Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'UeLDwwBIrwI_QtizZrzjwUJXsW' = '<SYSTEM32>\FdDttQYRsYxGpS.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\System Check.lnk
Malicious functions:
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- <SYSTEM32>\FdDttQYRsYxGpS.exe
Deletes the following files:
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
Deletes itself.
Network activity:
Connects to:
- 'ou####lyhrefdb.com':80
- 'ev####opsfyajc.in':80
- 'hr####urmuvltr.tw':80
- 'uu####iarqojsy.net':80
- 'yo####glldhmdj.cc':80
- 'yr####qpbhstje.com':80
- 'fe####ndwinrmm.in':80
- 'lg####usudtdvu.tw':80
- 'mc####ipvkmykh.net':80
- 'ui####tnqfxmin.cc':80
- 'ty####vyvropqk.cc':80
- 'dq####eckjkwkj.com':80
- 'pm####wqohorbx.in':80
- 'dw####pwhmdpxl.tw':80
- 'dk####daufdfyo.in':80
- 'vd####orjjgeea.cc':80
- 'ym####wqggamrl.net':80
- 'rw####jvexihbb.com':80
- 'jp####fhhnejdt.cc':80
- 'sa####rxwppmxn.tw':80
- 'wn####gxoylqvt.com':80
- 'qy####iemqrlvx.in':80
- 'fc####obaakdet.net':80
- 'ku####etuwcboe.cc':80
- 'od####eboqqffr.tw':80
- 'on####ahcctktf.com':80
- 'ou####vkiehpqn.in':80
- 'ni####rrnwerid.net':80
- 'ih####rxcxbiju.com':80
- 'fm####nvfeuggg.cc':80
- 'pw####glygfneo.tw':80
- 'aa####splxepbb.in':80
- 'ii####shyqvucs.tw':80
- 'cu####adaonihw.net':80
- 'lr####dimhydmr.in':80
- 'ma####mschxgqj.cc':80
- 'to####npynbmhi.net':80
- 'cr####butvloox.com':80
- 'qh####ldtaqxte.in':80
- 'pu####qldjfnav.tw':80
- 'wv####gjadgsvu.net':80
- 'nf####omgsyauw.cc':80
- 'ub####cpkcxxry.com':80
- 'xg####madccvuy.in':80
- 'xk####phphcjnd.tw':80
- 'sm####kgwlvqyj.net':80
- 'xb####dlpypjhx.in':80
- 'ef####ovtjslcb.cc':80
- 'pb####auixkaev.net':80
- 'xs####enhempwp.com':80
- 'dd####smhattnn.tw':80
- 'sb####qdahvdfx.in':80
- 'ru####ahwllirl.cc':80
- 'po####cnxvlgai.net':80
- 'dg####rbckgxwe.com':80
- 'hf####ropkxuga.cc':80
- 'ck####bctjwdpm.tw':80
- 'uf####yiofwpel.com':80
- 'yl####fnyhvryt.in':80
- 'wl####slppybwp.net':80
- 'ag####pefjhccd.cc':80
- 'yt####ocnlwuns.tw':80
- 'ms####trfyqbuu.com':80
- 'mi####jrunefcx.in':80
- 'nf####alamthns.tw':80
- 'is####gdokurnj.net':80
- 'oj####wtmwwpua.cc':80
- 'kk####tqtvwdcr.tw':80
- 'ab####uwhakowy.com':80
- 'bp####btodpicv.tw':80
- 'bb####pwwdhqwb.net':80
- 'qn####pmgwshrs.in':80
- 'lu####nbelmgcd.cc':80
TCP:
HTTP POST requests:
- ou####lyhrefdb.com/
- ev####opsfyajc.in/
- hr####urmuvltr.tw/
- uu####iarqojsy.net/
- yo####glldhmdj.cc/
- yr####qpbhstje.com/
- fe####ndwinrmm.in/
- lg####usudtdvu.tw/
- mc####ipvkmykh.net/
- ui####tnqfxmin.cc/
- ty####vyvropqk.cc/
- dq####eckjkwkj.com/
- pm####wqohorbx.in/
- dw####pwhmdpxl.tw/
- dk####daufdfyo.in/
- vd####orjjgeea.cc/
- ym####wqggamrl.net/
- rw####jvexihbb.com/
- jp####fhhnejdt.cc/
- sa####rxwppmxn.tw/
- wn####gxoylqvt.com/
- qy####iemqrlvx.in/
- fc####obaakdet.net/
- ku####etuwcboe.cc/
- od####eboqqffr.tw/
- on####ahcctktf.com/
- ou####vkiehpqn.in/
- ni####rrnwerid.net/
- ih####rxcxbiju.com/
- fm####nvfeuggg.cc/
- pw####glygfneo.tw/
- aa####splxepbb.in/
