Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MciGkrwk' = '<LS_APPDATA>\eyqtaont\mcigkrwk.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,<LS_APPDATA>\eyqtaont\mcigkrwk.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mcigkrwk.exe
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Creates and executes the following:
- %TEMP%\ekdbmtyq.exe admin
- %TEMP%\ekdbmtyq.exe elevate
Executes the following:
- <SYSTEM32>\svchost.exe
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtOpenKey, handler: tqgnnosw.sys
- NtCreateKey, handler: tqgnnosw.sys
Modifies file system :
Creates the following files:
- %TEMP%\tqgnnosw.sys
- %WINDIR%\Temp\6decd52f
- %WINDIR%\Temp\7fffffb1
- <LS_APPDATA>\eyqtaont\mcigkrwk.exe
- %TEMP%\ekdbmtyq.exe
- %ALLUSERSPROFILE%\Application Data\bjdwbfvf.log
- <LS_APPDATA>\niuydqre.log
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mcigkrwk.exe
Deletes the following files:
- %TEMP%\tqgnnosw.sys
Network activity:
Connects to:
- 'po####jnvfauh.com':443
- 'sd####lyavjif.com':443
- 'la###jvqc.com':443
- 'su#####rwhjfxdqbt.com':443
- 'qu###xiga.com':443
- 'de#####paoywbeccng.com':443
- 'vo#####uxkkmhbmuac.com':443
- 'ma###rada.com':443
- '74.##5.232.51':80
- 'bj###vngsn.com':443
- 'xp###lpguj.com':443
- 'fo#####ykmdxodav.com':443
UDP:
- DNS ASK bw#####maylcusgj.com
- DNS ASK wd####rgmluxb.com
- DNS ASK el#####qujjsojmx.com
- DNS ASK be###ootil.com
- DNS ASK qv###knv.com
- DNS ASK sq####wlslkv.com
- DNS ASK gn#####dxnwrwqkwpp.com
- DNS ASK qp###xefbxv.com
- DNS ASK ch#####jcohrghodar.com
- DNS ASK nd####elkoxl.com
- DNS ASK ku###cqp.com
- DNS ASK qw###ygxhjr.com
- DNS ASK nd###gecu.com
- DNS ASK cs#####weytrimmb.com
- DNS ASK yj###uva.com
- DNS ASK jm#####pmvbliuoqw.com
- DNS ASK fp####oxhcajs.com
- DNS ASK lu#####xfwyjlpnpig.com
- DNS ASK dq####ddwvllihp.com
- DNS ASK ah####mbxjqjon.com
- DNS ASK mr####oxjgrnqm.com
- DNS ASK dv###yqhomu.com
- DNS ASK ej###jdfvkh.com
- DNS ASK rd####tsxxsvkj.com
- DNS ASK ec###nbib.com
- DNS ASK rd###uyxkh.com
- DNS ASK rd###vyaon.com
- DNS ASK ps###fybl.com
- DNS ASK sx#####caaprwyocm.com
- DNS ASK dl#####nvmmgtngihh.com
- DNS ASK ha#####acvhhmngyg.com
- DNS ASK ep#####qkbedarpd.com
- DNS ASK nv#####shkovbheq.com
- DNS ASK kg####ycaynei.com
- DNS ASK ya##o.com
- DNS ASK er###tbw.com
- DNS ASK rn#####hmhcuewwvm.com
- DNS ASK sl#####uwfxnfweg.com
- DNS ASK ic###lgk.com
- DNS ASK ku####lhpqfxv.com
- DNS ASK ta####oqnuhxe.com
- DNS ASK oq####udrctwy.com
- DNS ASK uf###werdk.com
- DNS ASK cx#####phvqlduqqj.com
- DNS ASK er###nya.com
- DNS ASK ey#####lecqsgdghv.com
- DNS ASK ji#####jbrmwcvux.com
- DNS ASK uw#####ixgltepqsfv.com
- DNS ASK sd###kbhsk.com
