Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Foundation Manager Notification Logon' = '<SYSTEM32>\wovxjqu.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Program Driver Desktop SPP Device] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\kadhdmwn.exe' "<SYSTEM32>\wovxjqu.exe"
- '%WINDIR%\Temp\pvl2oto2y8ne43mt.exe' -r 31697 tcp
- '%TEMP%\pvl2oto2wtve43mtwfgxuo.exe'
- '<SYSTEM32>\wovxjqu.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\utlsswfskujml\run
- <SYSTEM32>\utlsswfskujml\rng
- %WINDIR%\Temp\pvl2oto2y8ne43mt.exe
- <SYSTEM32>\utlsswfskujml\cfg
- <SYSTEM32>\kadhdmwn.exe
- %TEMP%\pvl2oto2wtve43mtwfgxuo.exe
- <SYSTEM32>\utlsswfskujml\tst
- <SYSTEM32>\wovxjqu.exe
- <SYSTEM32>\utlsswfskujml\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\kadhdmwn.exe
- <SYSTEM32>\wovxjqu.exe
Deletes the following files:
- %WINDIR%\Temp\pvl2oto2y8ne43mt.exe
- %TEMP%\pvl2oto2wtve43mtwfgxuo.exe
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'to###ress.net':80
- 'fa###ress.net':80
- 'fa###oat.net':80
- 'le###open.net':80
- 'to###oat.net':80
- 'fa###pen.net':80
- 'we###oat.net':80
- 'to###pen.net':80
- 'to###est.net':80
- 'fa###est.net':80
- 'se###boat.net':80
- 'le###boat.net':80
- 'fi###pen.net':80
- 'fi###est.net':80
- 'pl###open.net':80
- 'le###rest.net':80
- 'se###open.net':80
- 'se###rest.net':80
- 'se###press.net':80
- 'le###press.net':80
- 'pi###open.net':80
- 'mu###pen.net':80
- 'mu###est.net':80
- 'mu###ress.net':80
- 'pi###rest.net':80
- 'ta###ress.net':80
- 'wa###est.net':80
- 'wa###ress.net':80
- 'wa###oat.net':80
- 'ta###oat.net':80
- 'we###est.net':80
- 've###est.net':80
- 've###ress.net':80
- 've###oat.net':80
- 'we###ress.net':80
- 'mu###oat.net':80
- 'pi###press.net':80
- 'pi###boat.net':80
- 'we###pen.net':80
- 've###pen.net':80
- 'pl###rest.net':80
- 'ta###ild.net':80
- 'wa###une.net':80
- 'wa###ild.net':80
- 'pi###kind.net':80
- 'mu###ind.net':80
- 'wa###ind.net':80
- 'ta###ind.net':80
- 'ta###egan.net':80
- 'ta###une.net':80
- 'wa###egan.net':80
- 're####eneither.net':80
- 'ge####friend.net':80
- 'mi####lossary.net':80
- 'st###march.net':80
- 'ta###fruit.net':80
- 'li####appear.net':80
- 'th####hcountry.net':80
- 're####erpaint.net':80
- 'gl###health.net':80
- 'ne####arydress.net':80
- 'vi###est.net':80
- 'lr###open.net':80
- 'lr###rest.net':80
- 'lr###press.net':80
- 'vi###ress.net':80
- 'pl###press.net':80
- 'fi###ress.net':80
- 'fi###oat.net':80
- 'vi###pen.net':80
- 'pl###boat.net':80
- 'yo###ress.net':80
- 'tr###rest.net':80
- 'tr###press.net':80
- 'tr###boat.net':80
- 'yo###oat.net':80
- 'lr###boat.net':80
- 'vi###oat.net':80
- 'yo###pen.net':80
- 'yo###est.net':80
- 'tr###open.net':80
TCP:
HTTP GET requests:
- http://to###ress.net/forum/search.php?me#########################################
- http://fa###ress.net/forum/search.php?me#########################################
- http://fa###oat.net/forum/search.php?me#########################################
- http://le###open.net/forum/search.php?me#########################################
- http://to###oat.net/forum/search.php?me#########################################
- http://fa###pen.net/forum/search.php?me#########################################
- http://we###oat.net/forum/search.php?me#########################################
- http://to###pen.net/forum/search.php?me#########################################
- http://to###est.net/forum/search.php?me#########################################
- http://fa###est.net/forum/search.php?me#########################################
- http://se###boat.net/forum/search.php?me#########################################
- http://le###boat.net/forum/search.php?me#########################################
- http://fi###pen.net/forum/search.php?me#########################################
- http://fi###est.net/forum/search.php?me#########################################
