Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Endpoint Play Proxy SNMP Power Protection RPC' = '<SYSTEM32>\qwyjfsz.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Server Secure Connectivity Themes Sharing] 'ImagePath' = '<SYSTEM32>\qwyjfsz.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Server Secure Connectivity Themes Sharing] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Executes the following:
- '<SYSTEM32>\xgmzyjxae.exe' "<SYSTEM32>\qwyjfsz.exe"
- '%WINDIR%\Temp\cza4xtzxiprbzjcwn.exe' -r 20796 tcp
- '%TEMP%\cza4xtzxrci2vlcwnylleglyv.exe'
- '<SYSTEM32>\qwyjfsz.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\krfsmlpuxe\run
- <SYSTEM32>\krfsmlpuxe\rng
- %WINDIR%\Temp\cza4xtzxiprbzjcwn.exe
- <SYSTEM32>\krfsmlpuxe\cfg
- %TEMP%\cza4xtzxrci2vlcwnylleglyv.exe
- <SYSTEM32>\krfsmlpuxe\tst
- <SYSTEM32>\xgmzyjxae.exe
- <SYSTEM32>\qwyjfsz.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\xgmzyjxae.exe
- <SYSTEM32>\qwyjfsz.exe
Deletes the following files:
- %WINDIR%\Temp\cza4xtzxiprbzjcwn.exe
- %TEMP%\cza4xtzxrci2vlcwnylleglyv.exe
Network activity:
Connects to:
- 'le###ule.net':80
- 'ta###hear.ru':80
- 'ta###hear.net':80
- 'ta###hunt.net':80
- 'ca###ule.net':80
- 'le###how.net':80
- 'le##show.ru':80
- 'le###ear.net':80
- 'ri###nstorm.net':80
- '18#.#06.120.168':80
- '18#.#17.73.77':80
- 'lo####thepings.ru':80
- 'po###show.net':80
- 'le###unt.net':80
- 'ta###rule.net':80
TCP:
HTTP GET requests:
- http://le###ule.net/index.php
- http://ta###hear.ru/index.php
- http://ta###hear.net/index.php
- http://ta###hunt.net/index.php
- http://ca###ule.net/index.php
- http://le###how.net/index.php
- http://le##show.ru/index.php
- http://le###ear.net/index.php
- http://ri###nstorm.net/index.php
- http://18#.#06.120.168/index.php
- http://18#.#17.73.77/index.php
- http://lo####thepings.ru/index.php
- http://po###show.net/index.php
- http://le###unt.net/index.php
- http://ta###rule.net/index.php
UDP:
- DNS ASK le###orse.net
- DNS ASK ta###horse.net
- DNS ASK le###ctover.net
- DNS ASK ca###orld.net
- DNS ASK po###world.net
- DNS ASK po###world.ru
- DNS ASK ta####ctover.net
- DNS ASK le###orld.net
- DNS ASK ta###world.net
- DNS ASK we###orse.net
- DNS ASK le###njoy.net
- DNS ASK le###njoy.ru
- DNS ASK ta###enjoy.net
- DNS ASK po###enjoy.net
- DNS ASK no###ctover.net
- DNS ASK no###njoy.net
- DNS ASK no###njoy.ru
- DNS ASK we###ctover.ru
- DNS ASK li###orse.ru
- DNS ASK no###orse.net
- DNS ASK no###orld.net
- DNS ASK ca###ctover.ru
- DNS ASK po####ctover.net
- DNS ASK ca###njoy.net
- DNS ASK ca###orse.net
- DNS ASK po###horse.net
- DNS ASK ca###ctover.net
- DNS ASK fe###orse.net
- DNS ASK fi###horse.net
- DNS ASK fi###horse.ru
- DNS ASK so###horse.net
- DNS ASK th###enjoy.net
- DNS ASK li###orld.net
- DNS ASK th###world.net
- DNS ASK fi####ctover.net
- DNS ASK so###enjoy.ru
- DNS ASK fi###world.net
- DNS ASK to###uess.net
- DNS ASK so####ctover.net
- DNS ASK fi###enjoy.net
- DNS ASK so###enjoy.net
- DNS ASK li###njoy.net
- DNS ASK we###njoy.net
- DNS ASK we###orld.net
- DNS ASK fe###njoy.net
- DNS ASK fe###orse.ru
- DNS ASK we###ctover.net
- DNS ASK fe###ctover.net
- DNS ASK we###orld.ru
- DNS ASK li###ctover.net
- DNS ASK th####ctover.net
- DNS ASK th###octover.ru
- DNS ASK fe###orld.net
- DNS ASK li###orse.net
- DNS ASK th###horse.net
- DNS ASK ri###orld.net
- DNS ASK fi###uess.net
- DNS ASK fi###uess.ru
- DNS ASK pl###guess.net
- DNS ASK se###kill.net
- DNS ASK le###stood.net
- DNS ASK se###stood.net
- DNS ASK fi###irst.net
- DNS ASK pl###kill.ru
- DNS ASK fi###tood.net
- DNS ASK pl###stood.net
- DNS ASK pl###first.net
- DNS ASK fi###ill.net
- DNS ASK pl###kill.net
- DNS ASK le###kill.net
