Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows DNS SPP Ordering User-mode Smart' = 'C:\mfgbpz8lxsv\iyypmfdwmr8c.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Class Location Resource Engine Firewall Net.Tcp] 'ImagePath' = 'C:\mfgbpz8lxsv\iyypmfdwmr8c.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Class Location Resource Engine Firewall Net.Tcp] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\mfgbpz8lxsv\tp0nmtnfbq.exe' "c:\mfgbpz8lxsv\iyypmfdwmr8c.exe"
- 'C:\mfgbpz8lxsv\iyypmfdwmr8c.exe'
- 'C:\mfgbpz8lxsv\y5wflusn2ql1lbh6xozg.exe'
Modifies file system:
Creates the following files:
- C:\mfgbpz8lxsv\iyypmfdwmr8c.exe
- C:\mfgbpz8lxsv\tp0nmtnfbq.exe
- C:\mfgbpz8lxsv\uzkcshxpm
- %WINDIR%\mfgbpz8lxsv\ziexlz
- C:\mfgbpz8lxsv\ziexlz
- C:\mfgbpz8lxsv\y5wflusn2ql1lbh6xozg.exe
Sets the 'hidden' attribute to the following files:
- C:\mfgbpz8lxsv\tp0nmtnfbq.exe
- C:\mfgbpz8lxsv\iyypmfdwmr8c.exe
Deletes the following files:
- C:\mfgbpz8lxsv\y5wflusn2ql1lbh6xozg.exe
- %WINDIR%\mfgbpz8lxsv\ziexlz
Network activity:
Connects to:
- 'ma######antollemache.net':80
- 'ki######edwerryhouse.net':80
- 'ma######andwerryhouse.net':80
- 'ki######ewitherspoon.net':80
- 'ma######anwitherspoon.net':80
- 'ki#####eetollemache.net':80
- 'ca#####raauttenberg.net':80
- 'ca#####ratollemache.net':80
- 'kr######ertollemache.net':80
- 'ca######adwerryhouse.net':80
- 'kr######erauttenberg.net':80
- 'ca######awitherspoon.net':80
- 'kr######erwitherspoon.net':80
- 'ma######edwerryhouse.net':80
- 'an######edwerryhouse.net':80
- 'ca#####neauttenberg.net':80
- 'an######ewitherspoon.net':80
- 'ma#####netollemache.net':80
- 'an#####tetollemache.net':80
- 'ca#####naauttenberg.net':80
- 'ca######edwerryhouse.net':80
- 'ki#####eeauttenberg.net':80
- 'ma######anauttenberg.net':80
- 'ca######ewitherspoon.net':80
- 'ca#####netollemache.net':80
- 'ca#####natollemache.net':80
- 'kr######erdwerryhouse.net':80
- 'gl#####lemerrickson.net':80
- 'ki#####ynmerrickson.net':80
- 'gl######echristophers.net':80
- 'je#####nehuddleston.net':80
- 'ge######emiddlesworth.net':80
- 'je######emiddlesworth.net':80
- 'ki######nchristophers.net':80
- 'ki######nmiddlesworth.net':80
- 'st#####iemerrickson.net':80
- 'ch#####temerrickson.net':80
- 'gl#####lehuddleston.net':80
- 'ki#####ynhuddleston.net':80
- 'gl######emiddlesworth.net':80
- 'ze######hchristophers.net':80
- 'ma#####kehuddleston.net':80
- 'ze#####ahhuddleston.net':80
- 'ma#####kemerrickson.net':80
- 'ze#####ahmerrickson.net':80
- 'ma######echristophers.net':80
- 'ma######emiddlesworth.net':80
- 'ge######echristophers.net':80
- 'je######echristophers.net':80
- 'ge#####vehuddleston.net':80
- 'ze######hmiddlesworth.net':80
- 'ge#####vemerrickson.net':80
- 'je#####nemerrickson.net':80
TCP:
HTTP GET requests:
- http://ma######antollemache.net/index.php
- http://ki######edwerryhouse.net/index.php
- http://ma######andwerryhouse.net/index.php
- http://ki######ewitherspoon.net/index.php
- http://ma######anwitherspoon.net/index.php
- http://ki#####eetollemache.net/index.php
- http://ca#####raauttenberg.net/index.php
- http://ca#####ratollemache.net/index.php
- http://kr######ertollemache.net/index.php
- http://ca######adwerryhouse.net/index.php
- http://kr######erauttenberg.net/index.php
- http://ca######awitherspoon.net/index.php
- http://kr######erwitherspoon.net/index.php
- http://ma######edwerryhouse.net/index.php
- http://an######edwerryhouse.net/index.php
- http://ca#####neauttenberg.net/index.php
