Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PC Protocol Block Isolation Networking' = '<SYSTEM32>\qzjpzwd.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Encryption Identity Health Browser] 'ImagePath' = '<SYSTEM32>\qzjpzwd.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Encryption Identity Health Browser] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Modifies file system:
Creates the following files:
- <SYSTEM32>\bpxjoudigmdj\run
- <SYSTEM32>\bpxjoudigmdj\rng
- %WINDIR%\Temp\hgfxjqeaycs18coa.exe
- <SYSTEM32>\bpxjoudigmdj\cfg
- %TEMP%\hgfxjqejanuzkcoaorcgur.exe
- <SYSTEM32>\bpxjoudigmdj\tst
- <SYSTEM32>\crvvxniqtgn.exe
- <SYSTEM32>\qzjpzwd.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\crvvxniqtgn.exe
- <SYSTEM32>\qzjpzwd.exe
Deletes the following files:
- %WINDIR%\Temp\hgfxjqeaycs18coa.exe
- %TEMP%\hgfxjqejanuzkcoaorcgur.exe
Network activity:
Connects to:
- 'de####turday.net':80
- 'jo##loud.ru':80
- 'jo###oud.net':80
- 'ro###aturday.ru':80
- 'ro####turday.net':80
- 'wi####ousand.net':80
- 'wi###oud.net':80
- 'ri###nstorm.net':80
- '18#.#06.120.168':80
- '18#.#17.73.77':80
- 'jo###ree.net':80
- 'wi###ree.net':80
- 'lo####thepings.ru':80
TCP:
HTTP GET requests:
- http://de####turday.net/index.php
- http://jo##loud.ru/index.php
- http://jo###oud.net/index.php
- http://ro###aturday.ru/index.php
- http://ro####turday.net/index.php
- http://wi####ousand.net/index.php
- http://wi###oud.net/index.php
- http://ri###nstorm.net/index.php
- http://18#.#06.120.168/index.php
- http://18#.#17.73.77/index.php
- http://jo###ree.net/index.php
- http://wi###ree.net/index.php
- http://lo####thepings.ru/index.php
UDP:
- DNS ASK tr###full.ru
- DNS ASK tr###full.net
- DNS ASK tr###lose.net
- DNS ASK mi###ull.net
- DNS ASK wi###aily.net
- DNS ASK du###aily.net
- DNS ASK wi###lood.net
- DNS ASK du###lood.net
- DNS ASK mi###ose.net
- DNS ASK ma###ire.net
- DNS ASK mi###lood.net
- DNS ASK ma###one.net
- DNS ASK wr###fire.net
- DNS ASK mi###aily.net
- DNS ASK tr###daily.net
- DNS ASK tr###blood.net
- DNS ASK mi###aily.ru
- DNS ASK si###lose.net
- DNS ASK th###full.ru
- DNS ASK si###daily.net
- DNS ASK th###lose.net
- DNS ASK ca###lood.net
- DNS ASK he###lood.net
- DNS ASK th###full.net
- DNS ASK si###full.net
- DNS ASK th###daily.net
- DNS ASK du###ose.net
- DNS ASK wi###ull.net
- DNS ASK wi##lose.ru
- DNS ASK wi###ose.net
- DNS ASK si###blood.ru
- DNS ASK si###blood.net
- DNS ASK th###blood.net
- DNS ASK du###ull.net
- DNS ASK jo###rote.net
- DNS ASK wi###rote.net
- DNS ASK wi##cold.ru
- DNS ASK wi###old.net
- DNS ASK wi###one.net
- DNS ASK wi###ire.net
- DNS ASK jo###one.net
- DNS ASK jo##fire.ru
- DNS ASK jo###old.net
- DNS ASK of###fire.net
- DNS ASK se####bercold.net
- DNS ASK fr###fire.net
- DNS ASK of###fire.ru
- DNS ASK se####berbone.net
- DNS ASK se####berfire.net