- DNS ASK fa###ill.net
- DNS ASK to###ill.net
- DNS ASK fa###tood.net
- DNS ASK to###uess.ru
- DNS ASK fa###irst.net
- DNS ASK to###irst.net
- DNS ASK fa###tood.ru
- DNS ASK le###first.net
- DNS ASK se###first.net
- DNS ASK se###first.ru
- DNS ASK to###tood.net
- DNS ASK le###guess.net
- DNS ASK se###guess.net
- DNS ASK vi###uess.net
- DNS ASK tr###stood.net
- DNS ASK fa###horse.net
- DNS ASK ri###orse.net
- DNS ASK yo##kill.ru
- DNS ASK tr###kill.net
- DNS ASK yo###tood.net
- DNS ASK ri###orse.ru
- DNS ASK ri###njoy.net
- DNS ASK fa###world.net
- DNS ASK fa###world.ru
- DNS ASK fa####ctover.net
- DNS ASK ri###ctover.net
- DNS ASK fa###enjoy.net
- DNS ASK yo###ill.net
- DNS ASK lr###first.net
- DNS ASK vi###ill.net
- DNS ASK lr###kill.net
- DNS ASK lr###guess.net
- DNS ASK vi###irst.net
- DNS ASK vi###irst.ru
- DNS ASK vi###tood.net
- DNS ASK tr###guess.net
- DNS ASK yo###irst.net
- DNS ASK tr###first.net
- DNS ASK lr###stood.net
- DNS ASK lr###stood.ru
- DNS ASK yo###uess.net
- DNS ASK we###ule.net
- DNS ASK po###hunt.net
- DNS ASK we###ear.net
- DNS ASK fa###hunt.net
- DNS ASK li###how.net
- DNS ASK ri###unt.net
- DNS ASK ca##hunt.ru
- DNS ASK li##rule.ru
- DNS ASK fa###show.net
- DNS ASK ca###how.net
- DNS ASK li###unt.net
- DNS ASK we###unt.net
- DNS ASK no###unt.net
- DNS ASK ri##rule.ru
- DNS ASK so###feed.net
- DNS ASK fi###monday.net
- DNS ASK so###monday.net
- DNS ASK so###lend.net
- DNS ASK so###lend.ru
- DNS ASK fi###feed.net
- DNS ASK fi###under.net
- DNS ASK ri###ear.net
- DNS ASK fa###rule.net
- DNS ASK ri###ule.net
- DNS ASK fi###under.ru
- DNS ASK so###under.net
- DNS ASK fa###hear.net
- DNS ASK li###ule.net
- DNS ASK le###ule.net
- DNS ASK ta###hear.ru
- DNS ASK ta###hear.net
- DNS ASK le###how.net
- DNS ASK le##show.ru
- DNS ASK ta###hunt.net
- DNS ASK po###show.net
- DNS ASK lo####thepings.ru
- DNS ASK ri###nstorm.net
- DNS ASK so###world.net
- DNS ASK le###ear.net
- DNS ASK le###unt.net
- DNS ASK ta###rule.net
- DNS ASK ca###ule.net
- DNS ASK ca###unt.net
- DNS ASK we###how.net
- DNS ASK no##show.ru
- DNS ASK no###ule.net
- DNS ASK no###ear.net
- DNS ASK li###ear.net
- DNS ASK po###rule.net
- DNS ASK po###hear.net
- DNS ASK we##hunt.ru
- DNS ASK no##hear.ru
- DNS ASK no###how.net
- DNS ASK ca###ear.net
- DNS ASK ri###how.net
- DNS ASK fi###lend.net
- DNS ASK ca###end.net
- DNS ASK po###lend.net
- DNS ASK ca###eed.net
- DNS ASK no###onday.net
- DNS ASK li###nder.ru
- DNS ASK no###nder.net
- DNS ASK po###feed.net
- DNS ASK ca###nder.net
- DNS ASK po###under.net
- DNS ASK le###end.net
- DNS ASK po###feed.ru
- DNS ASK ca###onday.net
- DNS ASK po###monday.net
- DNS ASK no###eed.net
- DNS ASK fa###feed.ru
- DNS ASK ri###eed.net
- DNS ASK fa###monday.net
- DNS ASK fa###lend.net
- DNS ASK ri###end.net
- DNS ASK fa###feed.net
- DNS ASK ri###onday.net
- DNS ASK no###onday.ru
- DNS ASK no###end.net
- DNS ASK no##lend.ru
- DNS ASK fa###under.net
- DNS ASK ri###nder.net
- DNS ASK ri###nder.ru
- DNS ASK le##lend.ru
- DNS ASK fe###nder.ru
- DNS ASK li###end.net
- DNS ASK th###lend.net
- DNS ASK fe###onday.net
- DNS ASK we###nder.net
- DNS ASK fe###nder.net
- DNS ASK li###eed.net
- DNS ASK th###monday.net
- DNS ASK li###nder.net
- DNS ASK th###under.net
- DNS ASK th###feed.net
- DNS ASK li###onday.net
- DNS ASK li###onday.ru
- DNS ASK we###onday.net
- DNS ASK le###onday.net
- DNS ASK ta###monday.net
- DNS ASK ta###monday.ru
- DNS ASK ta###lend.net
- DNS ASK le###eed.net
- DNS ASK ta###feed.net
- DNS ASK le###nder.net
- DNS ASK we###eed.net
- DNS ASK we##feed.ru
- DNS ASK fe###eed.net
- DNS ASK ta###under.net
- DNS ASK we###end.net
- DNS ASK fe###end.net
- '23#.#55.255.250':1900