Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Brightness Extensible Shell WLAN Hardware' = '<SYSTEM32>\xgmjmrvzrqsw.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Certificate Encryption Windows Time] 'ImagePath' = '<SYSTEM32>\xgmjmrvzrqsw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Certificate Encryption Windows Time] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Executes the following:
- '<SYSTEM32>\qsogqkknk.exe' "<SYSTEM32>\xgmjmrvzrqsw.exe"
- '%WINDIR%\Temp\ozc23zim3thob2zdgzp.exe' -r 31282 tcp
- '%TEMP%\ozc23zimcqbgwpzdgzpxlrabmu9.exe'
- '<SYSTEM32>\xgmjmrvzrqsw.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\lnatnidyzwmfnx\run
- <SYSTEM32>\lnatnidyzwmfnx\rng
- %WINDIR%\Temp\ozc23zim3thob2zdgzp.exe
- <SYSTEM32>\lnatnidyzwmfnx\cfg
- %TEMP%\ozc23zimcqbgwpzdgzpxlrabmu9.exe
- <SYSTEM32>\lnatnidyzwmfnx\tst
- <SYSTEM32>\qsogqkknk.exe
- <SYSTEM32>\xgmjmrvzrqsw.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\qsogqkknk.exe
- <SYSTEM32>\xgmjmrvzrqsw.exe
Deletes the following files:
- %WINDIR%\Temp\ozc23zim3thob2zdgzp.exe
- %TEMP%\ozc23zimcqbgwpzdgzpxlrabmu9.exe
Network activity:
Connects to:
- 'lo###aste.net':80
- 'fe###ives.net':80
- 'lo###ives.net':80
- 'th###earth.ru':80
- 'th###earth.net':80
- 'th###taste.net':80
- 'lo###llow.net':80
- 'ri###nstorm.net':80
- '18#.#06.120.168':80
- '18#.#17.73.77':80
- 'lo###llow.ru':80
- 'fe###llow.net':80
- 'lo####thepings.ru':80
TCP:
HTTP GET requests:
- http://lo###aste.net/index.php
- http://fe###ives.net/index.php
- http://lo###ives.net/index.php
- http://th###earth.ru/index.php
- http://th###earth.net/index.php
- http://th###taste.net/index.php
- http://lo###llow.net/index.php
- http://ri###nstorm.net/index.php
- http://18#.#06.120.168/index.php
- http://18#.#17.73.77/index.php
- http://lo###llow.ru/index.php
- http://fe###llow.net/index.php
- http://lo####thepings.ru/index.php
UDP:
- DNS ASK fe###eal.net
- DNS ASK lo###oll.net
- DNS ASK fe###oll.net
- DNS ASK lo##deal.ru
- DNS ASK th###build.net
- DNS ASK th###iron.net
- DNS ASK lo###eal.net
- DNS ASK fe###ron.net
- DNS ASK wh###eal.net
- DNS ASK hi###eal.net
- DNS ASK fe###uild.ru
- DNS ASK lo###uild.net
- DNS ASK fe###uild.net
- DNS ASK lo###ron.net
- DNS ASK dr###roll.net
- DNS ASK wi###oll.net
- DNS ASK dr###build.net
- DNS ASK dr###deal.ru
- DNS ASK dr###deal.net
- DNS ASK wi###eal.net
- DNS ASK kn###hoe.net
- DNS ASK th###deal.net
- DNS ASK th###roll.net
- DNS ASK th###roll.ru
- DNS ASK dr###iron.net
- DNS ASK wi###uild.net
- DNS ASK wi###ron.net
- DNS ASK wi##iron.ru
- DNS ASK wh##roll.ru
- DNS ASK ro##deal.ru
- DNS ASK si###oll.net
- DNS ASK ro###oll.net
- DNS ASK ro###eal.net
- DNS ASK mo###uild.net
- DNS ASK mo###ron.net
- DNS ASK si###eal.net
- DNS ASK ro###ron.net
- DNS ASK so###eal.net
- DNS ASK th####ctober.net
- DNS ASK si##iron.ru
- DNS ASK si###uild.net
- DNS ASK ro###uild.net
- DNS ASK si###ron.net
- DNS ASK wh###ron.net
- DNS ASK hi###ron.net
- DNS ASK hi##iron.ru
- DNS ASK hi###uild.net
- DNS ASK wh###oll.net
- DNS ASK hi###oll.net
- DNS ASK wh###uild.net
- DNS ASK ju###uild.net
- DNS ASK ju###uild.ru
- DNS ASK ju###ron.net
- DNS ASK mo###oll.net
- DNS ASK ju###eal.net
- DNS ASK mo###eal.net
- DNS ASK ju###oll.net
- DNS ASK ab###hoe.net
- DNS ASK hi###hoe.net
- DNS ASK wh###hoe.net
- DNS ASK wh##shoe.ru
- DNS ASK hi###ctober.net
- DNS ASK wh###oon.net
- DNS ASK hi###oon.net
- DNS ASK wh###ctober.net
- DNS ASK mo###oon.net
- DNS ASK mo##moon.ru
- DNS ASK mo###ctober.net
- DNS ASK ju###ctober.net
- DNS ASK ju###uter.net
- DNS ASK ju###oon.net
- DNS ASK mo###uter.net
- DNS ASK lo###oon.net
- DNS ASK lo###ctober.net
- DNS ASK fe###oon.net
- DNS ASK fe###uter.net