- DNS ASK se####berwrote.net
- DNS ASK ha##bone.ru
- DNS ASK wr###cold.net
- DNS ASK ma###old.net
- DNS ASK ro###ire.net
- DNS ASK wr###cold.ru
- DNS ASK wr###bone.net
- DNS ASK ma##bone.ru
- DNS ASK wr###wrote.net
- DNS ASK ma###rote.net
- DNS ASK de###ire.net
- DNS ASK ro###old.net
- DNS ASK de###rote.net
- DNS ASK jo###ire.net
- DNS ASK de###old.net
- DNS ASK de###one.net
- DNS ASK ro###one.net
- DNS ASK ro###rote.ru
- DNS ASK ro###rote.net
- DNS ASK ca###aily.net
- DNS ASK mi###old.net
- DNS ASK tr###hold.net
- DNS ASK cl###full.net
- DNS ASK da###ull.net
- DNS ASK tr###second.net
- DNS ASK mi###cean.net
- DNS ASK mi###econd.net
- DNS ASK tr###second.ru
- DNS ASK cl###full.ru
- DNS ASK da###lood.ru
- DNS ASK da###lood.net
- DNS ASK si###ull.net
- DNS ASK cl###blood.net
- DNS ASK cl###lose.net
- DNS ASK da###ose.net
- DNS ASK cl###daily.net
- DNS ASK da###aily.net
- DNS ASK si###hold.net
- DNS ASK si###second.net
- DNS ASK du###cean.ru
- DNS ASK wi###ave.net
- DNS ASK du###ave.net
- DNS ASK th###second.net
- DNS ASK th###second.ru
- DNS ASK th###hold.net
- DNS ASK du###cean.net
- DNS ASK tr###have.net
- DNS ASK wi##hold.ru
- DNS ASK tr###ocean.net
- DNS ASK mi###ave.net
- DNS ASK du###econd.net
- DNS ASK wi###cean.net
- DNS ASK du###old.net
- DNS ASK wi###econd.net
- DNS ASK qu###lose.net
- DNS ASK th##lose.ru
- DNS ASK qu###daily.net
- DNS ASK th###aily.net
- DNS ASK th###ull.net
- DNS ASK su###yblood.net
- DNS ASK th###ose.net
- DNS ASK qu###full.net
- DNS ASK th###lood.net
- DNS ASK ca###ose.net
- DNS ASK he###ose.net
- DNS ASK he###aily.ru
- DNS ASK he###aily.net
- DNS ASK qu###blood.ru
- DNS ASK qu###blood.net
- DNS ASK ca###ull.net
- DNS ASK he###ull.net
- DNS ASK si###lood.net
- DNS ASK si###aily.net
- DNS ASK me###aily.net
- DNS ASK me###lood.net
- DNS ASK si###ose.net
- DNS ASK me###ull.net
- DNS ASK me##lose.ru
- DNS ASK me###ose.net
- DNS ASK mo###ull.net
- DNS ASK su###ydaily.net
- DNS ASK mo###aily.net
- DNS ASK mo###lood.net
- DNS ASK su###ydaily.ru
- DNS ASK su###yfull.net
- DNS ASK mo##full.ru
- DNS ASK su###ylose.net
- DNS ASK mo###ose.net
- DNS ASK mu###whole.ru
- DNS ASK mu###whole.net
- DNS ASK mu###reply.net
- DNS ASK ya###hole.net
- DNS ASK we###hrow.net
- DNS ASK sp###throw.net
- DNS ASK we###tock.net
- DNS ASK sp###stock.net
- DNS ASK ya###eply.net
- DNS ASK ha###eply.ru
- DNS ASK ha###eply.net
- DNS ASK hu###stock.net
- DNS ASK ma####ousand.net
- DNS ASK ha###hrow.net
- DNS ASK mu###throw.net
- DNS ASK ma###ree.net
- DNS ASK mu###stock.net
- DNS ASK fr###whole.ru
- DNS ASK of###reply.net
- DNS ASK of###throw.net
- DNS ASK fr###reply.net
- DNS ASK se####berstock.net
- DNS ASK se####berthrow.ru
- DNS ASK fr###whole.net
- DNS ASK of###whole.net
- DNS ASK fr###throw.net
- DNS ASK we###hole.net
- DNS ASK sp###reply.net
- DNS ASK we###eply.ru
- DNS ASK we###eply.net
