Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Auto-Discovery Driver Source Socket Application' = 'C:\zwn0nlgluv\yfkwhee.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\IPsec Logon Helper Compatibility Link Modules] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\IPsec Logon Helper Compatibility Link Modules] 'ImagePath' = 'C:\zwn0nlgluv\yfkwhee.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\zwn0nlgluv\pdeq4rxysylh
- C:\zwn0nlgluv\pdeq4rxysylh
- C:\zwn0nlgluv\j0hhg5us2rmtrsoztogrgbpb.exe
- C:\zwn0nlgluv\yfkwhee.exe
- C:\zwn0nlgluv\muieokzsefhx.exe
- C:\zwn0nlgluv\xplrqy3bl4tk
Sets the 'hidden' attribute to the following files:
- C:\zwn0nlgluv\yfkwhee.exe
- C:\zwn0nlgluv\muieokzsefhx.exe
Deletes the following files:
- %WINDIR%\zwn0nlgluv\pdeq4rxysylh
- C:\zwn0nlgluv\j0hhg5us2rmtrsoztogrgbpb.exe
Substitutes the following files:
- %WINDIR%\zwn0nlgluv\pdeq4rxysylh
Network activity:
Connects to:
- 'so####ryducks.com':80
- 'gr###factory.cn':80
- 'pr####anabolikov.ru':80
- 'ye####gdongwu.cn':80
- 'ga####liongrass.net':80
- 'ch####isportsmen.ru':80
- 'ma#####necherokee.net':80
- 'gr#####lecherokee.net':80
- 'ma#####nesullivan.net':80
- 'ca#####neharoldson.net':80
- 'gr#####learabella.net':80
- 'gr#####lesullivan.ru':80
- 'gr#####lesullivan.net':80
- 'si#####temargaret.net':80
- 'st#####iamargaret.net':80
- 'ma#####necherokee.ru':80
- 'me#####herharoldson.net':80
- 'ha####nhalflion.net':80
- 'ma#####nearabella.net':80
- 'ag#####anabolics.com':80
- 'ca#####eeitinthecup.org':80
- 'pi##asia.cn':80
- 'sp##tnav.ru':80
- 'un###lgrain.org':80
- 'ka#######ayajivayapriroda.ru':80
- 'na##top.ru':80
- 'ga#####yundongyuan.cn':80
- 'to###tosales.ru':80
- 'gu##155.cn':80
- 'sc####ainbow.net':80
- 'si###ypeas.net':80
- 'cl#####ortswomen.com':80
- 'cl####portsmen.com':80
- 'do##bate.cn':80
- 'bu####rmansion.com':80
- 'pr##card.ru':80
- 'ta#####pielenreiten.org':80
- 'sc#####epuzzlechess.org':80
- 'st#####iacherokee.net':80
TCP:
HTTP GET requests:
- http://so####ryducks.com/index.php
- http://gr###factory.cn/index.php
- http://pr####anabolikov.ru/index.php
- http://ye####gdongwu.cn/index.php
- http://ga####liongrass.net/index.php
- http://ch####isportsmen.ru/index.php
- http://ma#####necherokee.net/index.php
- http://gr#####lecherokee.net/index.php
- http://ma#####nesullivan.net/index.php
- http://ca#####neharoldson.net/index.php
- http://gr#####learabella.net/index.php
- http://gr#####lesullivan.ru/index.php
- http://gr#####lesullivan.net/index.php
- http://si#####temargaret.net/index.php
- http://st#####iamargaret.net/index.php
- http://ma#####necherokee.ru/index.php
- http://me#####herharoldson.net/index.php
- http://ha####nhalflion.net/index.php
- http://ma#####nearabella.net/index.php
- http://ag#####anabolics.com/index.php
- http://ca#####eeitinthecup.org/index.php
- http://pi##asia.cn/index.php
- http://sp##tnav.ru/index.php
- http://un###lgrain.org/index.php
- http://ka#######ayajivayapriroda.ru/index.php
- http://na##top.ru/index.php
- http://ga#####yundongyuan.cn/index.php
- http://to###tosales.ru/index.php
- http://gu##155.cn/index.php
- http://sc####ainbow.net/index.php
- http://si###ypeas.net/index.php
- http://cl#####ortswomen.com/index.php
- http://cl####portsmen.com/index.php
- http://do##bate.cn/index.php
