Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Remote Thread Function Network' = '<SYSTEM32>\ehvhuxaigyg.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\NGEN Configuration Assistant Task] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\NGEN Configuration Assistant Task] 'ImagePath' = '<SYSTEM32>\ehvhuxaigyg.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Modifies file system:
Creates the following files:
- <SYSTEM32>\aziwngsvgd\tst
- %TEMP%\ycy5ogbm60rc1rdeknrxlct.exe
- <SYSTEM32>\ehvhuxaigyg.exe
- <SYSTEM32>\vizlqzivsecp.exe
- <SYSTEM32>\aziwngsvgd\rng
- <SYSTEM32>\aziwngsvgd\run
- <SYSTEM32>\aziwngsvgd\cfg
- %WINDIR%\Temp\ycy5ogbmf82ddfdek.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\ehvhuxaigyg.exe
- <SYSTEM32>\vizlqzivsecp.exe
Deletes the following files:
- %TEMP%\ycy5ogbm60rc1rdeknrxlct.exe
- %WINDIR%\Temp\ycy5ogbmf82ddfdek.exe
Network activity:
Connects to:
- '18#.#17.73.77':80
- '18#.#06.120.168':80
- 'ri###nstorm.net':80
- 'lo####thepings.ru':80
- 'fi###since.ru':80
- 'fi###since.net':80
- 'qu###since.net':80
- 'fi###page.net':80
- 'qu###page.net':80
- 'bo###appy.net':80
- 'ga###appy.ru':80
- 'bo###eat.net':80
- 'ga###appy.net':80
- 'ga###eat.net':80
TCP:
HTTP GET requests:
- http://18#.#17.73.77/index.php
- http://18#.#06.120.168/index.php
- http://ri###nstorm.net/index.php
- http://lo####thepings.ru/index.php
- http://fi###since.ru/index.php
- http://fi###since.net/index.php
- http://qu###since.net/index.php
- http://fi###page.net/index.php
- http://qu###page.net/index.php
- http://bo###appy.net/index.php
- http://ga###appy.ru/index.php
- http://bo###eat.net/index.php
- http://ga###appy.net/index.php
- http://ga###eat.net/index.php
UDP:
- DNS ASK fa###hey.net
- DNS ASK se##five.ru
- DNS ASK we####dayvoice.net
- DNS ASK se###oice.net
- DNS ASK se###ive.net
- DNS ASK we####dayfive.net
- DNS ASK se###ight.net
- DNS ASK we####dayeight.net
- DNS ASK we####daythey.ru
- DNS ASK se###hey.net
- DNS ASK qu###aunt.net
- DNS ASK fo###they.net
- DNS ASK af###they.net
- DNS ASK dr###five.net
- DNS ASK na###ive.net
- DNS ASK dr###eight.ru
- DNS ASK dr###eight.net
- DNS ASK na###ight.net
- DNS ASK dr###they.net
- DNS ASK fi###aunt.net
- DNS ASK na###hey.net
- DNS ASK qu###aunt.ru
- DNS ASK we####daythey.net
- DNS ASK na###oice.net
- DNS ASK wa###oice.ru
- DNS ASK dr###voice.net
- DNS ASK we##five.ru
- DNS ASK mo###five.net
- DNS ASK wa###ive.net
- DNS ASK wa###ight.net
- DNS ASK mo###eight.net
- DNS ASK mo###they.net
- DNS ASK mo###they.ru
- DNS ASK wa###hey.net
- DNS ASK st###voice.net
- DNS ASK we###oice.net
- DNS ASK af###eight.net
- DNS ASK fo###eight.net
- DNS ASK fo###eight.ru
- DNS ASK st###eight.net
- DNS ASK we###ight.net
- DNS ASK st###they.net
- DNS ASK we###hey.net
- DNS ASK af###voice.ru
- DNS ASK af###voice.net
- DNS ASK fo###voice.net
- DNS ASK af###five.net
- DNS ASK fo###five.net
- DNS ASK st###five.net
- DNS ASK we###ive.net
- DNS ASK wa###oice.net
- DNS ASK fi###scene.net
- DNS ASK fi###dont.ru
- DNS ASK wa###cene.net
- DNS ASK mo###great.net
- DNS ASK mo###dont.net
- DNS ASK wa###reat.net
- DNS ASK wa##dont.ru
- DNS ASK wa###ont.net
- DNS ASK st###aunt.net
- DNS ASK st###scene.net
- DNS ASK we###unt.net
- DNS ASK mo###scene.ru
- DNS ASK mo###scene.net
- DNS ASK we###cene.net
- DNS ASK st###dont.net
- DNS ASK we###ont.net
- DNS ASK we###reat.net
- DNS ASK af###aunt.net
- DNS ASK fo###aunt.ru
- DNS ASK fo###aunt.net
- DNS ASK af###scene.net
- DNS ASK fo###scene.net