- DNS ASK of###stock.ru
- DNS ASK of###stock.net
- DNS ASK sp###whole.net
- DNS ASK fr###stock.net
- DNS ASK de####ousand.net
- DNS ASK ma###housand.ru
- DNS ASK ro####turday.net
- DNS ASK ro###aturday.ru
- DNS ASK de###oud.net
- DNS ASK de###ree.net
- DNS ASK wr###tree.net
- DNS ASK ro####ousand.net
- DNS ASK wi####ousand.net
- DNS ASK wi###ree.net
- DNS ASK jo###ree.net
- DNS ASK ri###nstorm.net
- DNS ASK lo####thepings.ru
- DNS ASK jo##loud.ru
- DNS ASK de####turday.net
- DNS ASK wi###oud.net
- DNS ASK jo###oud.net
- DNS ASK ya###hrow.net
- DNS ASK wr####aturday.net
- DNS ASK wr###loud.net
- DNS ASK de##tree.ru
- DNS ASK hu###throw.net
- DNS ASK ha###tock.net
- DNS ASK ro###ree.net
- DNS ASK hu###stock.ru
- DNS ASK ya###hrow.ru
- DNS ASK ro###oud.net
- DNS ASK wr####housand.net
- DNS ASK ya###tock.net
- DNS ASK ha###hole.net
- DNS ASK hu###reply.net
- DNS ASK hu###whole.net
- DNS ASK ma####turday.net
- DNS ASK ma###oud.net
- DNS ASK mu###wrote.ru
- DNS ASK mu###wrote.net
- DNS ASK mu###cold.net
- DNS ASK ya###rote.net
- DNS ASK mu###bone.net
- DNS ASK mu###fire.net
- DNS ASK ya###one.net
- DNS ASK ya###ire.net
- DNS ASK ya###old.net
- DNS ASK hu###wrote.net
- DNS ASK hu###bone.net
- DNS ASK ha###old.net
- DNS ASK ha###rote.net
- DNS ASK hu###fire.net
- DNS ASK ha###ire.net
- DNS ASK ha###one.net
- DNS ASK hu###fire.ru
- DNS ASK of###cold.net
- DNS ASK fr###wrote.ru
- DNS ASK sp###fire.net
- DNS ASK fr###cold.net
- DNS ASK fr###bone.net
- DNS ASK of###bone.net
- DNS ASK fr###wrote.net
- DNS ASK of###wrote.net
- DNS ASK we###ire.net
- DNS ASK sp###cold.net
- DNS ASK we###rote.net
- DNS ASK we##cold.ru
- DNS ASK we###old.net
- DNS ASK sp###bone.ru
- DNS ASK sp###bone.net
- DNS ASK sp###wrote.net
- DNS ASK we###one.net
- DNS ASK jo###hole.net
- DNS ASK wi###hole.net
- DNS ASK jo###eply.net
- DNS ASK wi###eply.net
- DNS ASK de###hrow.ru
- DNS ASK de###hrow.net
- DNS ASK de###tock.net
- DNS ASK ro###tock.net
- DNS ASK wi###eply.ru
- DNS ASK se####berwhole.net
- DNS ASK jo###tock.ru
- DNS ASK se####berthrow.net
- DNS ASK se####berreply.net
- DNS ASK jo###hrow.net
- DNS ASK wi###hrow.net
- DNS ASK jo###tock.net
- DNS ASK wi###tock.net
- DNS ASK wr###reply.net
- DNS ASK ma###eply.net
- DNS ASK ma###hrow.net
- DNS ASK wr###reply.ru
- DNS ASK hu###cold.net
- DNS ASK ha##cold.ru
- DNS ASK wr###whole.net
- DNS ASK ma###hole.net
- DNS ASK wr###throw.net
- DNS ASK ro###eply.net
- DNS ASK de###hole.net
- DNS ASK ro###hrow.net
- DNS ASK de###eply.net
- DNS ASK wr###stock.net
- DNS ASK ma###tock.net
- DNS ASK ro###hole.ru
- DNS ASK ro###hole.net
- '23#.#55.255.250':1900
Miscellaneous:
Creates and executes the following:
- '<SYSTEM32>\crvvxniqtgn.exe' "<SYSTEM32>\qzjpzwd.exe"
- '%WINDIR%\Temp\hgfxjqeaycs18coa.exe' -r 47066 tcp
- '%TEMP%\hgfxjqejanuzkcoaorcgur.exe'
- '<SYSTEM32>\qzjpzwd.exe'