Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'File Engine Initiator Application Biometric' = '<SYSTEM32>\gqidwzqulk.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\File Now Tracking Interactive] 'ImagePath' = '<SYSTEM32>\gqidwzqulk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\File Now Tracking Interactive] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Executes the following:
- '<SYSTEM32>\lsjscxcuxap.exe' "<SYSTEM32>\gqidwzqulk.exe"
- '%WINDIR%\Temp\bemlsboxh7x2mgpm.exe' -r 47119 tcp
- '%TEMP%\bemlsboxj0z7tapmcj5vng.exe'
- '<SYSTEM32>\gqidwzqulk.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\mkzjavjug\run
- <SYSTEM32>\mkzjavjug\rng
- %WINDIR%\Temp\bemlsboxh7x2mgpm.exe
- <SYSTEM32>\mkzjavjug\cfg
- %TEMP%\bemlsboxj0z7tapmcj5vng.exe
- <SYSTEM32>\mkzjavjug\tst
- <SYSTEM32>\lsjscxcuxap.exe
- <SYSTEM32>\gqidwzqulk.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\lsjscxcuxap.exe
- <SYSTEM32>\gqidwzqulk.exe
Deletes the following files:
- %WINDIR%\Temp\bemlsboxh7x2mgpm.exe
- %TEMP%\bemlsboxj0z7tapmcj5vng.exe
Network activity:
Connects to:
- 'wh###free.net':80
- 'up###ree.net':80
- 'so###wall.net':80
- 'up##free.ru':80
- 'up###orty.net':80
- 'sp###orty.net':80
- 'sp###ther.net':80
- 'eq###forty.net':80
- 'gr###forty.net':80
- 'ri###nstorm.net':80
- 'lo####thepings.ru':80
- '18#.#17.73.77':80
- '18#.#06.120.168':80
- 'ar###other.net':80
- 'ar###wall.net':80
- 'so###other.net':80
- 'so###forty.ru':80
- 'so###forty.net':80
TCP:
HTTP GET requests:
- http://wh###free.net/index.php
- http://up###ree.net/index.php
- http://so###wall.net/index.php
- http://up##free.ru/index.php
- http://up###orty.net/index.php
- http://sp###orty.net/index.php
- http://sp###ther.net/index.php
- http://eq###forty.net/index.php
- http://gr###forty.net/index.php
- http://ri###nstorm.net/index.php
- http://lo####thepings.ru/index.php
- http://18#.#17.73.77/index.php
- http://18#.#06.120.168/index.php
- http://ar###other.net/index.php
- http://ar###wall.net/index.php
- http://so###other.net/index.php
- http://so###forty.ru/index.php
- http://so###forty.net/index.php
UDP:
- DNS ASK fr###agree.net
- DNS ASK of###agree.net
- DNS ASK of###form.ru
- DNS ASK of###form.net
- DNS ASK fr###word.ru
- DNS ASK fr###word.net
- DNS ASK fr###touch.net
- DNS ASK of###touch.net
- DNS ASK fr###form.net
- DNS ASK sp###agree.net
- DNS ASK we###ouch.ru
- DNS ASK sp###form.net
- DNS ASK we###gree.net
- DNS ASK we###ord.net
- DNS ASK sp###word.net
- DNS ASK we###ouch.net
- DNS ASK sp###touch.net
- DNS ASK jo###ouch.net
- DNS ASK wi###ouch.ru
- DNS ASK jo###gree.net
- DNS ASK wi###gree.net
- DNS ASK wi###ord.net
- DNS ASK de###orm.net
- DNS ASK wi###ouch.net
- DNS ASK jo###ord.net
- DNS ASK wi###orm.net
- DNS ASK se####beragree.ru
- DNS ASK se####beragree.net
- DNS ASK of###word.net
- DNS ASK se####berform.net
- DNS ASK jo##form.ru
- DNS ASK jo###orm.net