- DNS ASK af###great.net
- DNS ASK st###great.ru
- DNS ASK st###great.net
- DNS ASK qu###scene.net
- DNS ASK fi###great.net
- DNS ASK le###dont.net
- DNS ASK fi###dont.net
- DNS ASK qu###dont.net
- DNS ASK bo###unt.net
- DNS ASK ga###unt.net
- DNS ASK bo###cene.net
- DNS ASK ga###cene.ru
- DNS ASK ga###cene.net
- DNS ASK bo###reat.net
- DNS ASK mo###aunt.net
- DNS ASK qu###great.net
- DNS ASK wa###unt.net
- DNS ASK ga###reat.net
- DNS ASK le###aunt.net
- DNS ASK fa###unt.net
- DNS ASK le###scene.net
- DNS ASK fa###cene.net
- DNS ASK le###great.net
- DNS ASK fa###reat.ru
- DNS ASK fa###reat.net
- DNS ASK fa###ont.net
- DNS ASK bo###ont.net
- DNS ASK ga###ont.net
- DNS ASK le###aunt.ru
- DNS ASK mo###voice.net
- DNS ASK af###dont.ru
- DNS ASK le###they.net
- DNS ASK le###page.net
- DNS ASK st###happy.net
- DNS ASK mo###heat.net
- DNS ASK bo###ince.net
- DNS ASK bo###age.net
- DNS ASK fa###eat.net
- DNS ASK wa###ince.net
- DNS ASK we###appy.net
- DNS ASK mo###happy.net
- DNS ASK wa###age.net
- DNS ASK af###heat.net
- DNS ASK wa###ince.ru
- DNS ASK st###heat.ru
- DNS ASK mo###page.net
- DNS ASK st###since.net
- DNS ASK we###ince.net
- DNS ASK st###page.net
- DNS ASK we##page.ru
- DNS ASK we###age.net
- DNS ASK af###happy.net
- DNS ASK fo###happy.net
- DNS ASK mo###happy.ru
- DNS ASK we###eat.net
- DNS ASK fa###age.net
- DNS ASK bo##page.ru
- DNS ASK wa###appy.net
- DNS ASK lo####thepings.ru
- DNS ASK fi###since.ru
- DNS ASK fi###since.net
- DNS ASK qu###since.net
- DNS ASK fi###page.net
- DNS ASK qu###page.net
- DNS ASK bo###appy.net
- DNS ASK ga###appy.ru
- DNS ASK ga###appy.net
- DNS ASK le###heat.net
- DNS ASK fo###heat.net
- DNS ASK ri###nstorm.net
- DNS ASK st###heat.net
- DNS ASK fa###ince.net
- DNS ASK fa##heat.ru
- DNS ASK le###happy.net
- DNS ASK ga###age.net
- DNS ASK fa###appy.net
- DNS ASK wa###eat.net
- DNS ASK mo###since.net
- DNS ASK ga###ince.net
- DNS ASK ga###eat.net
- DNS ASK bo###eat.net
- DNS ASK le###since.net
- DNS ASK af###since.ru
- DNS ASK fi###eight.net
- DNS ASK qu###eight.net
- DNS ASK fi###they.net
- DNS ASK qu###they.net
- DNS ASK bo###oice.net
- DNS ASK ga###oice.net
- DNS ASK bo##five.ru
- DNS ASK bo###ive.net
- DNS ASK ga###ive.net
- DNS ASK qu###five.net
- DNS ASK fi###voice.net
- DNS ASK qu###eight.ru
- DNS ASK bo###ight.net
- DNS ASK ga###hey.net
- DNS ASK le###voice.net
- DNS ASK fa###oice.net
- DNS ASK le###five.net
- DNS ASK fa###ive.net
- DNS ASK le###eight.ru
- DNS ASK le###eight.net
- DNS ASK fa###ight.net
- DNS ASK ga###ight.net
- DNS ASK bo###hey.net
- DNS ASK ga##they.ru
- DNS ASK fi###five.net
- DNS ASK qu###voice.net
- DNS ASK af###since.net
- DNS ASK fo###since.net
- DNS ASK se###appy.net
- DNS ASK we####dayhappy.net
- DNS ASK af###page.net
- DNS ASK fo###page.net
- DNS ASK se###eat.net
- DNS ASK we####dayheat.net
- DNS ASK se###ince.net
- DNS ASK se###age.net
- DNS ASK we####daysince.net
- DNS ASK we####dayhappy.ru
- DNS ASK se##page.ru
- DNS ASK dr###happy.net
- DNS ASK na###appy.net
- DNS ASK dr###heat.net
- DNS ASK na###eat.net
- DNS ASK na##heat.ru
- DNS ASK dr###since.net
- DNS ASK na###ince.net
- DNS ASK dr###page.net
- DNS ASK na###age.net
- DNS ASK fi###voice.ru
- DNS ASK we####daypage.net
- DNS ASK fo###great.net
- '23#.#55.255.250':1900
Miscellaneous:
Creates and executes the following:
- '%TEMP%\ycy5ogbm60rc1rdeknrxlct.exe'
- '<SYSTEM32>\ehvhuxaigyg.exe'
- '<SYSTEM32>\vizlqzivsecp.exe' "<SYSTEM32>\ehvhuxaigyg.exe"
- '%WINDIR%\Temp\ycy5ogbmf82ddfdek.exe' -r 34953 tcp