- DNS ASK vk####rosfly.com
- DNS ASK tn#####xenaqbdtavwq.com
- DNS ASK bj###dybgv.com
- DNS ASK je#####otxdmsdii.com
- DNS ASK pj#####olyjcktcrt.com
- DNS ASK gd###inrnck.com
- DNS ASK ai####uwohodb.com
- DNS ASK xd###topx.com
- DNS ASK kg#####ntvypekpui.com
- DNS ASK yw####ahywcmub.com
- DNS ASK eq###gxi.com
- DNS ASK jd###bvkleb.com
- DNS ASK sc###oelqc.com
- DNS ASK ea#####dokkgarfmuj.com
- DNS ASK cw####vnopquj.com
- DNS ASK gl###fkwxhe.com
- DNS ASK cq####ajfpumhco.com
- DNS ASK ys####ufhioygn.com
- DNS ASK la###ffr.com
- DNS ASK eq####khtelypr.com
- DNS ASK mw###cio.com
- DNS ASK cq####etbxkk.com
- DNS ASK ek#####rwtnmkrgo.com
- DNS ASK wf###jxywb.com
- DNS ASK gm#####jcwvaidubfha.com
- DNS ASK fm####ycqcllrql.com
- DNS ASK fb####kvhcgp.com
- DNS ASK ot####ndkmwgak.com
- DNS ASK lq#####thqejaosnm.com
- DNS ASK vu####bqnuot.com
- DNS ASK qb#####jlbetfrjfh.com
- DNS ASK iu####gmqgyf.com
- DNS ASK we####bsrjjf.com
- DNS ASK mr###wva.com
- DNS ASK of###xwx.com
- DNS ASK vd####rwmhpvtw.com
- DNS ASK pe####kmewcix.com
- DNS ASK aa####jyvxlosy.com
- DNS ASK aj###vwcsnp.com
- DNS ASK yy####ghkfwqpyq.com
- DNS ASK tu####asasucgkv.com
- DNS ASK sd####lyavjif.com
- DNS ASK bj###vngsn.com
- DNS ASK po####jnvfauh.com
- DNS ASK la###jvqc.com
- DNS ASK xp###lpguj.com
- DNS ASK ma###rada.com
- DNS ASK google.com
- DNS ASK fo#####ykmdxodav.com
- DNS ASK vo#####uxkkmhbmuac.com
- DNS ASK er###qeq.com
- DNS ASK ov###fobf.com
- DNS ASK wv#####liuqbakkxry.com
- DNS ASK oq####sfugms.com
- DNS ASK ii###gbo.com
- DNS ASK qu###xiga.com
- DNS ASK de#####paoywbeccng.com
- DNS ASK gx###jxn.com
- DNS ASK su#####rwhjfxdqbt.com
- DNS ASK py####pajlxoeoc.com
- DNS ASK xl####tggmabhpp.com
- DNS ASK dp####aikowymh.com
- DNS ASK ox###xtyyr.com
- DNS ASK gc###bgura.com
- DNS ASK ke####bypwgfqyg.com
- DNS ASK da###lbs.com
- DNS ASK oo####wmyxunlr.com
- DNS ASK iw###pbwppg.com
- DNS ASK br####kmgndn.com
- DNS ASK cy#####pqdllvrxqu.com
- DNS ASK ge###kyac.com
- DNS ASK oq####mhigjfw.com
- DNS ASK wg###cdb.com
- DNS ASK ip#####knysfvomq.com
- DNS ASK yc####htqeenpso.com
- DNS ASK bing.com
- DNS ASK kb###agf.com
- DNS ASK vk####pjiqwejsv.com
- DNS ASK ri###mncox.com
- DNS ASK il#####vfabsxnodio.com
- DNS ASK pq#####thkuhlyoycp.com
- DNS ASK fy#####lnlaedmnew.com
- DNS ASK sv####vugdxo.com
- DNS ASK si####sxureorb.com
- DNS ASK ib#####odpyxmfhyk.com
- DNS ASK hx###cpwyxh.com
- DNS ASK bg#####pdfqnqppg.com
- DNS ASK go####gvolnkcpo.com
- DNS ASK kx#####oqnlfwfvisbb.com
- DNS ASK mq####itbbak.com
- DNS ASK rb###ssmhcx.com
- DNS ASK wv####xvdjag.com
- DNS ASK xa####olgpym.com
- DNS ASK kp###ugumx.com
- DNS ASK bg###vwufi.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''