- http://pl###open.net/forum/search.php?me#########################################
- http://le###rest.net/forum/search.php?me#########################################
- http://se###open.net/forum/search.php?me#########################################
- http://se###rest.net/forum/search.php?me#########################################
- http://se###press.net/forum/search.php?me#########################################
- http://le###press.net/forum/search.php?me#########################################
- http://pi###open.net/forum/search.php?me#########################################
- http://mu###pen.net/forum/search.php?me#########################################
- http://mu###est.net/forum/search.php?me#########################################
- http://mu###ress.net/forum/search.php?me#########################################
- http://pi###rest.net/forum/search.php?me#########################################
- http://ta###ress.net/forum/search.php?me#########################################
- http://wa###est.net/forum/search.php?me#########################################
- http://wa###ress.net/forum/search.php?me#########################################
- http://wa###oat.net/forum/search.php?me#########################################
- http://ta###oat.net/forum/search.php?me#########################################
- http://we###est.net/forum/search.php?me#########################################
- http://ve###est.net/forum/search.php?me#########################################
- http://ve###ress.net/forum/search.php?me#########################################
- http://ve###oat.net/forum/search.php?me#########################################
- http://we###ress.net/forum/search.php?me#########################################
- http://mu###oat.net/forum/search.php?me#########################################
- http://pi###press.net/forum/search.php?me#########################################
- http://pi###boat.net/forum/search.php?me#########################################
- http://we###pen.net/forum/search.php?me#########################################
- http://ve###pen.net/forum/search.php?me#########################################
- http://pl###rest.net/forum/search.php?me#########################################
- http://ta###ild.net/forum/search.php?me#########################################
- http://wa###une.net/forum/search.php?me#########################################
- http://wa###ild.net/forum/search.php?me#########################################
- http://pi###kind.net/forum/search.php?me#########################################
- http://mu###ind.net/forum/search.php?me#########################################
- http://wa###ind.net/forum/search.php?me#########################################
- http://ta###ind.net/forum/search.php?me#########################################
- http://ta###egan.net/forum/search.php?me#########################################
- http://ta###une.net/forum/search.php?me#########################################
- http://wa###egan.net/forum/search.php?me#########################################
- http://re####eneither.net/forum/search.php?me#########################################
- http://ge####friend.net/forum/search.php?me#########################################
- http://mi####lossary.net/forum/search.php?me#########################################
- http://st###march.net/forum/search.php?me#########################################
- http://ta###fruit.net/forum/search.php?me#########################################
- http://li####appear.net/forum/search.php?me#########################################
- http://th####hcountry.net/forum/search.php?me#########################################
- http://re####erpaint.net/forum/search.php?me#########################################
