Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Config Upgrade Registrar Reporting Tools' = '<SYSTEM32>\ejuygctaxeq.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Tunneling Experience Workstation Distributed] 'ImagePath' = '<SYSTEM32>\ejuygctaxeq.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Tunneling Experience Workstation Distributed] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\btpngqb.exe' "<SYSTEM32>\ejuygctaxeq.exe"
- '%WINDIR%\Temp\mkdytisg315az4c2bk.exe' -r 34523 tcp
- '%TEMP%\mkdytisgau3aw6c2bknnuxvlw.exe'
- '<SYSTEM32>\ejuygctaxeq.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\fmgeuednkaqlufy\run
- <SYSTEM32>\fmgeuednkaqlufy\rng
- %WINDIR%\Temp\mkdytisg315az4c2bk.exe
- <SYSTEM32>\fmgeuednkaqlufy\cfg
- %TEMP%\mkdytisgau3aw6c2bknnuxvlw.exe
- <SYSTEM32>\fmgeuednkaqlufy\tst
- <SYSTEM32>\btpngqb.exe
- <SYSTEM32>\ejuygctaxeq.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\btpngqb.exe
- <SYSTEM32>\ejuygctaxeq.exe
Deletes the following files:
- %WINDIR%\Temp\mkdytisg315az4c2bk.exe
- %TEMP%\mkdytisgau3aw6c2bknnuxvlw.exe
Network activity:
Connects to:
- 'ha###onday.net':80
- 'of###lend.ru':80
- 'fr###lend.net':80
- 'se####bermonday.net':80
- 'se####berfeed.net':80
- 'ha###eed.net':80
- 'ha##feed.ru':80
- 'ri###nstorm.net':80
- '18#.#06.120.168':80
- '18#.#17.73.77':80
- 'lo####thepings.ru':80
- 'ha###nder.net':80
- 'of###lend.net':80
- 'se####berunder.net':80
TCP:
HTTP GET requests:
- http://ha###onday.net/index.php
- http://of###lend.ru/index.php
- http://fr###lend.net/index.php
- http://se####bermonday.net/index.php
- http://se####berfeed.net/index.php
- http://ha###eed.net/index.php
- http://ha##feed.ru/index.php
- http://ri###nstorm.net/index.php
- http://18#.#06.120.168/index.php
- http://18#.#17.73.77/index.php
- http://lo####thepings.ru/index.php
- http://ha###nder.net/index.php
- http://of###lend.net/index.php
- http://se####berunder.net/index.php
UDP:
- DNS ASK eq###talk.net
- DNS ASK gr###below.net
- DNS ASK eq###below.net
- DNS ASK gr###talk.net
- DNS ASK gr###shirt.net
- DNS ASK eq###shirt.net
- DNS ASK eq###shirt.ru
- DNS ASK gr###wash.net
- DNS ASK ta###talk.net
- DNS ASK gl###alk.net
- DNS ASK gl##talk.ru
- DNS ASK ta###shirt.net
- DNS ASK gr###wash.ru
- DNS ASK eq###wash.net
- DNS ASK gl###hirt.net
- DNS ASK fa###ash.net
- DNS ASK wa###wash.ru
- DNS ASK vi###shirt.net
- DNS ASK wa###wash.net
- DNS ASK wa###talk.net
- DNS ASK fa###elow.net
- DNS ASK wa###below.net
- DNS ASK sp###shirt.net
- DNS ASK sp###below.net
- DNS ASK vi###wash.net
- DNS ASK sp###wash.net
- DNS ASK vi###below.ru