- http://an######ewitherspoon.net/index.php
- http://ma#####netollemache.net/index.php
- http://an#####tetollemache.net/index.php
- http://ca#####naauttenberg.net/index.php
- http://ca######edwerryhouse.net/index.php
- http://ki#####eeauttenberg.net/index.php
- http://ma######anauttenberg.net/index.php
- http://ca######ewitherspoon.net/index.php
- http://ca#####netollemache.net/index.php
- http://ca#####natollemache.net/index.php
- http://kr######erdwerryhouse.net/index.php
- http://gl#####lemerrickson.net/index.php
- http://ki#####ynmerrickson.net/index.php
- http://gl######echristophers.net/index.php
- http://je#####nehuddleston.net/index.php
- http://ge######emiddlesworth.net/index.php
- http://je######emiddlesworth.net/index.php
- http://ki######nchristophers.net/index.php
- http://ki######nmiddlesworth.net/index.php
- http://st#####iemerrickson.net/index.php
- http://ch#####temerrickson.net/index.php
- http://gl#####lehuddleston.net/index.php
- http://ki#####ynhuddleston.net/index.php
- http://gl######emiddlesworth.net/index.php
- http://ze######hchristophers.net/index.php
- http://ma#####kehuddleston.net/index.php
- http://ze#####ahhuddleston.net/index.php
- http://ma#####kemerrickson.net/index.php
- http://ze#####ahmerrickson.net/index.php
- http://ma######echristophers.net/index.php
- http://ma######emiddlesworth.net/index.php
- http://ge######echristophers.net/index.php
- http://je######echristophers.net/index.php
- http://ge#####vehuddleston.net/index.php
- http://ze######hmiddlesworth.net/index.php
- http://ge#####vemerrickson.net/index.php
- http://je#####nemerrickson.net/index.php
UDP:
- DNS ASK ma######antollemache.net
- DNS ASK ki######edwerryhouse.net
- DNS ASK ma######andwerryhouse.net
- DNS ASK ki######ewitherspoon.net
- DNS ASK ma######anwitherspoon.net
- DNS ASK ki#####eetollemache.net
- DNS ASK ca#####raauttenberg.net
- DNS ASK ca#####ratollemache.net
- DNS ASK kr######ertollemache.net
- DNS ASK ca######adwerryhouse.net
- DNS ASK kr######erauttenberg.net
- DNS ASK ca######awitherspoon.net
- DNS ASK kr######erwitherspoon.net
- DNS ASK ma######anauttenberg.net
- DNS ASK an#####tetollemache.net
- DNS ASK ma######edwerryhouse.net
- DNS ASK an######edwerryhouse.net
- DNS ASK ma######ewitherspoon.net
- DNS ASK an######ewitherspoon.net
- DNS ASK ma#####netollemache.net
- DNS ASK ca#####neauttenberg.net
- DNS ASK ca#####natollemache.net
- DNS ASK ca######edwerryhouse.net
- DNS ASK ki#####eeauttenberg.net
- DNS ASK ca#####naauttenberg.net
- DNS ASK ca######ewitherspoon.net
- DNS ASK ca#####netollemache.net
- DNS ASK gl#####lemerrickson.net
- DNS ASK ki#####ynmerrickson.net
- DNS ASK gl######echristophers.net
- DNS ASK je#####nehuddleston.net
- DNS ASK ge######emiddlesworth.net
- DNS ASK je######emiddlesworth.net
- DNS ASK ki######nchristophers.net
- DNS ASK ki######nmiddlesworth.net
- DNS ASK st#####iemerrickson.net
- DNS ASK ch#####temerrickson.net
- DNS ASK gl#####lehuddleston.net
- DNS ASK ki#####ynhuddleston.net
- DNS ASK gl######emiddlesworth.net
- DNS ASK ge#####vehuddleston.net
- DNS ASK ma######echristophers.net
- DNS ASK ze######hchristophers.net
- DNS ASK ma#####kehuddleston.net
- DNS ASK kr######erdwerryhouse.net
- DNS ASK ma#####kemerrickson.net
- DNS ASK ze#####ahmerrickson.net
- DNS ASK ze#####ahhuddleston.net
- DNS ASK je#####nemerrickson.net
- DNS ASK ge######echristophers.net
- DNS ASK je######echristophers.net
- DNS ASK ma######emiddlesworth.net
- DNS ASK ze######hmiddlesworth.net
- DNS ASK ge#####vemerrickson.net
