Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Discovery Procedure Adaptive Helper TPM' = '<SYSTEM32>\uxsutmsxgth.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Background Video Protocol] 'ImagePath' = '<SYSTEM32>\uxsutmsxgth.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Background Video Protocol] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Executes the following:
- '<SYSTEM32>\txjfprrcclc.exe' "<SYSTEM32>\uxsutmsxgth.exe"
- '%WINDIR%\Temp\ftyrf7pld7txsgip.exe' -r 44182 tcp
- '%TEMP%\ftyrf7746dqjsgipdihfrrn.exe'
- '<SYSTEM32>\uxsutmsxgth.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\mhbeuiwogguv\run
- <SYSTEM32>\mhbeuiwogguv\rng
- %WINDIR%\Temp\ftyrf7pld7txsgip.exe
- <SYSTEM32>\mhbeuiwogguv\cfg
- %TEMP%\ftyrf7746dqjsgipdihfrrn.exe
- <SYSTEM32>\mhbeuiwogguv\tst
- <SYSTEM32>\txjfprrcclc.exe
- <SYSTEM32>\uxsutmsxgth.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\txjfprrcclc.exe
- <SYSTEM32>\uxsutmsxgth.exe
Deletes the following files:
- %WINDIR%\Temp\ftyrf7pld7txsgip.exe
- %TEMP%\ftyrf7746dqjsgipdihfrrn.exe
Network activity:
Connects to:
- 'wa###stand.net':80
- 'wa###stand.ru':80
- 'fa###gain.net':80
- 'fa###gain.ru':80
- 'ha###ose.net':80
- 'th##pass.ru':80
- 'fa###tand.net':80
- 'dr###again.net':80
- 'ri###nstorm.net':80
- 'lo####thepings.ru':80
- '18#.#17.73.77':80
- '18#.#06.120.168':80
- 'fa###ass.net':80
- 'wa###pass.net':80
- 'fa###ugar.net':80
- 'wa###sugar.net':80
TCP:
HTTP GET requests:
- http://wa###stand.net/index.php
- http://wa###stand.ru/index.php
- http://fa###gain.net/index.php
- http://fa###gain.ru/index.php
- http://ha###ose.net/index.php
- http://th##pass.ru/index.php
- http://fa###tand.net/index.php
- http://dr###again.net/index.php
- http://ri###nstorm.net/index.php
- http://lo####thepings.ru/index.php
- http://18#.#17.73.77/index.php
- http://18#.#06.120.168/index.php
- http://fa###ass.net/index.php
- http://wa###pass.net/index.php
- http://fa###ugar.net/index.php
- http://wa###sugar.net/index.php
UDP:
- DNS ASK ya###rms.net
- DNS ASK mu###arms.net
- DNS ASK ya###here.net
- DNS ASK mu###there.net
- DNS ASK mu###stone.net
- DNS ASK ya###ide.net
- DNS ASK ya###tone.ru
- DNS ASK ya###tone.net
- DNS ASK hu###stone.net
- DNS ASK ha###rms.net
- DNS ASK hu###arms.ru
- DNS ASK hu###arms.net
- DNS ASK ha##side.ru
- DNS ASK ha###ide.net
- DNS ASK ha###tone.net
- DNS ASK hu###side.net
- DNS ASK mu###side.net
- DNS ASK fr###there.net
- DNS ASK of###there.net
- DNS ASK we###ide.net
- DNS ASK sp###side.net
- DNS ASK of###arms.net
- DNS ASK fr###stone.net
- DNS ASK fr###arms.net
- DNS ASK of###arms.ru
- DNS ASK sp###there.net
- DNS ASK we###rms.net
- DNS ASK we###here.net
- DNS ASK sp###there.ru
- DNS ASK sp###stone.net
- DNS ASK we##side.ru
- DNS ASK sp###arms.net
- DNS ASK we###tone.net
- DNS ASK ha###here.net
- DNS ASK jo##have.ru
- DNS ASK jo###ave.net
