###ive.net/index.php
- http://sa###ine.net/index.php
- http://eq###serve.net/index.php
- http://gr###live.net/index.php
- http://eq###live.net/index.php
- http://vi###hello.net/index.php
- http://sp###hello.net/index.php
- http://gr###serve.net/index.php
- http://gr###mine.net/index.php
- http://ta###serve.net/index.php
- http://gl###erve.net/index.php
- http://ta###live.net/index.php
- http://eq###mine.net/index.php
- http://gr###hello.net/index.php
- http://eq###hello.net/index.php
- http://ri###nstorm.net/index.php
- http://al###being.net/index.php
- http://ca####nbring.net/index.php
- http://ar###mine.net/index.php
- http://so###hello.net/index.php
- http://be##lxc.com/index.php
- http://pr####tbottom.net/index.php
- http://mo###ugust.net/index.php
- http://le###form.net/index.php
- http://cr#####onaraminta.net/index.php
- http://mo###olor.net/index.php
- http://ab###ell.net/index.php
- http://mi###hown.net/index.php
- http://up###ive.net/index.php
- http://wh###mine.net/index.php
- http://up###ine.net/index.php
- http://wh###serve.net/index.php
- http://up###erve.net/index.php
- http://wh###live.net/index.php
- http://wh###hello.net/index.php
- http://so###live.net/index.php
- http://ar###live.net/index.php
- http://so###mine.net/index.php
- http://up###ello.net/index.php
- http://so###serve.net/index.php
- http://ar###serve.net/index.php
UDP:
- DNS ASK ta###hello.net
- DNS ASK gl###ello.net
- DNS ASK sa###erve.net
- DNS ASK gl###ive.net
- DNS ASK ta###mine.net
- DNS ASK gl###ine.net
- DNS ASK sp###erve.net
- DNS ASK sp###ine.net
- DNS ASK sa###ello.net
- DNS ASK sp###ello.net
- DNS ASK sa###ive.net
- DNS ASK sp###ive.net
- DNS ASK sa###ine.net
- DNS ASK ta###live.net
- DNS ASK gr###serve.net
- DNS ASK eq###serve.net
- DNS ASK gr###live.net
- DNS ASK sp###mine.net
- DNS ASK vi###hello.net
- DNS ASK sp###hello.net
- DNS ASK eq###live.net
- DNS ASK eq###hello.net
- DNS ASK ta###serve.net
- DNS ASK gl###erve.net
- DNS ASK gr###mine.net
- DNS ASK eq###mine.net
- DNS ASK gr###hello.net
- DNS ASK ri###nstorm.net
- DNS ASK al###being.net
- DNS ASK ca####nbring.net
- DNS ASK ar###mine.net
- DNS ASK so###hello.net
- DNS ASK be##lxc.com
- DNS ASK pr####tbottom.net
- DNS ASK mo###ugust.net
- DNS ASK le###form.net
- DNS ASK cr#####onaraminta.net
- DNS ASK mo###olor.net
- DNS ASK ab###ell.net
- DNS ASK mi###hown.net
- DNS ASK up###ive.net
- DNS ASK wh###mine.net
- DNS ASK up###ine.net
- DNS ASK wh###serve.net
- DNS ASK up###erve.net
- DNS ASK wh###live.net
- DNS ASK wh###hello.net
- DNS ASK so###live.net
- DNS ASK ar###live.net
- DNS ASK so###mine.net
- DNS ASK up###ello.net
- DNS ASK so###serve.net
- DNS ASK ar###serve.net
- '23#.#55.255.250':1900