- http://gl###health.net/forum/search.php?me#########################################
- http://ne####arydress.net/forum/search.php?me#########################################
- http://vi###est.net/forum/search.php?me#########################################
- http://lr###open.net/forum/search.php?me#########################################
- http://lr###rest.net/forum/search.php?me#########################################
- http://lr###press.net/forum/search.php?me#########################################
- http://vi###ress.net/forum/search.php?me#########################################
- http://pl###press.net/forum/search.php?me#########################################
- http://fi###ress.net/forum/search.php?me#########################################
- http://fi###oat.net/forum/search.php?me#########################################
- http://vi###pen.net/forum/search.php?me#########################################
- http://pl###boat.net/forum/search.php?me#########################################
- http://yo###ress.net/forum/search.php?me#########################################
- http://tr###rest.net/forum/search.php?me#########################################
- http://tr###press.net/forum/search.php?me#########################################
- http://tr###boat.net/forum/search.php?me#########################################
- http://yo###oat.net/forum/search.php?me#########################################
- http://lr###boat.net/forum/search.php?me#########################################
- http://vi###oat.net/forum/search.php?me#########################################
- http://yo###pen.net/forum/search.php?me#########################################
- http://yo###est.net/forum/search.php?me#########################################
- http://tr###open.net/forum/search.php?me#########################################
UDP:
- DNS ASK to###ress.net
- DNS ASK fa###ress.net
- DNS ASK fa###oat.net
- DNS ASK le###open.net
- DNS ASK to###oat.net
- DNS ASK fa###pen.net
- DNS ASK we###oat.net
- DNS ASK to###pen.net
- DNS ASK to###est.net
- DNS ASK fa###est.net
- DNS ASK se###boat.net
- DNS ASK le###boat.net
- DNS ASK fi###pen.net
- DNS ASK fi###est.net
- DNS ASK pl###open.net
- DNS ASK le###rest.net
- DNS ASK se###open.net
- DNS ASK se###rest.net
- DNS ASK se###press.net
- DNS ASK le###press.net
- DNS ASK ve###oat.net
- DNS ASK mu###pen.net
- DNS ASK wa###oat.net
- DNS ASK pi###open.net
- DNS ASK pi###rest.net
- DNS ASK mu###est.net
- DNS ASK wa###est.net
- DNS ASK ta###est.net
- DNS ASK ta###ress.net
- DNS ASK ta###oat.net
- DNS ASK wa###ress.net
- DNS ASK ve###est.net
- DNS ASK we###pen.net
- DNS ASK we###est.net
- DNS ASK we###ress.net
- DNS ASK ve###ress.net
- DNS ASK pi###press.net
- DNS ASK mu###ress.net
- DNS ASK mu###oat.net
- DNS ASK ve###pen.net
- DNS ASK pi###boat.net
- DNS ASK pl###rest.net
- DNS ASK ta###ild.net
- DNS ASK wa###une.net
- DNS ASK wa###ild.net
- DNS ASK pi###kind.net
- DNS ASK mu###ind.net
- DNS ASK wa###ind.net
- DNS ASK ta###ind.net
- DNS ASK ta###egan.net
- DNS ASK ta###une.net
- DNS ASK wa###egan.net
- DNS ASK re####eneither.net
- DNS ASK ge####friend.net
- DNS ASK mi####lossary.net
- DNS ASK st###march.net
- DNS ASK ta###fruit.net
- DNS ASK li####appear.net
- DNS ASK th####hcountry.net
- DNS ASK re####erpaint.net
- DNS ASK gl###health.net
- DNS ASK ne####arydress.net
- DNS ASK vi###est.net
- DNS ASK lr###open.net
- DNS ASK lr###rest.net
- DNS ASK lr###press.net
- DNS ASK vi###ress.net
- DNS ASK pl###press.net
- DNS ASK fi###ress.net
- DNS ASK fi###oat.net
- DNS ASK vi###pen.net
- DNS ASK pl###boat.net
- DNS ASK yo###ress.net
- DNS ASK tr###rest.net
- DNS ASK tr###press.net
- DNS ASK tr###boat.net
- DNS ASK yo###oat.net
- DNS ASK lr###boat.net
- DNS ASK vi###oat.net
- DNS ASK yo###pen.net
- DNS ASK yo###est.net
- DNS ASK tr###open.net
- '23#.#55.255.250':1900