Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Level Access Networking Secondary Config' = 'C:\olndmylqwmqiuui\rkdvzcxn.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Ordering Connection Machine DNS] 'ImagePath' = 'C:\olndmylqwmqiuui\rkdvzcxn.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Ordering Connection Machine DNS] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\olndmylqwmqiuui\nmkjqnvyaw.exe' "c:\olndmylqwmqiuui\rkdvzcxn.exe"
- 'C:\olndmylqwmqiuui\rkdvzcxn.exe'
- 'C:\olndmylqwmqiuui\nf3mjngyqdubdt1no.exe'
Modifies file system:
Creates the following files:
- C:\olndmylqwmqiuui\rkdvzcxn.exe
- C:\olndmylqwmqiuui\nmkjqnvyaw.exe
- C:\olndmylqwmqiuui\nf3mjngyqdubdt1no.exe
- %WINDIR%\olndmylqwmqiuui\ucbheirl
- C:\olndmylqwmqiuui\ucbheirl
Sets the 'hidden' attribute to the following files:
- C:\olndmylqwmqiuui\nmkjqnvyaw.exe
- C:\olndmylqwmqiuui\rkdvzcxn.exe
Deletes the following files:
- C:\olndmylqwmqiuui\nf3mjngyqdubdt1no.exe
- %WINDIR%\olndmylqwmqiuui\ucbheirl
Network activity:
Connects to:
- 'sw###device.net':80
- 'pr####lydevice.net':80
- 'sw####anguage.net':80
- 'pr#####ylanguage.net':80
- 'sw###before.net':80
- 'ma####alsettle.net':80
- 'se####llanguage.net':80
- 'pr####lybefore.net':80
- 'se####lsettle.net':80
- 'le####anguage.net':80
- 'fi####device.net':80
- 'le###settle.net':80
- 'fi####language.net':80
- 'le###device.net':80
- 'sw###settle.net':80
- 'pr####lysettle.net':80
- 'fi####before.net':80
- 'le###before.net':80
- 'ma#####llanguage.net':80
- 'la###banker.net':80
- 'si###efound.net':80
- 'la####uccess.net':80
- 'se####banker.net':80
- 'mo###rfound.net':80
- 'si####success.net':80
- 'mo####success.net':80
- 'si####spring.net':80
- 'mo####spring.net':80
- 'se####lbefore.net':80
- 'ma####albefore.net':80
- 'se####ldevice.net':80
- 'ma####aldevice.net':80
- 'se###afound.net':80
- 'la###spring.net':80
- 'se####success.net':80
- 'la###found.net':80
- 'se####spring.net':80
- 'mo####language.net':80
- 'si####device.net':80
- 'mo####settle.net':80
- 'si####language.net':80
- 'mo####device.net':80
- 'mo####insettle.net':80
- 'po####lesettle.net':80
- 'si####before.net':80
- 'mo####before.net':80
- 'se####language.net':80
- 'la####anguage.net':80
- 'se####settle.net':80
- 'la###settle.net':80
- 'se####device.net':80
- 'la###before.net':80
- 'si####settle.net':80
- 'la###device.net':80
- 'se####before.net':80
- 'mo#####nlanguage.net':80
- 'pe####sbefore.net':80
- 'wi####before.net':80
- 'pe####sdevice.net':80
- 'wi####device.net':80
- 'su####tsettle.net':80
- 'su####tbefore.net':80
- 'fi####settle.net':80
- 'su####tlanguage.net':80
- 'su####tdevice.net':80
- 'po####ledevice.net':80
- 'mo####inbefore.net':80
- 'po#####elanguage.net':80
- 'mo####indevice.net':80
- 'po####lebefore.net':80
- 'pe####slanguage.net':80
- 'wi####language.net':80
- 'pe####ssettle.net':80
- 'wi####settle.net':80
TCP:
HTTP GET requests:
- http://sw###device.net/index.php
- http://pr####lydevice.net/index.php
- http://sw####anguage.net/index.php
- http://pr#####ylanguage.net/index.php
- http://sw###before.net/index.php
- http://ma####alsettle.net/index.php
- http://se####llanguage.net/index.php
- http://pr####lybefore.net/index.php
- http://se####lsettle.net/index.php
- http://le####anguage.net/index.php
- http://fi####device.net/index.php
- http://le###settle.net/index.php
- http://fi####language.net/index.php
- http://le###device.net/index.php
- http://sw###settle.net/index.php
- http://pr####lysettle.net/index.php
- http://fi####before.net/index.php
- http://le###before.net/index.php
- http://ma#####llanguage.net/index.php
- http://la###banker.net/index.php
- http://si###efound.net/index.php
- http://la####uccess.net/index.php
- http://se####banker.net/index.php
- http://mo###rfound.net/index.php
- http://si####success.net/index.php
- http://mo####success.net/index.php
- http://si####spring.net/index.php