- DNS ASK vi###talk.net
- DNS ASK sp###talk.net
- DNS ASK vi###below.net
- DNS ASK wh###below.net
- DNS ASK up###elow.net
- DNS ASK wh###wash.net
- DNS ASK up###alk.net
- DNS ASK up###hirt.net
- DNS ASK wh###talk.net
- DNS ASK wh###talk.ru
- DNS ASK up###ash.net
- DNS ASK ar###talk.net
- DNS ASK so###below.net
- DNS ASK so###below.ru
- DNS ASK so###talk.net
- DNS ASK up##wash.ru
- DNS ASK so###shirt.net
- DNS ASK ar###shirt.net
- DNS ASK sa###hirt.net
- DNS ASK sa###hirt.ru
- DNS ASK sp###hirt.net
- DNS ASK gl###ash.net
- DNS ASK ta###below.net
- DNS ASK gl###elow.net
- DNS ASK ta###wash.net
- DNS ASK sa###alk.net
- DNS ASK sa###ash.net
- DNS ASK wh###shirt.net
- DNS ASK sp###ash.net
- DNS ASK sa###elow.net
- DNS ASK sp###alk.net
- DNS ASK sp###elow.net
- DNS ASK sp###elow.ru
- DNS ASK sa###hot.net
- DNS ASK sp###ack.net
- DNS ASK sp###hot.net
- DNS ASK sa###ack.net
- DNS ASK ta###sure.net
- DNS ASK gl###ure.net
- DNS ASK gl##sure.ru
- DNS ASK sa###ause.net
- DNS ASK wh###back.net
- DNS ASK up###ack.net
- DNS ASK up##back.ru
- DNS ASK sp###ure.net
- DNS ASK sp###ause.net
- DNS ASK sa###ause.ru
- DNS ASK sa###ure.net
- DNS ASK eq###cause.net
- DNS ASK eq###cause.ru
- DNS ASK gr###sure.net
- DNS ASK gr###cause.net
- DNS ASK eq###back.net
- DNS ASK gr###shot.net
- DNS ASK eq###shot.net
- DNS ASK eq###sure.net
- DNS ASK gl###hot.net
- DNS ASK ta###cause.net
- DNS ASK gl###ause.net
- DNS ASK ta###shot.ru
- DNS ASK ta###back.net
- DNS ASK gl###ack.net
- DNS ASK ta###shot.net
- DNS ASK th###alk.net
- DNS ASK dr###talk.net
- DNS ASK th###elow.net
- DNS ASK dr###shirt.net
- DNS ASK ar###sure.net
- DNS ASK th###hirt.net
- DNS ASK th###hirt.ru
- DNS ASK dr###below.net
- DNS ASK wa###shirt.net
- DNS ASK fa###alk.net
- DNS ASK fa##talk.ru
- DNS ASK fa###hirt.net
- DNS ASK dr###below.ru
- DNS ASK th###ash.net
- DNS ASK dr###wash.net
- DNS ASK wh###sure.net
- DNS ASK wh###sure.ru
- DNS ASK up###ure.net
- DNS ASK up###ause.net
- DNS ASK wh###shot.net
- DNS ASK up###hot.net
- DNS ASK wh###cause.net
- DNS ASK so###back.net
- DNS ASK so###cause.net
- DNS ASK ar###cause.net
- DNS ASK so###sure.net
- DNS ASK ar###shot.ru
- DNS ASK ar###back.net
- DNS ASK so###shot.net
- DNS ASK ar###shot.net
- DNS ASK wr###under.net
- DNS ASK wr###monday.net
- DNS ASK wr###under.ru
- DNS ASK wi###end.net
- DNS ASK hu###world.net
- DNS ASK ma###end.net
- DNS ASK ro###onday.net
- DNS ASK de###eed.net
- DNS ASK de###end.net
- DNS ASK ro###onday.ru
- DNS ASK ro###end.net
- DNS ASK ma###eed.net
- DNS ASK de###nder.net
- DNS ASK wr###lend.net
- DNS ASK ha###orld.net
- DNS ASK ya###orld.net