- DNS ASK jo###cean.net
- DNS ASK wi###cean.net
- DNS ASK ro###old.net
- DNS ASK de###econd.net
- DNS ASK wi###ave.net
- DNS ASK de###old.net
- DNS ASK se####berhave.net
- DNS ASK jo###old.net
- DNS ASK ha###cean.ru
- DNS ASK se####berocean.net
- DNS ASK jo###econd.net
- DNS ASK wi###econd.net
- DNS ASK wi##hold.ru
- DNS ASK wi###old.net
- DNS ASK ro###econd.ru
- DNS ASK wr###ocean.net
- DNS ASK ma###cean.ru
- DNS ASK wr###second.net
- DNS ASK ma###econd.net
- DNS ASK ma###ave.net
- DNS ASK hu###there.net
- DNS ASK ma###cean.net
- DNS ASK wr###have.net
- DNS ASK ro###cean.net
- DNS ASK de###ave.net
- DNS ASK ro###econd.net
- DNS ASK de###cean.net
- DNS ASK wr###hold.net
- DNS ASK ma###old.net
- DNS ASK ro###ave.net
- DNS ASK wr###hold.ru
- DNS ASK of###stone.net
- DNS ASK ha###iss.net
- DNS ASK ya###ower.ru
- DNS ASK hu###wide.net
- DNS ASK hu###kiss.net
- DNS ASK ya####morrow.net
- DNS ASK mu####omorrow.net
- DNS ASK ya###ower.net
- DNS ASK mu###lower.net
- DNS ASK ma###ide.net
- DNS ASK hu###lower.net
- DNS ASK wr###side.ru
- DNS ASK wr###side.net
- DNS ASK ha###omorrow.ru
- DNS ASK ha####morrow.net
- DNS ASK ha###ower.net
- DNS ASK hu####omorrow.net
- DNS ASK mu###wide.ru
- DNS ASK sp###kiss.ru
- DNS ASK sp###kiss.net
- DNS ASK sp###wide.net
- DNS ASK we###iss.net
- DNS ASK fr####omorrow.net
- DNS ASK of####omorrow.net
- DNS ASK of###lower.net
- DNS ASK fr###lower.net
- DNS ASK mu###kiss.net
- DNS ASK we###ower.net
- DNS ASK mu###wide.net
- DNS ASK ya###iss.net
- DNS ASK sp####omorrow.net
- DNS ASK we####morrow.net
- DNS ASK sp###lower.net
- DNS ASK we###omorrow.ru
- DNS ASK ma###tone.net
- DNS ASK jo##arms.ru
- DNS ASK jo###rms.net
- DNS ASK jo###here.net
- DNS ASK wi###here.net
- DNS ASK wi###tone.net
- DNS ASK jo###ide.net
- DNS ASK wi###rms.net
- DNS ASK jo###tone.net
- DNS ASK ha###here.ru
- DNS ASK se####berthere.net
- DNS ASK fr###side.net
- DNS ASK of###side.net
- DNS ASK se####berstone.net
- DNS ASK se####berside.net
- DNS ASK se####berarms.net
- DNS ASK se####berstone.ru
- DNS ASK wi##side.ru
- DNS ASK wr###there.net
- DNS ASK ma###here.ru
- DNS ASK de###ide.net
- DNS ASK ro###ide.net
- DNS ASK ma###rms.net
- DNS ASK wr###stone.net
- DNS ASK ma###here.net
- DNS ASK wr###arms.net
- DNS ASK de###rms.net
- DNS ASK ro###here.net
- DNS ASK wi###ide.net
- DNS ASK de###here.net
- DNS ASK de###tone.net
- DNS ASK ro###tone.net
- DNS ASK ro###rms.net
- DNS ASK de###tone.ru
- DNS ASK we##lose.ru
- DNS ASK we###ose.net
- DNS ASK we###aily.net
- DNS ASK sp###daily.net
- DNS ASK sp###full.net
- DNS ASK fr###blood.net
- DNS ASK sp###lose.net
- DNS ASK we###ull.net
- DNS ASK mu###daily.net
- DNS ASK ya###aily.net
- DNS ASK we###lood.net
- DNS ASK th###gain.net
- DNS ASK ha###ull.net
- DNS ASK hu###blood.net
- DNS ASK mu###blood.net
- DNS ASK hu###blood.ru
- DNS ASK of###blood.ru
