Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Engine Audio Browser Play Panel SPP Security' = 'C:\pmtumgj\hqdmzkglwrq.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Workstation Ordering Transaction] 'ImagePath' = 'C:\pmtumgj\hqdmzkglwrq.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Workstation Ordering Transaction] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\pmtumgj\xntkohojyx.exe' "c:\pmtumgj\hqdmzkglwrq.exe"
- 'C:\pmtumgj\hqdmzkglwrq.exe'
- 'C:\pmtumgj\nrnj345ba1fglgzoog8g.exe'
Modifies file system:
Creates the following files:
- C:\pmtumgj\hqdmzkglwrq.exe
- C:\pmtumgj\xntkohojyx.exe
- C:\pmtumgj\kbvztdy
- %WINDIR%\pmtumgj\rbvuxw
- C:\pmtumgj\rbvuxw
- C:\pmtumgj\nrnj345ba1fglgzoog8g.exe
Sets the 'hidden' attribute to the following files:
- C:\pmtumgj\xntkohojyx.exe
- C:\pmtumgj\hqdmzkglwrq.exe
Deletes the following files:
- C:\pmtumgj\nrnj345ba1fglgzoog8g.exe
- %WINDIR%\pmtumgj\rbvuxw
Network activity:
Connects to:
- 'pr####famous.net':80
- 'do###rpower.net':80
- 'do####famous.net':80
- 'do####century.net':80
- 'pr####century.net':80
- 'fe####century.net':80
- 'fe####famous.net':80
- 'pr####country.net':80
- 'pr###ypower.net':80
- 'do####country.net':80
- 'mi####entury.net':80
- 'st###famous.net':80
- 'st####entury.net':80
- 'bu####ngcountry.net':80
- 'ev####gcountry.net':80
- 'st####ountry.net':80
- 'mi####ountry.net':80
- 'mi###power.net':80
- 'mi###famous.net':80
- 'st###power.net':80
- 'pr####efamous.net':80
- 'de####famous.net':80
- 'de####century.net':80
- 're####country.net':80
- 'pr####ecentury.net':80
- 'de####country.net':80
- 'st####thcentury.net':80
- 'pr####ecountry.net':80
- 'pr####epower.net':80
- 'de###epower.net':80
- 'br####century.net':80
- 're####century.net':80
- 'fe####country.net':80
- 'fe###wpower.net':80
- 'do###epower.net':80
- 're###tpower.net':80
- 'br####country.net':80
- 'br###npower.net':80
- 'br####famous.net':80
- 're####famous.net':80
- 'de####soldier.net':80
- 'pr####eplease.net':80
- 'pr####esoldier.net':80
- 'pr####enation.net':80
- 'de####nation.net':80
- 'st####thnation.net':80
- 'st###nation.net':80
- 'de####condition.net':80
- 'de####please.net':80
- 'pr#####condition.net':80
- 're####nation.net':80
- 'br####soldier.net':80
- 'br####nation.net':80
- 'fe####condition.net':80
- 'do####condition.net':80
- 'br####condition.net':80
- 're####condition.net':80
- 're####please.net':80
- 're####soldier.net':80
- 'br####please.net':80
- 'ou####ecountry.net':80
- 'bu####ngcentury.net':80
- 'mo####ntcountry.net':80
- 'mo####ntpower.net':80
- 'ou####epower.net':80
- 'bu####ngpower.net':80
- 'ev####gpower.net':80
- 'ev####gfamous.net':80
- 'ev####gcentury.net':80
- 'bu####ngfamous.net':80
- 'st###please.net':80
- 'st#####hcondition.net':80
- 'st####thplease.net':80
- 'st####thsoldier.net':80
- 'st####oldier.net':80
- 'mo####ntfamous.net':80
- 'ou####efamous.net':80
- 'ou####ecentury.net':80
- 'st####ondition.net':80
- 'mo####ntcentury.net':80
TCP:
HTTP GET requests:
- http://pr####famous.net/index.php?me########
- http://do###rpower.net/index.php?me########
- http://do####famous.net/index.php?me########
- http://do####century.net/index.php?me########
- http://pr####century.net/index.php?me########
- http://fe####century.net/index.php?me########
- http://fe####famous.net/index.php?me########
- http://pr####country.net/index.php?me########
- http://pr###ypower.net/index.php?me########
- http://do####country.net/index.php?me########
- http://mi####entury.net/index.php?me########
- http://st###famous.net/index.php?me########
- http://st####entury.net/index.php?me########
- http://bu####ngcountry.net/index.php?me########
- http://ev####gcountry.net/index.php?me########
- http://st####ountry.net/index.php?me########
- http://mi####ountry.net/index.php?me########
- http://mi###power.net/index.php?me########
- http://mi###famous.net/index.php?me########
- http://st###power.net/index.php?me########
- http://pr####efamous.net/index.php?me########
- http://de####famous.net/index.php?me########
- http://de####century.net/index.php?me########
- http://re####country.net/index.php?me########
- http://pr####ecentury.net/index.php?me########
- http://de####country.net/index.php?me########
- http://st####thcentury.net/index.php?me########
- http://pr####ecountry.net/index.php?me########
- http://pr####epower.net/index.php?me########
- http://de###epower.net/index.php?me########
- http://br####century.net/index.php?me########
- http://re####century.net/index.php?me########
- http://fe####country.net/index.php?me########
