Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'TPM Interactive Tools Cryptographic IP' = '<SYSTEM32>\walbhsghi.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\List Propagation Class] 'ImagePath' = '<SYSTEM32>\walbhsghi.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\List Propagation Class] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\yvczohemt.exe' "<SYSTEM32>\walbhsghi.exe"
- '%WINDIR%\Temp\tnurmxfp4kwmtp.exe' -r 45286 tcp
- '%TEMP%\tnurmxfp4bcgtpngpjk99h.exe'
- '<SYSTEM32>\walbhsghi.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\grggiirmcaxbwaa\run
- <SYSTEM32>\grggiirmcaxbwaa\rng
- %WINDIR%\Temp\tnurmxfp4kwmtp.exe
- <SYSTEM32>\grggiirmcaxbwaa\cfg
- <SYSTEM32>\yvczohemt.exe
- %TEMP%\tnurmxfp4bcgtpngpjk99h.exe
- <SYSTEM32>\grggiirmcaxbwaa\tst
- <SYSTEM32>\walbhsghi.exe
- <SYSTEM32>\grggiirmcaxbwaa\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\yvczohemt.exe
- <SYSTEM32>\walbhsghi.exe
Deletes the following files:
- %WINDIR%\Temp\tnurmxfp4kwmtp.exe
- <DRIVERS>\etc\hosts
- %TEMP%\tnurmxfp4bcgtpngpjk99h.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'dr###moon.net':80
- 'wi###ctober.net':80
- 'dr####ctober.net':80
- 'wi###uter.net':80
- 'dr###outer.net':80
- 'wi###oon.net':80
- 'wi###hoe.net':80
- 'th####ctober.net':80
- 'th###shoe.net':80
- 'lo###uter.net':80
- 'dr###shoe.net':80
- 'th###outer.net':80
- 'th###moon.net':80
- 'so###how.net':80
- 'pi###how.net':80
- 'ab###ear.net':80
- 'pi###ule.net':80
- 'so###unt.net':80
- 'pi###unt.net':80
- 'kn###ear.net':80
- 'kn###unt.net':80
- 'ab###how.net':80
- 'kn###how.net':80
- 'ab###ule.net':80
- 'kn###ule.net':80
- 'ab###unt.net':80
- 'pr####tbottom.net':80
- 'mo###olor.net':80
- 'ab###ell.net':80
- 'ri###nstorm.net':80
- 'al###being.net':80
- 'ca####nbring.net':80
- 'mi###hown.net':80
- 'jo####ymeasure.net':80
- 'th###while.net':80
- 'ef###tbuilt.net':80
- 'mo###ugust.net':80
- 'le###form.net':80
- 'cr#####onaraminta.net':80
- 'lo###ctober.net':80
- 'fe###ctober.net':80
- 'lo###hoe.net':80
- 'fe###uter.net':80
- 'lo###oon.net':80
- 'fe###oon.net':80
- 'fe###hoe.net':80
- 'hi###oon.net':80
- 'wh###ctober.net':80
- 'hi###ctober.net':80
- 'wh###uter.net':80
- 'hi###uter.net':80
- 'wh###oon.net':80
TCP:
HTTP GET requests:
- http://dr###moon.net/index.php
- http://wi###ctober.net/index.php
- http://dr####ctober.net/index.php
- http://wi###uter.net/index.php
- http://dr###outer.net/index.php
- http://wi###oon.net/index.php
- http://wi###hoe.net/index.php
- http://th####ctober.net/index.php
- http://th###shoe.net/index.php
- http://lo###uter.net/index.php
- http://dr###shoe.net/index.php
- http://th###outer.net/index.php
- http://th###moon.net/index.php
- http://so###how.net/index.php
- http://pi###how.net/index.php
- http://ab###ear.net/index.php
- http://pi###ule.net/index.php
- http://so###unt.net/index.php
- http://pi###unt.net/index.php
- http://kn###ear.net/index.php
- http://kn###unt.net/index.php
- http://ab###how.net/index.php
- http://kn###how.net/index.php
- http://ab###ule.net/index.php
- http://kn###ule.net/index.php
- http://ab###unt.net/index.php
- http://pr####tbottom.net/index.php
- http://mo###olor.net/index.php
- http://ab###ell.net/index.php
- http://ri###nstorm.net/index.php
- http://al###being.net/index.php
- http://ca####nbring.net/index.php
- http://mi###hown.net/index.php
- http://jo####ymeasure.net/index.php
- http://th###while.net/index.php
- http://ef###tbuilt.net/index.php
- http://mo###ugust.net/index.php
- http://le###form.net/index.php
- http://cr#####onaraminta.net/index.php
- http://lo###ctober.net/index.php
- http://fe###ctober.net/index.php
- http://lo###hoe.net/index.php
- http://fe###uter.net/index.php
- http://lo###oon.net/index.php
- http://fe###oon.net/index.php
- http://fe###hoe.net/index.php
- http://hi###oon.net/index.php
- http://wh###ctober.net/index.php
- http://hi###ctober.net/index.php
- http://wh###uter.net/index.php
- http://hi###uter.net/index.php
- http://wh###oon.net/index.php
UDP:
- DNS ASK dr###moon.net
- DNS ASK wi###ctober.net
- DNS ASK dr####ctober.net
- DNS ASK wi###uter.net
- DNS ASK dr###outer.net
- DNS ASK wi###oon.net
- DNS ASK wi###hoe.net
- DNS ASK th####ctober.net
- DNS ASK th###shoe.net
- DNS ASK lo###uter.net
- DNS ASK dr###shoe.net
- DNS ASK th###outer.net
- DNS ASK th###moon.net
- DNS ASK kn###how.net
- DNS ASK pi###unt.net
- DNS ASK so###how.net
- DNS ASK pi###how.net
- DNS ASK so###ule.net
- DNS ASK pi###ule.net
- DNS ASK so###unt.net
- DNS ASK ab###ear.net
- DNS ASK ab###unt.net
- DNS ASK kn###unt.net
- DNS ASK ab###how.net
- DNS ASK kn###ear.net
- DNS ASK ab###ule.net
- DNS ASK kn###ule.net
- DNS ASK pr####tbottom.net
- DNS ASK mo###olor.net
- DNS ASK ab###ell.net
- DNS ASK ri###nstorm.net
- DNS ASK al###being.net
- DNS ASK ca####nbring.net
- DNS ASK mi###hown.net
- DNS ASK jo####ymeasure.net
- DNS ASK th###while.net
- DNS ASK ef###tbuilt.net
- DNS ASK mo###ugust.net
- DNS ASK le###form.net
- DNS ASK cr#####onaraminta.net
- DNS ASK lo###ctober.net
- DNS ASK fe###ctober.net
- DNS ASK lo###hoe.net
- DNS ASK fe###uter.net
- DNS ASK lo###oon.net
- DNS ASK fe###oon.net
- DNS ASK fe###hoe.net
- DNS ASK hi###oon.net
- DNS ASK wh###ctober.net
- DNS ASK hi###ctober.net
- DNS ASK wh###uter.net
- DNS ASK hi###uter.net
- DNS ASK wh###oon.net
- '23#.#55.255.250':1900