- ii####shyqvucs.tw/
- cu####adaonihw.net/
- lr####dimhydmr.in/
- ma####mschxgqj.cc/
- to####npynbmhi.net/
- cr####butvloox.com/
- qh####ldtaqxte.in/
- pu####qldjfnav.tw/
- wv####gjadgsvu.net/
- nf####omgsyauw.cc/
- ub####cpkcxxry.com/
- xg####madccvuy.in/
- xk####phphcjnd.tw/
- sm####kgwlvqyj.net/
- xb####dlpypjhx.in/
- ef####ovtjslcb.cc/
- pb####auixkaev.net/
- xs####enhempwp.com/
- dd####smhattnn.tw/
- sb####qdahvdfx.in/
- ru####ahwllirl.cc/
- po####cnxvlgai.net/
- dg####rbckgxwe.com/
- hf####ropkxuga.cc/
- ck####bctjwdpm.tw/
- uf####yiofwpel.com/
- yl####fnyhvryt.in/
- wl####slppybwp.net/
- ag####pefjhccd.cc/
- yt####ocnlwuns.tw/
- ms####trfyqbuu.com/
- mi####jrunefcx.in/
- nf####alamthns.tw/
- is####gdokurnj.net/
- oj####wtmwwpua.cc/
- kk####tqtvwdcr.tw/
- ab####uwhakowy.com/
- bp####btodpicv.tw/
- bb####pwwdhqwb.net/
- qn####pmgwshrs.in/
- lu####nbelmgcd.cc/
UDP:
- DNS ASK uu####iarqojsy.net
- DNS ASK ou####lyhrefdb.com
- DNS ASK vd####orjjgeea.cc
- DNS ASK hr####urmuvltr.tw
- DNS ASK ev####opsfyajc.in
- DNS ASK mc####ipvkmykh.net
- DNS ASK yr####qpbhstje.com
- DNS ASK yo####glldhmdj.cc
- DNS ASK lg####usudtdvu.tw
- DNS ASK pm####wqohorbx.in
- DNS ASK ui####tnqfxmin.cc
- DNS ASK to####npynbmhi.net
- DNS ASK dq####eckjkwkj.com
- DNS ASK ty####vyvropqk.cc
- DNS ASK rw####jvexihbb.com
- DNS ASK dk####daufdfyo.in
- DNS ASK dw####pwhmdpxl.tw
- DNS ASK ym####wqggamrl.net
- DNS ASK fe####ndwinrmm.in
- DNS ASK jp####fhhnejdt.cc
- DNS ASK sa####rxwppmxn.tw
- DNS ASK wn####gxoylqvt.com
- DNS ASK qy####iemqrlvx.in
- DNS ASK fc####obaakdet.net
- DNS ASK ku####etuwcboe.cc
- DNS ASK od####eboqqffr.tw
- DNS ASK on####ahcctktf.com
- DNS ASK ou####vkiehpqn.in
- DNS ASK ni####rrnwerid.net
- DNS ASK ih####rxcxbiju.com
- DNS ASK fm####nvfeuggg.cc
- DNS ASK pw####glygfneo.tw
- DNS ASK aa####splxepbb.in
- DNS ASK ii####shyqvucs.tw
- DNS ASK cu####adaonihw.net
- DNS ASK lr####dimhydmr.in
- DNS ASK ma####mschxgqj.cc
- DNS ASK wv####gjadgsvu.net
- DNS ASK cr####butvloox.com
- DNS ASK ru####ahwllirl.cc
- DNS ASK pu####qldjfnav.tw
- DNS ASK qh####ldtaqxte.in
- DNS ASK sm####kgwlvqyj.net
- DNS ASK ub####cpkcxxry.com
- DNS ASK nf####omgsyauw.cc
- DNS ASK xk####phphcjnd.tw
- DNS ASK xs####enhempwp.com
- DNS ASK xb####dlpypjhx.in
- DNS ASK google.com
- DNS ASK pb####auixkaev.net
- DNS ASK ef####ovtjslcb.cc
- DNS ASK dg####rbckgxwe.com
- DNS ASK sb####qdahvdfx.in
- DNS ASK dd####smhattnn.tw
- DNS ASK po####cnxvlgai.net
- DNS ASK xg####madccvuy.in
- DNS ASK hf####ropkxuga.cc
- DNS ASK ck####bctjwdpm.tw
- DNS ASK uf####yiofwpel.com
- DNS ASK yl####fnyhvryt.in
- DNS ASK wl####slppybwp.net
- DNS ASK ag####pefjhccd.cc
- DNS ASK yt####ocnlwuns.tw
- DNS ASK ms####trfyqbuu.com
- DNS ASK mi####jrunefcx.in
- DNS ASK nf####alamthns.tw
- DNS ASK is####gdokurnj.net
- DNS ASK oj####wtmwwpua.cc
- DNS ASK kk####tqtvwdcr.tw
- DNS ASK ab####uwhakowy.com
- DNS ASK bp####btodpicv.tw
- DNS ASK bb####pwwdhqwb.net
- DNS ASK qn####pmgwshrs.in
- DNS ASK lu####nbelmgcd.cc