- DNS ASK mu###world.net
- DNS ASK ha###orse.net
- DNS ASK ya###njoy.net
- DNS ASK ya###ctover.net
- DNS ASK ya###ctover.ru
- DNS ASK mu###enjoy.net
- DNS ASK ha###njoy.net
- DNS ASK hu###enjoy.net
- DNS ASK hu###enjoy.ru
- DNS ASK hu####ctover.net
- DNS ASK ha###orse.ru
- DNS ASK hu###horse.net
- DNS ASK ha###ctover.net
- DNS ASK ma###nder.net
- DNS ASK ha##feed.ru
- DNS ASK se####bermonday.net
- DNS ASK ha###onday.net
- DNS ASK ha###eed.net
- DNS ASK jo###eed.net
- DNS ASK ro###nder.net
- DNS ASK se####berfeed.net
- DNS ASK se####berunder.net
- DNS ASK lo####thepings.ru
- DNS ASK ri###nstorm.net
- DNS ASK of###lend.net
- DNS ASK of###lend.ru
- DNS ASK fr###lend.net
- DNS ASK ha###nder.net
- DNS ASK jo###onday.net
- DNS ASK ro###eed.net
- DNS ASK ha###end.net
- DNS ASK wr###feed.net
- DNS ASK jo###nder.net
- DNS ASK jo###end.net
- DNS ASK wi###onday.net
- DNS ASK ma##feed.ru
- DNS ASK jo##lend.ru
- DNS ASK wi###nder.ru
- DNS ASK ma###onday.net
- DNS ASK se####berlend.net
- DNS ASK wi###eed.net
- DNS ASK wi###nder.net
- DNS ASK de###onday.net
- DNS ASK ya###orse.net
- DNS ASK de###njoy.net
- DNS ASK de###orld.net
- DNS ASK ro###orld.net
- DNS ASK ro###njoy.net
- DNS ASK ro###ctover.net
- DNS ASK de###ctover.net
- DNS ASK de###ctover.ru
- DNS ASK jo###ctover.net
- DNS ASK wi###njoy.net
- DNS ASK jo###njoy.net
- DNS ASK wi###ctover.net
- DNS ASK wi###orse.net
- DNS ASK wi###orse.ru
- DNS ASK jo###orse.net
- DNS ASK de###orse.net
- DNS ASK wr###horse.net
- DNS ASK ma###ctover.net
- DNS ASK wr###horse.ru
- DNS ASK ma###orse.net
- DNS ASK ar###below.net
- DNS ASK so###wash.net
- DNS ASK ar###wash.net
- DNS ASK ma###orld.ru
- DNS ASK wr###world.net
- DNS ASK ro###orse.net
- DNS ASK ma###orld.net
- DNS ASK wr####ctover.net
- DNS ASK ma###njoy.net
- DNS ASK wr###enjoy.net
- DNS ASK jo###njoy.ru
- DNS ASK we###orse.ru
- DNS ASK we###ctover.net
- DNS ASK sp####ctover.net
- DNS ASK we###orse.net
- DNS ASK of###world.net
- DNS ASK fr###world.net
- DNS ASK sp###horse.net
- DNS ASK we###orld.net
- DNS ASK mu###horse.net
- DNS ASK mu####ctover.net
- DNS ASK sp###world.net
- DNS ASK we###njoy.net
- DNS ASK sp###enjoy.net
- DNS ASK sp###world.ru
- DNS ASK fr###enjoy.net
- DNS ASK se####beroctover.ru
- DNS ASK se####berenjoy.net
- DNS ASK se####berworld.net
- DNS ASK se#####eroctover.net
- DNS ASK wi###orld.net
- DNS ASK jo###orld.net
- DNS ASK se####berhorse.net
- DNS ASK of###enjoy.net
- DNS ASK fr####ctover.net
- DNS ASK of###enjoy.ru
- DNS ASK of####ctover.net
- DNS ASK ha###orld.ru
- DNS ASK of###horse.net
- DNS ASK fr###horse.net
- '23#.#55.255.250':1900