- http://fe###wpower.net/index.php?me########
- http://do###epower.net/index.php?me########
- http://re###tpower.net/index.php?me########
- http://br####country.net/index.php?me########
- http://br###npower.net/index.php?me########
- http://br####famous.net/index.php?me########
- http://re####famous.net/index.php?me########
- http://de####soldier.net/index.php?me########
- http://pr####eplease.net/index.php?me########
- http://pr####esoldier.net/index.php?me########
- http://pr####enation.net/index.php?me########
- http://de####nation.net/index.php?me########
- http://st####thnation.net/index.php?me########
- http://st###nation.net/index.php?me########
- http://de####condition.net/index.php?me########
- http://de####please.net/index.php?me########
- http://pr#####condition.net/index.php?me########
- http://re####nation.net/index.php?me########
- http://br####soldier.net/index.php?me########
- http://br####nation.net/index.php?me########
- http://fe####condition.net/index.php?me########
- http://do####condition.net/index.php?me########
- http://br####condition.net/index.php?me########
- http://re####condition.net/index.php?me########
- http://re####please.net/index.php?me########
- http://re####soldier.net/index.php?me########
- http://br####please.net/index.php?me########
- http://ou####ecountry.net/index.php?me########
- http://bu####ngcentury.net/index.php?me########
- http://mo####ntcountry.net/index.php?me########
- http://mo####ntpower.net/index.php?me########
- http://ou####epower.net/index.php?me########
- http://bu####ngpower.net/index.php?me########
- http://ev####gpower.net/index.php?me########
- http://ev####gfamous.net/index.php?me########
- http://ev####gcentury.net/index.php?me########
- http://bu####ngfamous.net/index.php?me########
- http://st###please.net/index.php?me########
- http://st#####hcondition.net/index.php?me########
- http://st####thplease.net/index.php?me########
- http://st####thsoldier.net/index.php?me########
- http://st####oldier.net/index.php?me########
- http://mo####ntfamous.net/index.php?me########
- http://ou####efamous.net/index.php?me########
- http://ou####ecentury.net/index.php?me########
- http://st####ondition.net/index.php?me########
- http://mo####ntcentury.net/index.php?me########
UDP:
- DNS ASK do###rpower.net
- DNS ASK pr###ypower.net
- DNS ASK pr####famous.net
- DNS ASK pr####century.net
- DNS ASK do####famous.net
- DNS ASK fe####famous.net
- DNS ASK fe###wpower.net
- DNS ASK fe####century.net
- DNS ASK do####country.net
- DNS ASK pr####country.net
- DNS ASK st###famous.net
- DNS ASK mi###famous.net
- DNS ASK mi####entury.net
- DNS ASK ev####gcountry.net
- DNS ASK st####entury.net
- DNS ASK mi####ountry.net
- DNS ASK do####century.net
- DNS ASK st####ountry.net
- DNS ASK st###power.net
- DNS ASK mi###power.net
- DNS ASK de####famous.net
- DNS ASK pr####epower.net
- DNS ASK pr####efamous.net
- DNS ASK pr####ecentury.net
- DNS ASK de####century.net
- DNS ASK st####thcentury.net
- DNS ASK st####thfamous.net
- DNS ASK de####country.net
- DNS ASK de###epower.net
- DNS ASK pr####ecountry.net
- DNS ASK re####century.net
- DNS ASK br####famous.net
- DNS ASK br####century.net
- DNS ASK do###epower.net
- DNS ASK fe####country.net
- DNS ASK br####country.net
- DNS ASK re####country.net
- DNS ASK re###tpower.net
- DNS ASK re####famous.net
- DNS ASK br###npower.net
- DNS ASK bu####ngcountry.net
- DNS ASK de####soldier.net
- DNS ASK pr####eplease.net
- DNS ASK pr####esoldier.net
- DNS ASK pr####enation.net
- DNS ASK de####nation.net
- DNS ASK st####thnation.net
- DNS ASK st###nation.net
- DNS ASK de####condition.net
- DNS ASK de####please.net
- DNS ASK pr#####condition.net
- DNS ASK re####nation.net
- DNS ASK br####soldier.net
- DNS ASK br####nation.net
- DNS ASK fe####condition.net
- DNS ASK do####condition.net
- DNS ASK br####condition.net
- DNS ASK re####condition.net
- DNS ASK re####please.net
- DNS ASK re####soldier.net
- DNS ASK br####please.net
- DNS ASK ou####ecountry.net
- DNS ASK bu####ngcentury.net
- DNS ASK mo####ntcountry.net
- DNS ASK mo####ntpower.net
- DNS ASK ou####epower.net
- DNS ASK bu####ngpower.net
- DNS ASK ev####gpower.net
- DNS ASK ev####gfamous.net
- DNS ASK ev####gcentury.net
- DNS ASK bu####ngfamous.net
- DNS ASK st###please.net
- DNS ASK st#####hcondition.net
- DNS ASK st####thplease.net
- DNS ASK st####thsoldier.net
- DNS ASK st####oldier.net
- DNS ASK mo####ntfamous.net
- DNS ASK ou####efamous.net
- DNS ASK ou####ecentury.net
- DNS ASK st####ondition.net
- DNS ASK mo####ntcentury.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''