- http://bu####rmansion.com/index.php
- http://pr##card.ru/index.php
- http://ta#####pielenreiten.org/index.php
- http://sc#####epuzzlechess.org/index.php
- http://st#####iacherokee.net/index.php
UDP:
- DNS ASK so####ryducks.com
- DNS ASK ca#####nepettigrew.net
- DNS ASK me#####herpettigrew.net
- DNS ASK me#####hersackville.ru
- DNS ASK ca#####nesackville.net
- DNS ASK me#####hersackville.net
- DNS ASK me#####herhoneycutt.net
- DNS ASK ca#####nehoneycutt.net
- DNS ASK me#####herfairchild.net
- DNS ASK wi#####edpettigrew.net
- DNS ASK st#####iaharoldson.net
- DNS ASK st#####iadonaldson.net
- DNS ASK jo#####nepettigrew.net
- DNS ASK ma#####inesackville.net
- DNS ASK jo#####nesackville.net
- DNS ASK ma#####inehoneycutt.ru
- DNS ASK ma#####inehoneycutt.net
- DNS ASK jo#####nehoneycutt.net
- DNS ASK ma#####inefairchild.net
- DNS ASK jo#####nefairchild.net
- DNS ASK ca#####nefairchild.ru
- DNS ASK ca#####nefairchild.net
- DNS ASK ki#####eystrudwick.net
- DNS ASK ma#####inepettigrew.net
- DNS ASK gr#####leconstable.net
- DNS ASK je#####tedonaldson.net
- DNS ASK ki#####eydonaldson.net
- DNS ASK je#####teharoldson.ru
- DNS ASK je#####teharoldson.net
- DNS ASK ki#####eyharoldson.net
- DNS ASK ma#####nestrudwick.net
- DNS ASK gr#####lestrudwick.net
- DNS ASK ma#####neconstable.net
- DNS ASK si#####tedonaldson.net
- DNS ASK si#####teharoldson.net
- DNS ASK st#####iadonaldson.ru
- DNS ASK gr#####ledonaldson.net
- DNS ASK ma#####neharoldson.net
- DNS ASK gr#####leharoldson.net
- DNS ASK si#####testrudwick.ru
- DNS ASK si#####testrudwick.net
- DNS ASK st#####iastrudwick.net
- DNS ASK si#####teconstable.net
- DNS ASK st#####iaconstable.net
- DNS ASK gr#####leconstable.ru
- DNS ASK ma#####nedonaldson.net
- DNS ASK ki#####eyconstable.net
- DNS ASK sy#####erpettigrew.ru
- DNS ASK wi#####edhoneycutt.net
- DNS ASK je#####tepettigrew.net
- DNS ASK je#####tesackville.ru
- DNS ASK ki#####eypettigrew.net
- DNS ASK je#####tesackville.net
- DNS ASK ki#####eysackville.net
- DNS ASK je#####tehoneycutt.net
- DNS ASK ki#####eyhoneycutt.net
- DNS ASK je#####tefairchild.net
- DNS ASK ha#####tefairchild.net
- DNS ASK gw#####ynfairchild.net
- DNS ASK ki#####eyfairchild.ru
- DNS ASK gr#####lepettigrew.net
- DNS ASK ma#####nesackville.net
- DNS ASK gr#####lesackville.net
- DNS ASK ma#####nehoneycutt.ru
- DNS ASK ma#####nehoneycutt.net
- DNS ASK gr#####lehoneycutt.net
- DNS ASK ma#####nefairchild.net
- DNS ASK gr#####lefairchild.net
- DNS ASK ki#####eyfairchild.net
- DNS ASK ma#####nepettigrew.net
- DNS ASK wi#####edsackville.net
- DNS ASK sy#####erpettigrew.net
- DNS ASK gw#####ynhoneycutt.ru
- DNS ASK sy#####erhoneycutt.net
- DNS ASK wi#####edfairchild.ru
- DNS ASK wi#####edfairchild.net
- DNS ASK sy#####erfairchild.net
- DNS ASK ka#####napettigrew.net
- DNS ASK br#####nnpettigrew.net
- DNS ASK ka#####nasackville.net
- DNS ASK ha#####tehoneycutt.net
- DNS ASK sy#####ersackville.net
- DNS ASK gw#####ynhoneycutt.net
- DNS ASK br#####nnsackville.ru
- DNS ASK ha#####tepettigrew.ru
- DNS ASK ha#####tepettigrew.net
- DNS ASK ka#####nafairchild.net
- DNS ASK br#####nnfairchild.net
- DNS ASK gw#####ynpettigrew.net
- DNS ASK ha#####tesackville.net
- DNS ASK gw#####ynsackville.net
- DNS ASK br#####nnsackville.net
- DNS ASK ka#####nahoneycutt.net
- DNS ASK br#####nnhoneycutt.net
