Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Performance PNRP Resource Telephony' = '<LS_APPDATA>\xgeyvemhc\vwgbgcsnvz.exe'
Malicious functions:
Creates and executes the following:
- <LS_APPDATA>\xgeyvemhc\jjvgzet.exe "<LS_APPDATA>\xgeyvemhc\vwgbgcsnvz.exe"
- <LS_APPDATA>\xgeyvemhc\vwgbgcsnvz.exe
Modifies file system :
Creates the following files:
- <LS_APPDATA>\xgeyvemhc\vwgbgcsnvz.rctv
- <LS_APPDATA>\xgeyvemhc\jjvgzet.exe
- <LS_APPDATA>\xgeyvemhc\vwgbgcsnvz.exe
Sets the 'hidden' attribute to the following files:
- <LS_APPDATA>\xgeyvemhc\jjvgzet.exe
- <LS_APPDATA>\xgeyvemhc\vwgbgcsnvz.exe
Network activity:
Connects to:
- 'ne####titops.com':80
- 'lo##and.com':80
- 'jo###ret.com':80
- 'he####pcazers.com':80
- 'bi##rat.com':80
- 'mo##het.com':80
- 'ma####olirst.com':80
- 'ha##end.com':80
- 'ma###dpa.com':80
- 'fe####lopazerns.com':80
- 'va##xer.com':80
- 'mi##af.com':80
- 'kl##tar.com':80
- 'na##ied.com':80
- 'be###ete.com':80
- 'de###dar.com':80
- 'ge####serops.com':80
- 'fo###red.com':80
- 'fi###lox.com':80
- 'da##tan.com':80
- 'ad##ino.com':80
- 'bi##de.com':80
- 'el##rot.com':80
- 'go##tar.com':80
- 'fa###erest.com':80
- 'ba##ro.com':80
- 'pa##dov.com':80
- 'op##red.com':80
- 'ha####pricezat.com':80
- 'pu###inacee.com':80
- 're##lt.com':80
- 'bu###osasrl.com':80
- 'ji####olipop.com':80
- 'el##tow.com':80
- 'ge####iroplop.com':80
- 'ek##dar.com':80
- 'me##xe.com':80
- 'sw####lserits.com':80
- 'ib##an.com':80
- 'gl###mec.com':80
- 'bu###oriso.com':80
- 'va##lt.com':80
- 'po##ric.com':80
TCP:
HTTP GET requests:
- ne####titops.com/forum/search.php?em############################
- lo##and.com/forum/search.php?em############################
- jo###ret.com/forum/search.php?em############################
- he####pcazers.com/forum/search.php?em############################
- bi##rat.com/forum/search.php?em############################
- mo##het.com/forum/search.php?em############################
- ma####olirst.com/forum/search.php?em############################
- ha##end.com/forum/search.php?em############################
- ma###dpa.com/forum/search.php?em############################
- fe####lopazerns.com/forum/search.php?em############################
- va##xer.com/forum/search.php?em############################
- mi##af.com/forum/search.php?em############################
- kl##tar.com/forum/search.php?em############################
- na##ied.com/forum/search.php?em############################
- be###ete.com/forum/search.php?em############################
- de###dar.com/forum/search.php?em############################
- ge####serops.com/forum/search.php?em############################
- fo###red.com/forum/search.php?em############################
- fi###lox.com/forum/search.php?em############################
- da##tan.com/forum/search.php?em############################
- ad##ino.com/forum/search.php?em############################
- bi##de.com/forum/search.php?em############################
- el##rot.com/forum/search.php?em############################
- go##tar.com/forum/search.php?em############################
- fa###erest.com/forum/search.php?em############################
- ba##ro.com/forum/search.php?em############################
- pa##dov.com/forum/search.php?em############################
- op##red.com/forum/search.php?em############################
- ha####pricezat.com/forum/search.php?em############################
- pu###inacee.com/forum/search.php?em############################
- re##lt.com/forum/search.php?em############################
- bu###osasrl.com/forum/search.php?em############################
- ji####olipop.com/forum/search.php?em############################
- el##tow.com/forum/search.php?em############################
- ge####iroplop.com/forum/search.php?em############################
- ek##dar.com/forum/search.php?em############################
- me##xe.com/forum/search.php?em############################
- sw####lserits.com/forum/search.php?em############################
- ib##an.com/forum/search.php?em############################
- gl###mec.com/forum/search.php?em############################
- bu###oriso.com/forum/search.php?em############################
- va##lt.com/forum/search.php?em############################
- po##ric.com/forum/search.php?em############################
UDP:
- DNS ASK ne####titops.com
- DNS ASK lo##and.com
- DNS ASK jo###ret.com
- DNS ASK he####pcazers.com
- DNS ASK bi##rat.com
- DNS ASK mo##het.com
- DNS ASK ma####olirst.com
- DNS ASK ha##end.com
- DNS ASK ma###dpa.com
- DNS ASK fe####lopazerns.com
- DNS ASK va##xer.com
- DNS ASK mi##af.com
- DNS ASK kl##tar.com
- DNS ASK na##ied.com
- DNS ASK be###ete.com
- DNS ASK de###dar.com
- DNS ASK ge####serops.com
- DNS ASK fo###red.com
- DNS ASK fi###lox.com
- DNS ASK da##tan.com
- DNS ASK ad##ino.com
- DNS ASK bi##de.com
- DNS ASK el##rot.com
- DNS ASK go##tar.com
- DNS ASK fa###erest.com
- DNS ASK ba##ro.com
- DNS ASK pa##dov.com
- DNS ASK op##red.com
- DNS ASK ha####pricezat.com
- DNS ASK pu###inacee.com
- DNS ASK re##lt.com
- DNS ASK bu###osasrl.com
- DNS ASK ji####olipop.com
- DNS ASK el##tow.com
- DNS ASK ge####iroplop.com
- DNS ASK ek##dar.com
- DNS ASK me##xe.com
- DNS ASK sw####lserits.com
- DNS ASK ib##an.com
- DNS ASK gl###mec.com
- DNS ASK bu###oriso.com
- DNS ASK va##lt.com
- DNS ASK po##ric.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''