Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Hardware Procedure Internet RPC Store' = 'C:\prqckrc\vyxkuyxdk.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\NetBIOS Copy Helper Software Input Call Event] 'ImagePath' = 'C:\prqckrc\vyxkuyxdk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\NetBIOS Copy Helper Software Input Call Event] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\prqckrc\yrrranrqn.exe' "c:\prqckrc\vyxkuyxdk.exe"
- 'C:\prqckrc\vyxkuyxdk.exe'
- 'C:\prqckrc\wimlri4lyevotghruyqr.exe'
Modifies file system:
Creates the following files:
- C:\prqckrc\vyxkuyxdk.exe
- C:\prqckrc\yrrranrqn.exe
- C:\prqckrc\wt7fhb
- %WINDIR%\prqckrc\zldat7
- C:\prqckrc\zldat7
- C:\prqckrc\wimlri4lyevotghruyqr.exe
Sets the 'hidden' attribute to the following files:
- C:\prqckrc\yrrranrqn.exe
- C:\prqckrc\vyxkuyxdk.exe
Deletes the following files:
- C:\prqckrc\wimlri4lyevotghruyqr.exe
- %WINDIR%\prqckrc\zldat7
Substitutes the following files:
- %WINDIR%\prqckrc\zldat7
Network activity:
Connects to:
- 'ch######awinterbottom.net':80
- 'ka######awinterbottom.net':80
- 'co#####cestrickland.net':80
- 'co######ebreckenridge.net':80
- 'ha#####tastrickland.net':80
- 'ch#####tawashington.net':80
- 'ch#####tastrickland.net':80
- 'ka#####rastrickland.net':80
- 'ka######abreckenridge.net':80
- 'ka#####rawashington.net':80
- 'ch######abreckenridge.net':80
- 'ja######abreckenridge.net':80
- 'ro#####nestrickland.net':80
- 'ro######ebreckenridge.net':80
- 'ro#####newashington.net':80
- 'ja#####tawashington.net':80
- 'ja#####tastrickland.net':80
- 'co#####cewashington.net':80
- 'ha######abreckenridge.net':80
- 'ha#####tawashington.net':80
- 'ha######awinterbottom.net':80
- 'co######ewinterbottom.net':80
TCP:
HTTP GET requests:
- http://ch######awinterbottom.net/index.php
- http://ka######awinterbottom.net/index.php
- http://co#####cestrickland.net/index.php
- http://co######ebreckenridge.net/index.php
- http://ha#####tastrickland.net/index.php
- http://ch#####tawashington.net/index.php
- http://ch#####tastrickland.net/index.php
- http://ka#####rastrickland.net/index.php
- http://ka######abreckenridge.net/index.php
- http://ka#####rawashington.net/index.php
- http://ch######abreckenridge.net/index.php
- http://ja######abreckenridge.net/index.php
- http://ro#####nestrickland.net/index.php
- http://ro######ebreckenridge.net/index.php
- http://ro#####newashington.net/index.php
- http://ja#####tawashington.net/index.php
- http://ja#####tastrickland.net/index.php
- http://co#####cewashington.net/index.php
- http://ha######abreckenridge.net/index.php
- http://ha#####tawashington.net/index.php
- http://ha######awinterbottom.net/index.php
- http://co######ewinterbottom.net/index.php
UDP:
- DNS ASK ch######awinterbottom.net
- DNS ASK ka######awinterbottom.net
- DNS ASK co#####cestrickland.net
- DNS ASK co######ebreckenridge.net
- DNS ASK ha#####tastrickland.net
- DNS ASK ch#####tawashington.net
- DNS ASK ch#####tastrickland.net
- DNS ASK ka#####rastrickland.net
- DNS ASK ka######abreckenridge.net
- DNS ASK ka#####rawashington.net
- DNS ASK ch######abreckenridge.net
- DNS ASK ja######abreckenridge.net
- DNS ASK ro#####nestrickland.net
- DNS ASK ro######ebreckenridge.net
- DNS ASK ro#####newashington.net
- DNS ASK ja#####tawashington.net
- DNS ASK ja#####tastrickland.net
- DNS ASK co#####cewashington.net
- DNS ASK ha######abreckenridge.net
- DNS ASK ha#####tawashington.net
- DNS ASK ha######awinterbottom.net
- DNS ASK co######ewinterbottom.net
