Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Resource Location IKE Agent Visual Now Fax Backup' = 'C:\fhnsc5n\ppknazgi2.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Interface Storage Connections Scheduler] 'ImagePath' = 'C:\fhnsc5n\ppknazgi2.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Interface Storage Connections Scheduler] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\fhnsc5n\ujllpj7w.exe' "c:\fhnsc5n\ppknazgi2.exe"
- 'C:\fhnsc5n\ppknazgi2.exe'
- 'C:\fhnsc5n\avfkqg72jocichcgvbvi.exe'
Modifies file system:
Creates the following files:
- C:\fhnsc5n\ppknazgi2.exe
- C:\fhnsc5n\ujllpj7w.exe
- C:\fhnsc5n\a4aphnidko
- %WINDIR%\fhnsc5n\j6djl5p
- C:\fhnsc5n\j6djl5p
- C:\fhnsc5n\avfkqg72jocichcgvbvi.exe
Sets the 'hidden' attribute to the following files:
- C:\fhnsc5n\ujllpj7w.exe
- C:\fhnsc5n\ppknazgi2.exe
Deletes the following files:
- C:\fhnsc5n\avfkqg72jocichcgvbvi.exe
- %WINDIR%\fhnsc5n\j6djl5p
Substitutes the following files:
- %WINDIR%\fhnsc5n\j6djl5p
Network activity:
Connects to:
- 'co#####usunderwood.net':80
- 'ma#####neatterberry.net':80
- 'co#####usatterberry.net':80
- 'ma#####neunderwood.net':80
- 'ch#####asrichardson.net':80
- 'sh#####nepatrickson.net':80
- 'ch#####aspatrickson.net':80
- 'ra#####leunderwood.net':80
- 'co#####erunderwood.net':80
- 'ra#####leatterberry.net':80
- 'co#####uspatrickson.net':80
- 'ma#####nerichardson.net':80
- 'co#####usrichardson.net':80
- 'ma#####nepatrickson.net':80
- 'ka#####neatterberry.net':80
- 'co#####nerichardson.net':80
- 'ka#####nerichardson.net':80
- 'co#####neatterberry.net':80
- 'ro#####ltpatrickson.net':80
- 'co#####neunderwood.net':80
- 'ka#####neunderwood.net':80
- 'sh#####neatterberry.net':80
- 'ch#####asatterberry.net':80
- 'sh#####nerichardson.net':80
- 'ch#####asunderwood.net':80
- 'co#####nepatrickson.net':80
- 'ka#####nepatrickson.net':80
- 'sh#####neunderwood.net':80
- 'co#####eratterberry.net':80
- 'se#####napatrickson.net':80
- 'jo#####nepatrickson.net':80
- 'qu#####lachristians.net':80
- 'jo#####nerichardson.net':80
- 'se#####naatterberry.net':80
- 'jo#####neatterberry.net':80
- 'se#####narichardson.net':80
- 'ma#####netimberlake.net':80
- 'qu######astainthorpe.net':80
- 'ma######estainthorpe.net':80
- 'qu#####latimberlake.net':80
- 'ma#####nechristians.net':80
- 'qu######ashakesheave.net':80
- 'ma######eshakesheave.net':80
- 'se#####erunderwood.net':80
- 'tr#####anunderwood.net':80
- 'se#####eratterberry.net':80
- 'co#####erpatrickson.net':80
- 'ra#####lerichardson.net':80
- 'co#####errichardson.net':80
- 'ra#####lepatrickson.net':80
- 'tr#####anpatrickson.net':80
- 'se#####naunderwood.net':80
- 'jo#####neunderwood.net':80
- 'se#####erpatrickson.net':80
- 'tr#####anatterberry.net':80
- 'se#####errichardson.net':80
- 'tr#####anrichardson.net':80
TCP:
HTTP GET requests:
- http://co#####usunderwood.net/index.php
- http://ma#####neatterberry.net/index.php
- http://co#####usatterberry.net/index.php
- http://ma#####neunderwood.net/index.php
- http://ch#####asrichardson.net/index.php
- http://sh#####nepatrickson.net/index.php
- http://ch#####aspatrickson.net/index.php
- http://ra#####leunderwood.net/index.php
- http://co#####erunderwood.net/index.php
- http://ra#####leatterberry.net/index.php
- http://co#####uspatrickson.net/index.php
- http://ma#####nerichardson.net/index.php
- http://co#####usrichardson.net/index.php
- http://ma#####nepatrickson.net/index.php
- http://ka#####neatterberry.net/index.php
- http://co#####nerichardson.net/index.php
- http://ka#####nerichardson.net/index.php
- http://co#####neatterberry.net/index.php
- http://ro#####ltpatrickson.net/index.php
