Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Instrumentation Engine Windows' = '%APPDATA%\ehnadgn\gepeoxnwbc.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\ehnadgn\oyadzntabli.exe' "%APPDATA%\ehnadgn\gepeoxnwbc.exe"
- '%APPDATA%\ehnadgn\gepeoxnwbc.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\ehnadgn\gepeoxnwbc.uf
- %APPDATA%\ehnadgn\oyadzntabli.exe
- %APPDATA%\ehnadgn\gepeoxnwbc.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\ehnadgn\oyadzntabli.exe
- %APPDATA%\ehnadgn\gepeoxnwbc.exe
Network activity:
Connects to:
- 'wh####rgeneral.net':80
- 'ri###clear.net':80
- 'wh####rclear.net':80
- 'ri####eneral.net':80
- 'wh####rnorth.net':80
- 'ri####nclude.net':80
- 'wh####rinclude.net':80
- 'fo####ngeneral.net':80
- 'su####general.net':80
- 'fo####nclear.net':80
- 'su####include.net':80
- 'fo####nnorth.net':80
- 'su###nnorth.net':80
- 'fo####ninclude.net':80
- 'pi####eclear.net':80
- 'th###hnorth.net':80
- 'fi###enorth.net':80
- 'ci####tteclear.net':80
- 'pi####einclude.net':80
- 'ci#####tegeneral.net':80
- 'pi####egeneral.net':80
- 'th###hclear.net':80
- 'fi###eclear.net':80
- 'ri###north.net':80
- 'fi####general.net':80
- 'th####include.net':80
- 'fi####include.net':80
- 'th####general.net':80
- 'ei####during.net':80
- 'en####hindeed.net':80
- 'ei####indeed.net':80
- 'en####hduring.net':80
- 'ex####general.net':80
- 'be####eclear.net':80
- 'ex###tclear.net':80
- 'fa####during.net':80
- 'ch####enduring.net':80
- 'fa####indeed.net':80
- 'ei####length.net':80
- 'en####hnotice.net':80
- 'ei####notice.net':80
- 'en####hlength.net':80
- 'pe####include.net':80
- 'ma####egeneral.net':80
- 'pe####general.net':80
- 'ma####einclude.net':80
- 'su###nclear.net':80
- 'ma####enorth.net':80
- 'pe###nnorth.net':80
- 'be####einclude.net':80
- 'ex####include.net':80
- 'be####egeneral.net':80
- 'ex###tnorth.net':80
- 'ma####eclear.net':80
- 'pe###nclear.net':80
- 'be####enorth.net':80
TCP:
HTTP GET requests:
- http://wh####rgeneral.net/forum/search.php?em####################################
- http://ri###clear.net/forum/search.php?em####################################
- http://wh####rclear.net/forum/search.php?em####################################
- http://ri####eneral.net/forum/search.php?em####################################
- http://wh####rnorth.net/forum/search.php?em####################################
- http://ri####nclude.net/forum/search.php?em####################################
- http://wh####rinclude.net/forum/search.php?em####################################
- http://fo####ngeneral.net/forum/search.php?em####################################
- http://su####general.net/forum/search.php?em####################################
- http://fo####nclear.net/forum/search.php?em####################################
- http://su####include.net/forum/search.php?em####################################
- http://fo####nnorth.net/forum/search.php?em####################################
- http://su###nnorth.net/forum/search.php?em####################################
- http://fo####ninclude.net/forum/search.php?em####################################
- http://pi####eclear.net/forum/search.php?em####################################
- http://th###hnorth.net/forum/search.php?em####################################
- http://fi###enorth.net/forum/search.php?em####################################
- http://ci####tteclear.net/forum/search.php?em####################################
- http://pi####einclude.net/forum/search.php?em####################################
- http://ci#####tegeneral.net/forum/search.php?em####################################
- http://pi####egeneral.net/forum/search.php?em####################################
- http://th###hclear.net/forum/search.php?em####################################
- http://fi###eclear.net/forum/search.php?em####################################
- http://ri###north.net/forum/search.php?em####################################
- http://fi####general.net/forum/search.php?em####################################
- http://th####include.net/forum/search.php?em####################################