- DNS ASK se####berdaily.ru
- DNS ASK se####berlose.net
- DNS ASK se####berblood.net
- DNS ASK se####berdaily.net
- DNS ASK jo###lood.net
- DNS ASK wi###lood.net
- DNS ASK se####berfull.net
- DNS ASK jo###lood.ru
- DNS ASK of###daily.net
- DNS ASK fr###lose.net
- DNS ASK of###blood.net
- DNS ASK fr###daily.net
- DNS ASK fr###full.net
- DNS ASK of###full.net
- DNS ASK of###lose.net
- DNS ASK fr###full.ru
- DNS ASK mu###full.ru
- DNS ASK fa###tand.net
- DNS ASK dr###again.net
- DNS ASK wa###stand.net
- DNS ASK wa###stand.ru
- DNS ASK ha###aily.net
- DNS ASK th###tand.net
- DNS ASK ha###ose.net
- DNS ASK th##pass.ru
- DNS ASK fa###ugar.net
- DNS ASK wa###sugar.net
- DNS ASK ri###nstorm.net
- DNS ASK lo####thepings.ru
- DNS ASK fa###gain.net
- DNS ASK fa###gain.ru
- DNS ASK fa###ass.net
- DNS ASK wa###pass.net
- DNS ASK sp###blood.net
- DNS ASK hu###full.net
- DNS ASK ya###lood.net
- DNS ASK mu###full.net
- DNS ASK dr###sugar.net
- DNS ASK th###ass.net
- DNS ASK dr###pass.net
- DNS ASK ya###aily.ru
- DNS ASK dr###stand.net
- DNS ASK hu###lose.net
- DNS ASK hu###daily.net
- DNS ASK ha##lose.ru
- DNS ASK ya###ose.net
- DNS ASK mu###lose.net
- DNS ASK ya###ull.net
- DNS ASK th###ugar.net
- DNS ASK ha###lood.net
- DNS ASK mu###have.net
- DNS ASK we##hold.ru
- DNS ASK mu###ocean.net
- DNS ASK ya###ave.net
- DNS ASK we###econd.net
- DNS ASK sp###second.net
- DNS ASK we###old.net
- DNS ASK sp###hold.net
- DNS ASK ya###old.net
- DNS ASK mu###hold.net
- DNS ASK hu###have.net
- DNS ASK ha###ave.net
- DNS ASK mu###second.net
- DNS ASK ya###cean.net
- DNS ASK ya###econd.net
- DNS ASK mu###second.ru
- DNS ASK we###cean.net
- DNS ASK of###ocean.net
- DNS ASK fr###have.net
- DNS ASK of###second.net
- DNS ASK fr###ocean.net
- DNS ASK se####berhold.net
- DNS ASK se####bersecond.net
- DNS ASK of###have.ru
- DNS ASK of###have.net
- DNS ASK we###ave.net
- DNS ASK sp###have.net
- DNS ASK sp###ocean.ru
- DNS ASK sp###ocean.net
- DNS ASK fr###second.ru
- DNS ASK fr###second.net
- DNS ASK fr###hold.net
- DNS ASK of###hold.net
- DNS ASK hu###have.ru
- DNS ASK de###aily.net
- DNS ASK ro###aily.net
- DNS ASK ro###lood.net
- DNS ASK de###aily.ru
- DNS ASK de###ull.net
- DNS ASK ro##full.ru
- DNS ASK de###ose.net
- DNS ASK ro###ose.net
- DNS ASK jo###ose.net
- DNS ASK wi##lose.ru
- DNS ASK jo###aily.net
- DNS ASK wi###aily.net
- DNS ASK wi###ull.net
- DNS ASK de###lood.net
- DNS ASK wi###ose.net
- DNS ASK jo###ull.net
- DNS ASK ro###ull.net
- DNS ASK ha##hold.ru
- DNS ASK ha###old.net
- DNS ASK wr###full.net
- DNS ASK hu###hold.net
- DNS ASK hu###ocean.net
- DNS ASK ha###cean.net
- DNS ASK hu###second.net
- DNS ASK ha###econd.net
- DNS ASK wr###daily.net
- DNS ASK ma###aily.net
- DNS ASK wr###blood.net
- DNS ASK ma###lood.net
- DNS ASK ma###ose.net
- DNS ASK ma###ull.net
- DNS ASK wr###lose.ru
- DNS ASK wr###lose.net
- '23#.#55.255.250':1900