- DNS ASK je#####teconstable.net
- DNS ASK ki#####eystrudwick.ru
- DNS ASK je#####testrudwick.net
- DNS ASK ma#####necherokee.net
- DNS ASK gr#####lecherokee.net
- DNS ASK ma#####nearabella.net
- DNS ASK ma#####nesullivan.net
- DNS ASK gr#####learabella.net
- DNS ASK gr#####lesullivan.ru
- DNS ASK gr#####lesullivan.net
- DNS ASK si#####temargaret.net
- DNS ASK ga####liongrass.net
- DNS ASK jo#####nestrudwick.net
- DNS ASK ye####gdongwu.cn
- DNS ASK ca#####neharoldson.net
- DNS ASK st#####iacherokee.net
- DNS ASK jo#####nedonaldson.net
- DNS ASK ma#####inestrudwick.net
- DNS ASK ma#####inedonaldson.net
- DNS ASK me#####herstrudwick.net
- DNS ASK si#####tesullivan.net
- DNS ASK st#####iaarabella.net
- DNS ASK ma#####necherokee.ru
- DNS ASK st#####iamargaret.net
- DNS ASK me#####herharoldson.net
- DNS ASK gr###factory.cn
- DNS ASK cl####portsmen.com
- DNS ASK sp##tnav.ru
- DNS ASK un###lgrain.org
- DNS ASK ka#######ayajivayapriroda.ru
- DNS ASK na##top.ru
- DNS ASK ga#####yundongyuan.cn
- DNS ASK to###tosales.ru
- DNS ASK ca#####eeitinthecup.org
- DNS ASK gu##155.cn
- DNS ASK pr####anabolikov.ru
- DNS ASK jo#####neconstable.ru
- DNS ASK pi##asia.cn
- DNS ASK do##bate.cn
- DNS ASK bu####rmansion.com
- DNS ASK pr##card.ru
- DNS ASK ta#####pielenreiten.org
- DNS ASK sc####ainbow.net
- DNS ASK sc#####epuzzlechess.org
- DNS ASK ag#####anabolics.com
- DNS ASK ha####nhalflion.net
- DNS ASK cl#####ortswomen.com
- DNS ASK si###ypeas.net
- DNS ASK ch####isportsmen.ru
- DNS ASK me#####herdonaldson.net
- DNS ASK sy#####erharoldson.net
- DNS ASK br#####nnstrudwick.net
- DNS ASK ka#####naconstable.ru
- DNS ASK ka#####naconstable.net
- DNS ASK br#####nnconstable.net
- DNS ASK ka#####nadonaldson.net
- DNS ASK br#####nndonaldson.net
- DNS ASK ka#####naharoldson.net
- DNS ASK wi#####edharoldson.net
- DNS ASK sy#####erdonaldson.ru
- DNS ASK ka#####nastrudwick.net
- DNS ASK br#####nnharoldson.ru
- DNS ASK ha#####teconstable.net
- DNS ASK gw#####ynconstable.net
- DNS ASK ha#####tedonaldson.ru
- DNS ASK ha#####tedonaldson.net
- DNS ASK gw#####yndonaldson.net
- DNS ASK gw#####ynharoldson.net
- DNS ASK ha#####teharoldson.net
- DNS ASK br#####nnharoldson.net
- DNS ASK ha#####testrudwick.net
- DNS ASK gw#####ynstrudwick.net
- DNS ASK sy#####erdonaldson.net
- DNS ASK wi#####eddonaldson.net
- DNS ASK si#####tearabella.ru
- DNS ASK ca#####nedonaldson.net
- DNS ASK wi#####edstrudwick.ru
- DNS ASK jo#####neconstable.net
- DNS ASK gr#####lemargaret.net
- DNS ASK si#####tearabella.net
- DNS ASK ki#####eysullivan.net
- DNS ASK ca#####nestrudwick.ru
- DNS ASK ca#####neconstable.net
- DNS ASK me#####herconstable.net
- DNS ASK me#####herharoldson.ru
- DNS ASK st#####iasullivan.net
- DNS ASK ma#####nemargaret.net
- DNS ASK ma#####ineconstable.net
- DNS ASK si#####techerokee.net
- DNS ASK ca#####nestrudwick.net
- DNS ASK jo#####neharoldson.net
- DNS ASK wi#####edstrudwick.net
- DNS ASK sy#####erstrudwick.net
- DNS ASK wi#####edconstable.net
- DNS ASK sy#####erconstable.net
- DNS ASK ma#####ineharoldson.net
- DNS ASK si#####tepettigrew.net
- DNS ASK st#####iapettigrew.ru
Miscellaneous:
Creates and executes the following:
- 'C:\zwn0nlgluv\j0hhg5us2rmtrsoztogrgbpb.exe'
- 'C:\zwn0nlgluv\yfkwhee.exe'
- 'C:\zwn0nlgluv\muieokzsefhx.exe' "c:\zwn0nlgluv\yfkwhee.exe"