- http://mo####spring.net/index.php
- http://se####lbefore.net/index.php
- http://ma####albefore.net/index.php
- http://se####ldevice.net/index.php
- http://ma####aldevice.net/index.php
- http://se###afound.net/index.php
- http://la###spring.net/index.php
- http://se####success.net/index.php
- http://la###found.net/index.php
- http://se####spring.net/index.php
- http://mo####language.net/index.php
- http://si####device.net/index.php
- http://mo####settle.net/index.php
- http://si####language.net/index.php
- http://mo####device.net/index.php
- http://mo####insettle.net/index.php
- http://po####lesettle.net/index.php
- http://si####before.net/index.php
- http://mo####before.net/index.php
- http://se####language.net/index.php
- http://la####anguage.net/index.php
- http://se####settle.net/index.php
- http://la###settle.net/index.php
- http://se####device.net/index.php
- http://la###before.net/index.php
- http://si####settle.net/index.php
- http://la###device.net/index.php
- http://se####before.net/index.php
- http://mo#####nlanguage.net/index.php
- http://pe####sbefore.net/index.php
- http://wi####before.net/index.php
- http://pe####sdevice.net/index.php
- http://wi####device.net/index.php
- http://su####tsettle.net/index.php
- http://su####tbefore.net/index.php
- http://fi####settle.net/index.php
- http://su####tlanguage.net/index.php
- http://su####tdevice.net/index.php
- http://po####ledevice.net/index.php
- http://mo####inbefore.net/index.php
- http://po#####elanguage.net/index.php
- http://mo####indevice.net/index.php
- http://po####lebefore.net/index.php
- http://pe####slanguage.net/index.php
- http://wi####language.net/index.php
- http://pe####ssettle.net/index.php
- http://wi####settle.net/index.php
UDP:
- DNS ASK pr####lydevice.net
- DNS ASK sw###before.net
- DNS ASK pr#####ylanguage.net
- DNS ASK sw###device.net
- DNS ASK pr####lybefore.net
- DNS ASK se####llanguage.net
- DNS ASK ma#####llanguage.net
- DNS ASK se####lsettle.net
- DNS ASK ma####alsettle.net
- DNS ASK fi####device.net
- DNS ASK le###device.net
- DNS ASK fi####language.net
- DNS ASK le####anguage.net
- DNS ASK fi####before.net
- DNS ASK pr####lysettle.net
- DNS ASK sw####anguage.net
- DNS ASK le###before.net
- DNS ASK sw###settle.net
- DNS ASK se####ldevice.net
- DNS ASK si###efound.net
- DNS ASK mo###rfound.net
- DNS ASK se####banker.net
- DNS ASK la###banker.net
- DNS ASK si####spring.net
- DNS ASK mo####success.net
- DNS ASK si####banker.net
- DNS ASK mo####spring.net
- DNS ASK si####success.net
- DNS ASK ma####albefore.net
- DNS ASK se###afound.net
- DNS ASK ma####aldevice.net
- DNS ASK se####lbefore.net
- DNS ASK la###found.net
- DNS ASK se####success.net
- DNS ASK la####uccess.net
- DNS ASK se####spring.net
- DNS ASK la###spring.net
- DNS ASK le###settle.net
- DNS ASK mo####language.net
- DNS ASK si####device.net
- DNS ASK mo####settle.net
- DNS ASK si####language.net
- DNS ASK mo####device.net
- DNS ASK mo####insettle.net
- DNS ASK po####lesettle.net
- DNS ASK si####before.net
- DNS ASK mo####before.net
- DNS ASK se####language.net
- DNS ASK la####anguage.net
- DNS ASK se####settle.net
- DNS ASK la###settle.net
- DNS ASK se####device.net
- DNS ASK la###before.net
- DNS ASK si####settle.net
- DNS ASK la###device.net
- DNS ASK se####before.net
- DNS ASK mo#####nlanguage.net
- DNS ASK pe####sbefore.net
- DNS ASK wi####before.net
- DNS ASK pe####sdevice.net
- DNS ASK wi####device.net
- DNS ASK su####tsettle.net
- DNS ASK su####tbefore.net
- DNS ASK fi####settle.net
- DNS ASK su####tlanguage.net
- DNS ASK su####tdevice.net
- DNS ASK po####ledevice.net
- DNS ASK mo####inbefore.net
- DNS ASK po#####elanguage.net
- DNS ASK mo####indevice.net
- DNS ASK po####lebefore.net
- DNS ASK pe####slanguage.net
- DNS ASK wi####language.net
- DNS ASK pe####ssettle.net
- DNS ASK wi####settle.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''