- http://co#####neunderwood.net/index.php
- http://ka#####neunderwood.net/index.php
- http://sh#####neatterberry.net/index.php
- http://ch#####asatterberry.net/index.php
- http://sh#####nerichardson.net/index.php
- http://ch#####asunderwood.net/index.php
- http://co#####nepatrickson.net/index.php
- http://ka#####nepatrickson.net/index.php
- http://sh#####neunderwood.net/index.php
- http://co#####eratterberry.net/index.php
- http://se#####napatrickson.net/index.php
- http://jo#####nepatrickson.net/index.php
- http://qu#####lachristians.net/index.php
- http://jo#####nerichardson.net/index.php
- http://se#####naatterberry.net/index.php
- http://jo#####neatterberry.net/index.php
- http://se#####narichardson.net/index.php
- http://ma#####netimberlake.net/index.php
- http://qu######astainthorpe.net/index.php
- http://ma######estainthorpe.net/index.php
- http://qu#####latimberlake.net/index.php
- http://ma#####nechristians.net/index.php
- http://qu######ashakesheave.net/index.php
- http://ma######eshakesheave.net/index.php
- http://se#####erunderwood.net/index.php
- http://tr#####anunderwood.net/index.php
- http://se#####eratterberry.net/index.php
- http://co#####erpatrickson.net/index.php
- http://ra#####lerichardson.net/index.php
- http://co#####errichardson.net/index.php
- http://ra#####lepatrickson.net/index.php
- http://tr#####anpatrickson.net/index.php
- http://se#####naunderwood.net/index.php
- http://jo#####neunderwood.net/index.php
- http://se#####erpatrickson.net/index.php
- http://tr#####anatterberry.net/index.php
- http://se#####errichardson.net/index.php
- http://tr#####anrichardson.net/index.php
UDP:
- DNS ASK co#####usunderwood.net
- DNS ASK ma#####neatterberry.net
- DNS ASK co#####usatterberry.net
- DNS ASK ma#####neunderwood.net
- DNS ASK ch#####asrichardson.net
- DNS ASK sh#####nepatrickson.net
- DNS ASK ch#####aspatrickson.net
- DNS ASK ra#####leunderwood.net
- DNS ASK co#####erunderwood.net
- DNS ASK ra#####leatterberry.net
- DNS ASK co#####uspatrickson.net
- DNS ASK ma#####nerichardson.net
- DNS ASK co#####usrichardson.net
- DNS ASK ma#####nepatrickson.net
- DNS ASK sh#####nerichardson.net
- DNS ASK co#####neatterberry.net
- DNS ASK ka#####neatterberry.net
- DNS ASK co#####nerichardson.net
- DNS ASK ka#####neunderwood.net
- DNS ASK ra#####fepatrickson.net
- DNS ASK ro#####ltpatrickson.net
- DNS ASK co#####neunderwood.net
- DNS ASK ch#####asunderwood.net
- DNS ASK sh#####neatterberry.net
- DNS ASK ch#####asatterberry.net
- DNS ASK sh#####neunderwood.net
- DNS ASK ka#####nerichardson.net
- DNS ASK co#####nepatrickson.net
- DNS ASK ka#####nepatrickson.net
- DNS ASK se#####napatrickson.net
- DNS ASK jo#####nepatrickson.net
- DNS ASK qu#####lachristians.net
- DNS ASK jo#####nerichardson.net
- DNS ASK se#####naatterberry.net
- DNS ASK jo#####neatterberry.net
- DNS ASK se#####narichardson.net
- DNS ASK ma#####netimberlake.net
- DNS ASK qu######astainthorpe.net
- DNS ASK ma######estainthorpe.net
- DNS ASK qu#####latimberlake.net
- DNS ASK ma#####nechristians.net
- DNS ASK qu######ashakesheave.net
- DNS ASK ma######eshakesheave.net
- DNS ASK jo#####neunderwood.net
- DNS ASK co#####erpatrickson.net
- DNS ASK se#####erunderwood.net
- DNS ASK tr#####anunderwood.net
- DNS ASK ra#####lepatrickson.net
- DNS ASK co#####eratterberry.net
- DNS ASK ra#####lerichardson.net
- DNS ASK co#####errichardson.net
- DNS ASK se#####erpatrickson.net
- DNS ASK tr#####anpatrickson.net
- DNS ASK se#####naunderwood.net
- DNS ASK tr#####anrichardson.net
- DNS ASK se#####eratterberry.net
- DNS ASK tr#####anatterberry.net
- DNS ASK se#####errichardson.net