Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CardSpace Encryption PnP-X DNS Browser' = 'C:\iaczddzbkjoxx\mmnzqlmsp.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\TP Auto-Discovery Accounts Audio] 'ImagePath' = 'C:\iaczddzbkjoxx\mmnzqlmsp.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\TP Auto-Discovery Accounts Audio] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\iaczddzbkjoxx\bezbbcfofr.exe' "c:\iaczddzbkjoxx\mmnzqlmsp.exe"
- 'C:\iaczddzbkjoxx\mmnzqlmsp.exe'
- 'C:\iaczddzbkjoxx\ba2us3ltqkoya43.exe'
Modifies file system:
Creates the following files:
- C:\iaczddzbkjoxx\mmnzqlmsp.exe
- C:\iaczddzbkjoxx\bezbbcfofr.exe
- C:\iaczddzbkjoxx\vbdjmw
- %WINDIR%\iaczddzbkjoxx\rmyqeiycrro5
- C:\iaczddzbkjoxx\rmyqeiycrro5
- C:\iaczddzbkjoxx\ba2us3ltqkoya43.exe
Sets the 'hidden' attribute to the following files:
- C:\iaczddzbkjoxx\bezbbcfofr.exe
- C:\iaczddzbkjoxx\mmnzqlmsp.exe
Deletes the following files:
- C:\iaczddzbkjoxx\ba2us3ltqkoya43.exe
- %WINDIR%\iaczddzbkjoxx\rmyqeiycrro5
Network activity:
Connects to:
- 're####erindeed.net':80
- 'wo###indeed.net':80
- 're####ernotice.net':80
- 'jo####yclear.net':80
- 're####erduring.net':80
- 'wo###during.net':80
- 'in####seduring.net':80
- 'fo####during.net':80
- 'in####seindeed.net':80
- 'wo###notice.net':80
- 're####erlength.net':80
- 'wo###length.net':80
- 'hu####dclear.net':80
- 'de####ygeneral.net':80
- 'li###eclear.net':80
- 'de####yclear.net':80
- 'li####include.net':80
- 'de####yinclude.net':80
- 'li####general.net':80
- 'jo####yinclude.net':80
- 'hu####dgeneral.net':80
- 'jo####ygeneral.net':80
- 'hu####dnorth.net':80
- 'jo####ynorth.net':80
- 'hu####dinclude.net':80
- 'fo####indeed.net':80
- 'su####notice.net':80
- 'wi####notice.net':80
- 'su####length.net':80
- 'wi####during.net':80
- 'su####indeed.net':80
- 'wi####indeed.net':80
- 'th###indeed.net':80
- 'ch###indeed.net':80
- 'th###notice.net':80
- 'wi####length.net':80
- 'th###during.net':80
- 'ch###during.net':80
- 'su####during.net':80
- 'fo####length.net':80
- 'th####hduring.net':80
- 'ef####during.net':80
- 'in####senotice.net':80
- 'fo####notice.net':80
- 'in####selength.net':80
- 'ef####notice.net':80
- 'th####hlength.net':80
- 'ef####length.net':80
- 'th####hindeed.net':80
- 'ef####indeed.net':80
- 'th####hnotice.net':80
TCP:
HTTP GET requests:
- http://re####erindeed.net/index.php?me########
- http://wo###indeed.net/index.php?me########
- http://re####ernotice.net/index.php?me########
- http://jo####yclear.net/index.php?me########
- http://re####erduring.net/index.php?me########
- http://wo###during.net/index.php?me########
- http://in####seduring.net/index.php?me########
- http://fo####during.net/index.php?me########
- http://in####seindeed.net/index.php?me########
- http://wo###notice.net/index.php?me########
- http://re####erlength.net/index.php?me########
- http://wo###length.net/index.php?me########
- http://hu####dclear.net/index.php?me########
- http://de####ygeneral.net/index.php?me########
- http://li###eclear.net/index.php?me########
- http://de####yclear.net/index.php?me########
- http://li####include.net/index.php?me########
- http://de####yinclude.net/index.php?me########
- http://li####general.net/index.php?me########
- http://jo####yinclude.net/index.php?me########
- http://hu####dgeneral.net/index.php?me########
- http://jo####ygeneral.net/index.php?me########
- http://hu####dnorth.net/index.php?me########
- http://jo####ynorth.net/index.php?me########
- http://hu####dinclude.net/index.php?me########
- http://fo####indeed.net/index.php?me########
- http://su####notice.net/index.php?me########
- http://wi####notice.net/index.php?me########
- http://su####length.net/index.php?me########
- http://wi####during.net/index.php?me########
- http://su####indeed.net/index.php?me########
- http://wi####indeed.net/index.php?me########
- http://th###indeed.net/index.php?me########
- http://ch###indeed.net/index.php?me########
- http://th###notice.net/index.php?me########
- http://wi####length.net/index.php?me########
- http://th###during.net/index.php?me########
- http://ch###during.net/index.php?me########
- http://su####during.net/index.php?me########
- http://fo####length.net/index.php?me########
- http://th####hduring.net/index.php?me########
- http://ef####during.net/index.php?me########
- http://in####senotice.net/index.php?me########
- http://fo####notice.net/index.php?me########
- http://in####selength.net/index.php?me########
- http://ef####notice.net/index.php?me########
- http://th####hlength.net/index.php?me########
- http://ef####length.net/index.php?me########
- http://th####hindeed.net/index.php?me########
- http://ef####indeed.net/index.php?me########
- http://th####hnotice.net/index.php?me########
UDP:
- DNS ASK wo###during.net
- DNS ASK re####erindeed.net
- DNS ASK wo###indeed.net
- DNS ASK hu####dclear.net
- DNS ASK jo####yclear.net
- DNS ASK re####erduring.net
- DNS ASK re####ernotice.net
- DNS ASK in####seduring.net
- DNS ASK fo####during.net
- DNS ASK in####seindeed.net
- DNS ASK wo###notice.net
- DNS ASK re####erlength.net
- DNS ASK wo###length.net
- DNS ASK li####general.net
- DNS ASK de####ygeneral.net
- DNS ASK li###eclear.net
- DNS ASK de####ynorth.net
- DNS ASK li####include.net
- DNS ASK de####yinclude.net
- DNS ASK de####yclear.net
- DNS ASK jo####yinclude.net
- DNS ASK hu####dgeneral.net
- DNS ASK jo####ygeneral.net
- DNS ASK hu####dnorth.net
- DNS ASK jo####ynorth.net
- DNS ASK hu####dinclude.net
- DNS ASK wi####indeed.net
- DNS ASK su####notice.net
- DNS ASK wi####notice.net
- DNS ASK su####during.net
- DNS ASK wi####during.net
- DNS ASK su####indeed.net
- DNS ASK su####length.net
- DNS ASK th###indeed.net
- DNS ASK ch###indeed.net
- DNS ASK th###notice.net
- DNS ASK wi####length.net
- DNS ASK th###during.net
- DNS ASK ch###during.net
- DNS ASK in####selength.net
- DNS ASK fo####length.net
- DNS ASK th####hduring.net
- DNS ASK fo####indeed.net
- DNS ASK in####senotice.net
- DNS ASK fo####notice.net
- DNS ASK ef####during.net
- DNS ASK ef####notice.net
- DNS ASK th####hlength.net
- DNS ASK ef####length.net
- DNS ASK th####hindeed.net
- DNS ASK ef####indeed.net
- DNS ASK th####hnotice.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