- DNS ASK se####bertouch.net
- DNS ASK se####berword.net
- DNS ASK ma###lack.net
- DNS ASK wr###black.net
- DNS ASK wr###grown.net
- DNS ASK ma###rown.net
- DNS ASK ha###orm.net
- DNS ASK hu###form.net
- DNS ASK hu###form.ru
- DNS ASK hu###agree.net
- DNS ASK ma###lain.net
- DNS ASK de###lack.net
- DNS ASK ro###lack.net
- DNS ASK ro###rown.net
- DNS ASK de###lack.ru
- DNS ASK wr###plain.net
- DNS ASK ma###lain.ru
- DNS ASK wr###step.net
- DNS ASK ma###tep.net
- DNS ASK ya###ouch.net
- DNS ASK mu###touch.net
- DNS ASK ya###gree.net
- DNS ASK mu###agree.net
- DNS ASK mu###word.net
- DNS ASK we###orm.net
- DNS ASK ya###ord.net
- DNS ASK mu###word.ru
- DNS ASK ya###gree.ru
- DNS ASK ha###ouch.ru
- DNS ASK ha###ouch.net
- DNS ASK ha###gree.net
- DNS ASK hu###touch.net
- DNS ASK ya###orm.net
- DNS ASK mu###form.net
- DNS ASK hu###word.net
- DNS ASK ha###ord.net
- DNS ASK we###ush.net
- DNS ASK sp###rush.net
- DNS ASK sp###make.ru
- DNS ASK sp###make.net
- DNS ASK fr###clock.ru
- DNS ASK fr###clock.net
- DNS ASK fr###hard.net
- DNS ASK of###hard.net
- DNS ASK we###ake.net
- DNS ASK mu###rush.net
- DNS ASK we##hard.ru
- DNS ASK mu###make.net
- DNS ASK ya###ush.net
- DNS ASK we###lock.net
- DNS ASK sp###clock.net
- DNS ASK we###ard.net
- DNS ASK sp###hard.net
- DNS ASK jo###ard.net
- DNS ASK wi##hard.ru
- DNS ASK se####bermake.net
- DNS ASK se####berrush.net
- DNS ASK wi###lock.net
- DNS ASK jo###ake.net
- DNS ASK wi###ard.net
- DNS ASK jo###lock.net
- DNS ASK ha##make.ru
- DNS ASK of###make.net
- DNS ASK fr###rush.net
- DNS ASK of###clock.net
- DNS ASK fr###make.net
- DNS ASK se####berhard.net
- DNS ASK se####berclock.net
- DNS ASK of###rush.ru
- DNS ASK of###rush.net
- DNS ASK wr###agree.net
- DNS ASK ma###gree.net
- DNS ASK wr###form.net
- DNS ASK ma###orm.net
- DNS ASK ma###ouch.net
- DNS ASK wr###word.net
- DNS ASK wr###touch.ru
- DNS ASK wr###touch.net
- DNS ASK ro###ord.net
- DNS ASK de###gree.net
- DNS ASK ro###gree.net
- DNS ASK ro###orm.net
- DNS ASK de###gree.ru
- DNS ASK de###ord.net
- DNS ASK ro##word.ru
- DNS ASK de###ouch.net
- DNS ASK ro###ouch.net
- DNS ASK ya###ard.net
- DNS ASK mu###hard.net
- DNS ASK hu###rush.net
- DNS ASK ha###ush.net
- DNS ASK mu###clock.net
- DNS ASK ya###ake.net
- DNS ASK ya###lock.net
- DNS ASK mu###clock.ru
- DNS ASK hu###rush.ru
- DNS ASK ha##hard.ru
- DNS ASK ha###ard.net
- DNS ASK ma###ord.net
- DNS ASK hu###hard.net
- DNS ASK hu###make.net
- DNS ASK ha###ake.net
- DNS ASK hu###clock.net
- DNS ASK ha###lock.net
- DNS ASK eq###wall.ru
- DNS ASK eq###wall.net
- DNS ASK eq###other.net
- DNS ASK gr###other.net
- DNS ASK vi###free.net
- DNS ASK sp###forty.net
- DNS ASK gr###wall.net
- DNS ASK sp###free.net
- DNS ASK sa###ther.net
- DNS ASK eq###free.net
- DNS ASK gl###all.net
- DNS ASK ta###wall.net
- DNS ASK wh###other.net
- DNS ASK sp###ree.net
- DNS ASK gr###free.net
- DNS ASK sp###orty.ru
- DNS ASK vi###forty.ru