- http://fi####include.net/forum/search.php?em####################################
- http://th####general.net/forum/search.php?em####################################
- http://ei####during.net/forum/search.php?em####################################
- http://en####hindeed.net/forum/search.php?em####################################
- http://ei####indeed.net/forum/search.php?em####################################
- http://en####hduring.net/forum/search.php?em####################################
- http://ex####general.net/forum/search.php?em####################################
- http://be####eclear.net/forum/search.php?em####################################
- http://ex###tclear.net/forum/search.php?em####################################
- http://fa####during.net/forum/search.php?em####################################
- http://ch####enduring.net/forum/search.php?em####################################
- http://fa####indeed.net/forum/search.php?em####################################
- http://ei####length.net/forum/search.php?em####################################
- http://en####hnotice.net/forum/search.php?em####################################
- http://ei####notice.net/forum/search.php?em####################################
- http://en####hlength.net/forum/search.php?em####################################
- http://pe####include.net/forum/search.php?em####################################
- http://ma####egeneral.net/forum/search.php?em####################################
- http://pe####general.net/forum/search.php?em####################################
- http://ma####einclude.net/forum/search.php?em####################################
- http://su###nclear.net/forum/search.php?em####################################
- http://ma####enorth.net/forum/search.php?em####################################
- http://pe###nnorth.net/forum/search.php?em####################################
- http://be####einclude.net/forum/search.php?em####################################
- http://ex####include.net/forum/search.php?em####################################
- http://be####egeneral.net/forum/search.php?em####################################
- http://ex###tnorth.net/forum/search.php?em####################################
- http://ma####eclear.net/forum/search.php?em####################################
- http://pe###nclear.net/forum/search.php?em####################################
- http://be####enorth.net/forum/search.php?em####################################
UDP:
- DNS ASK wh####rgeneral.net
- DNS ASK ri###clear.net
- DNS ASK wh####rclear.net
- DNS ASK ri####eneral.net
- DNS ASK wh####rnorth.net
- DNS ASK ri####nclude.net
- DNS ASK wh####rinclude.net
- DNS ASK fo####ngeneral.net
- DNS ASK su####general.net
- DNS ASK fo####nclear.net
- DNS ASK su####include.net
- DNS ASK fo####nnorth.net
- DNS ASK su###nnorth.net
- DNS ASK fo####ninclude.net
- DNS ASK pi####eclear.net
- DNS ASK th###hnorth.net
- DNS ASK fi###enorth.net
- DNS ASK ci####tteclear.net
- DNS ASK pi####einclude.net
- DNS ASK ci#####tegeneral.net
- DNS ASK pi####egeneral.net
- DNS ASK th###hclear.net
- DNS ASK fi###eclear.net
- DNS ASK ri###north.net
- DNS ASK fi####general.net
- DNS ASK th####include.net
- DNS ASK fi####include.net
- DNS ASK th####general.net
- DNS ASK ei####during.net
- DNS ASK en####hindeed.net
- DNS ASK ei####indeed.net
- DNS ASK en####hduring.net
- DNS ASK ex####general.net
- DNS ASK be####eclear.net
- DNS ASK ex###tclear.net
- DNS ASK fa####during.net
- DNS ASK ch####enduring.net
- DNS ASK fa####indeed.net
- DNS ASK ei####length.net
- DNS ASK en####hnotice.net
- DNS ASK ei####notice.net
- DNS ASK en####hlength.net
- DNS ASK pe####include.net
- DNS ASK ma####egeneral.net
- DNS ASK pe####general.net
- DNS ASK ma####einclude.net
- DNS ASK su###nclear.net
- DNS ASK ma####enorth.net
- DNS ASK pe###nnorth.net
- DNS ASK be####einclude.net
- DNS ASK ex####include.net
- DNS ASK be####egeneral.net
- DNS ASK ex###tnorth.net
- DNS ASK ma####eclear.net
- DNS ASK pe###nclear.net
- DNS ASK be####enorth.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''