- DNS ASK th###shoe.net
- DNS ASK th###shoe.ru
- DNS ASK lo###uter.net
- DNS ASK wh###uter.net
- DNS ASK hi###uter.net
- DNS ASK hi###uter.ru
- DNS ASK fe###hoe.net
- DNS ASK lo###ctober.ru
- DNS ASK fe###ctober.net
- DNS ASK lo###hoe.net
- DNS ASK ju###hoe.net
- DNS ASK so###hoe.net
- DNS ASK pi###hoe.net
- DNS ASK pi##shoe.ru
- DNS ASK so###ctober.net
- DNS ASK so##moon.ru
- DNS ASK pi###oon.net
- DNS ASK pi###ctober.net
- DNS ASK ab###ctober.net
- DNS ASK ab###ctober.ru
- DNS ASK kn###ctober.net
- DNS ASK kn###oon.net
- DNS ASK ab###uter.net
- DNS ASK kn###uter.net
- DNS ASK ab###oon.net
- DNS ASK si###oon.net
- DNS ASK ro###oon.net
- DNS ASK si###ctober.net
- DNS ASK ro###uter.net
- DNS ASK mo###hoe.net
- DNS ASK si###uter.net
- DNS ASK si###uter.ru
- DNS ASK so###uter.net
- DNS ASK pi###uter.net
- DNS ASK so###oon.net
- DNS ASK ro###hoe.net
- DNS ASK ro###ctober.net
- DNS ASK ro###ctober.ru
- DNS ASK si###hoe.net
- DNS ASK kn###ome.net
- DNS ASK dr###gives.net
- DNS ASK wi###ives.net
- DNS ASK ab###ook.net
- DNS ASK pi###erve.net
- DNS ASK so###ome.net
- DNS ASK kn###eight.net
- DNS ASK pi###eight.net
- DNS ASK pi###ook.net
- DNS ASK kn###erve.ru
- DNS ASK pi###ome.net
- DNS ASK so##took.ru
- DNS ASK so###ook.net
- DNS ASK ab###ome.net
- DNS ASK ro###erve.net
- DNS ASK si###ome.net
- DNS ASK si##come.ru
- DNS ASK si###erve.net
- DNS ASK mo##took.ru
- DNS ASK ju###eight.net
- DNS ASK mo###eight.net
- DNS ASK ro###eight.net
- DNS ASK ro###eight.ru
- DNS ASK so###erve.net
- DNS ASK si###eight.net
- DNS ASK ro###ome.net
- DNS ASK si###ook.net
- DNS ASK ro###ook.net
- DNS ASK so###eight.net
- DNS ASK th###taste.net
- DNS ASK lo###aste.net
- DNS ASK fe###ives.net
- DNS ASK th###earth.net
- DNS ASK wi###arth.net
- DNS ASK lo###arth.net
- DNS ASK th###earth.ru
- DNS ASK lo####thepings.ru
- DNS ASK ri###nstorm.net
- DNS ASK pi###eal.net
- DNS ASK fe###llow.net
- DNS ASK lo###ives.net
- DNS ASK lo###llow.net
- DNS ASK lo###llow.ru
- DNS ASK ab###erve.net
- DNS ASK dr###earth.net
- DNS ASK ab###eight.ru
- DNS ASK wi###llow.net
- DNS ASK ab###eight.net
- DNS ASK kn###ook.net
- DNS ASK dr###allow.net
- DNS ASK dr###taste.net
- DNS ASK wi###aste.net
- DNS ASK kn###erve.net
- DNS ASK lo###ives.ru
- DNS ASK th###allow.net
- DNS ASK th###gives.net
- DNS ASK dr###allow.ru
- DNS ASK mo###ook.net
- DNS ASK dr###nerve.net
- DNS ASK wi###ome.net
- DNS ASK dr###come.net
- DNS ASK wi###erve.net
- DNS ASK kn###uild.ru
- DNS ASK ab###ron.net
- DNS ASK kn###ron.net
- DNS ASK wi###eight.net
- DNS ASK dr###weight.ru
- DNS ASK th###nerve.net
- DNS ASK dr###weight.net
- DNS ASK wi##come.ru
- DNS ASK dr###took.net
- DNS ASK wi###ook.net
- DNS ASK pi###uild.net
- DNS ASK pi###ron.net
- DNS ASK so###ron.net
- DNS ASK so###uild.net
- DNS ASK so###oll.net
- DNS ASK pi###oll.net
- DNS ASK pi##roll.ru
- DNS ASK kn###oll.net
- DNS ASK kn###uild.net
- DNS ASK ab###uild.net
- DNS ASK ab###oll.net
- DNS ASK ab###eal.net
- DNS ASK ab##deal.ru
- DNS ASK kn###eal.net
- DNS ASK th###come.net
- DNS ASK wh###ook.net
- DNS ASK hi###ook.net
- DNS ASK wh###eight.net
- DNS ASK hi##come.ru
- DNS ASK hi###erve.net
- DNS ASK wh###ome.net
- DNS ASK hi###ome.net
- DNS ASK ju###ome.net
- DNS ASK mo###ome.net
- DNS ASK ju###ook.net
- DNS ASK mo###erve.net
- DNS ASK ju###erve.net
- DNS ASK hi###eight.net
- DNS ASK ju###erve.ru
- DNS ASK fe###erve.net
- DNS ASK fe###erve.ru
- DNS ASK lo###ome.net
- DNS ASK lo###erve.net
- DNS ASK lo##took.ru
- DNS ASK th###took.net
- DNS ASK th###weight.net
- DNS ASK lo###eight.ru
- DNS ASK fe###eight.net
- DNS ASK wh###erve.net
- DNS ASK lo###eight.net
- DNS ASK fe###ome.net
- DNS ASK lo###ook.net
- DNS ASK fe###ook.net
- '23#.#55.255.250':1900