- DNS ASK fa###orty.net
- DNS ASK fa###ther.ru
- DNS ASK wa###forty.net
- DNS ASK wa###other.net
- DNS ASK fa###all.net
- DNS ASK dr###free.net
- DNS ASK fa###ther.net
- DNS ASK wa###wall.net
- DNS ASK vi###other.net
- DNS ASK sp###wall.net
- DNS ASK vi###forty.net
- DNS ASK sp###other.net
- DNS ASK wa###free.net
- DNS ASK fa###ree.net
- DNS ASK vi###wall.net
- DNS ASK wa###free.ru
- DNS ASK sp###all.net
- DNS ASK up###ree.net
- DNS ASK up###orty.net
- DNS ASK up##free.ru
- DNS ASK wh###free.net
- DNS ASK sp###orty.net
- DNS ASK sp###ther.net
- DNS ASK eq###forty.net
- DNS ASK gr###forty.net
- DNS ASK ar###other.net
- DNS ASK so###forty.ru
- DNS ASK ri###nstorm.net
- DNS ASK lo####thepings.ru
- DNS ASK so###other.net
- DNS ASK so###wall.net
- DNS ASK so###forty.net
- DNS ASK ar###wall.net
- DNS ASK ta###forty.net
- DNS ASK gl###ree.net
- DNS ASK wh###forty.net
- DNS ASK up###ther.net
- DNS ASK wh###other.ru
- DNS ASK gl###ther.net
- DNS ASK sa###ree.net
- DNS ASK gr###free.ru
- DNS ASK sa###all.net
- DNS ASK wh###wall.net
- DNS ASK ta###free.net
- DNS ASK gl###ther.ru
- DNS ASK sa##wall.ru
- DNS ASK ta###other.net
- DNS ASK sa###orty.net
- DNS ASK up###all.net
- DNS ASK gl###orty.net
- DNS ASK th###ree.net
- DNS ASK fr###black.net
- DNS ASK of###black.net
- DNS ASK of###grown.ru
- DNS ASK of###grown.net
- DNS ASK se####berplain.net
- DNS ASK se####bergrown.net
- DNS ASK se####berstep.net
- DNS ASK ha###lain.ru
- DNS ASK fr###step.ru
- DNS ASK fr###step.net
- DNS ASK we###lack.net
- DNS ASK sp###black.net
- DNS ASK of###plain.net
- DNS ASK fr###grown.net
- DNS ASK of###step.net
- DNS ASK fr###plain.net
- DNS ASK se####berblack.ru
- DNS ASK de###tep.net
- DNS ASK ro##step.ru
- DNS ASK jo###lack.net
- DNS ASK wi###lack.net
- DNS ASK ro###lain.net
- DNS ASK de###rown.net
- DNS ASK ro###tep.net
- DNS ASK de###lain.net
- DNS ASK wi###tep.net
- DNS ASK jo###lain.net
- DNS ASK se####berblack.net
- DNS ASK jo###tep.net
- DNS ASK jo###rown.net
- DNS ASK wi###rown.net
- DNS ASK wi###lain.net
- DNS ASK jo###rown.ru
- DNS ASK sp###grown.net
- DNS ASK hu###plain.net
- DNS ASK ha###lain.net
- DNS ASK hu###step.net
- DNS ASK ha###tep.net
- DNS ASK ha###rown.net
- DNS ASK hu###black.net
- DNS ASK hu###grown.ru
- DNS ASK hu###grown.net
- DNS ASK th###orty.net
- DNS ASK dr###other.net
- DNS ASK dr###forty.ru
- DNS ASK dr###forty.net
- DNS ASK th##wall.ru
- DNS ASK th###all.net
- DNS ASK th###ther.net
- DNS ASK dr###wall.net
- DNS ASK ha###lack.net
- DNS ASK we###tep.net
- DNS ASK sp###step.net
- DNS ASK ya###lack.net
- DNS ASK mu###black.net
- DNS ASK sp###plain.net
- DNS ASK we###rown.net
- DNS ASK we###lain.net
- DNS ASK sp###plain.ru
- DNS ASK mu###step.net
- DNS ASK ya###lain.net
- DNS ASK ya###tep.net
- DNS ASK mu###step.ru
- DNS ASK mu###grown.net
- DNS ASK ya###lack.ru
- DNS ASK mu###plain.net
- DNS ASK ya###rown.net
- '23#.#55.255.250':1900