Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Now Extender Bus Detection Internet IP Volume' = 'C:\jokqcqrjb\znsuouaqqqlz.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\AuthIP Proxy WLAN Endpoint Transfer] 'ImagePath' = 'C:\jokqcqrjb\znsuouaqqqlz.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\AuthIP Proxy WLAN Endpoint Transfer] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\jokqcqrjb\cnltzzenazd.exe' "c:\jokqcqrjb\znsuouaqqqlz.exe"
- 'C:\jokqcqrjb\znsuouaqqqlz.exe'
- 'C:\jokqcqrjb\kn2rpeojnbxk8ckrv5.exe'
Modifies file system:
Creates the following files:
- C:\jokqcqrjb\znsuouaqqqlz.exe
- C:\jokqcqrjb\cnltzzenazd.exe
- C:\jokqcqrjb\kn2rpeojnbxk8ckrv5.exe
- %WINDIR%\jokqcqrjb\zmznttzatyfv
- C:\jokqcqrjb\zmznttzatyfv
Sets the 'hidden' attribute to the following files:
- C:\jokqcqrjb\cnltzzenazd.exe
- C:\jokqcqrjb\znsuouaqqqlz.exe
Deletes the following files:
- C:\jokqcqrjb\kn2rpeojnbxk8ckrv5.exe
- %WINDIR%\jokqcqrjb\zmznttzatyfv
Substitutes the following files:
- %WINDIR%\jokqcqrjb\zmznttzatyfv
Network activity:
Connects to:
- 'ri###nwhose.net':80
- 'be####bicycle.net':80
- 'ri####bicycle.net':80
- 'th###except.net':80
- 'ch###except.net':80
- 'be###gwhose.net':80
- 'be####bridge.net':80
- 'li###ewhose.net':80
- 'de####ywhose.net':80
- 'li####bicycle.net':80
- 'ri####bridge.net':80
- 'be####except.net':80
- 'ri####except.net':80
- 'ch###bridge.net':80
- 'wi####bicycle.net':80
- 'su####bridge.net':80
- 'wi####bridge.net':80
- 'su###rwhose.net':80
- 'wi###nwhose.net':80
- 'su####bicycle.net':80
- 'su####except.net':80
- 'th####icycle.net':80
- 'ch####icycle.net':80
- 'th###bridge.net':80
- 'wi####except.net':80
- 'th###whose.net':80
- 'ch###whose.net':80
- 're####erladder.net':80
- 'wo###ladder.net':80
- 're#####rcharacter.net':80
- 'wo###enter.net':80
- 're####erboard.net':80
- 'wo###board.net':80
- 'wo####haracter.net':80
- 'fo###tboard.net':80
- 'in####seladder.net':80
- 'fo####ladder.net':80
- 'in####seenter.net':80
- 'fo###tenter.net':80
- 'in####seboard.net':80
- 're####erenter.net':80
- 'li####except.net':80
- 'de####yexcept.net':80
- 'hu####dwhose.net':80
- 'de####ybicycle.net':80
- 'li####bridge.net':80
- 'de####ybridge.net':80
- 'jo####ywhose.net':80
- 'jo####ybridge.net':80
- 'hu####dexcept.net':80
- 'jo####yexcept.net':80
- 'hu####dbicycle.net':80
- 'jo####ybicycle.net':80
- 'hu####dbridge.net':80
TCP:
HTTP GET requests:
- http://ri###nwhose.net/index.php
- http://be####bicycle.net/index.php
- http://ri####bicycle.net/index.php
- http://th###except.net/index.php
- http://ch###except.net/index.php
- http://be###gwhose.net/index.php
- http://be####bridge.net/index.php
- http://li###ewhose.net/index.php
- http://de####ywhose.net/index.php
- http://li####bicycle.net/index.php
- http://ri####bridge.net/index.php
- http://be####except.net/index.php
- http://ri####except.net/index.php
- http://ch###bridge.net/index.php
- http://wi####bicycle.net/index.php
- http://su####bridge.net/index.php
- http://wi####bridge.net/index.php
- http://su###rwhose.net/index.php
- http://wi###nwhose.net/index.php
- http://su####bicycle.net/index.php
- http://su####except.net/index.php
- http://th####icycle.net/index.php
- http://ch####icycle.net/index.php
- http://th###bridge.net/index.php
- http://wi####except.net/index.php
- http://th###whose.net/index.php
- http://ch###whose.net/index.php
- http://re####erladder.net/index.php
- http://wo###ladder.net/index.php
- http://re#####rcharacter.net/index.php
- http://wo###enter.net/index.php
- http://re####erboard.net/index.php
- http://wo###board.net/index.php
- http://wo####haracter.net/index.php
- http://fo###tboard.net/index.php
- http://in####seladder.net/index.php
- http://fo####ladder.net/index.php
- http://in####seenter.net/index.php
- http://fo###tenter.net/index.php
- http://in####seboard.net/index.php
- http://re####erenter.net/index.php
- http://li####except.net/index.php
- http://de####yexcept.net/index.php
- http://hu####dwhose.net/index.php
- http://de####ybicycle.net/index.php
- http://li####bridge.net/index.php
- http://de####ybridge.net/index.php
- http://jo####ywhose.net/index.php
- http://jo####ybridge.net/index.php
- http://hu####dexcept.net/index.php
- http://jo####yexcept.net/index.php
- http://hu####dbicycle.net/index.php
- http://jo####ybicycle.net/index.php
- http://hu####dbridge.net/index.php
UDP:
- DNS ASK be###gwhose.net
- DNS ASK ri###nwhose.net
- DNS ASK be####bicycle.net
- DNS ASK ch###bridge.net
- DNS ASK th###except.net
- DNS ASK ch###except.net
- DNS ASK ri####bicycle.net
- DNS ASK ri####except.net
- DNS ASK li###ewhose.net
- DNS ASK de####ywhose.net
- DNS ASK be####bridge.net
- DNS ASK ri####bridge.net
- DNS ASK be####except.net
- DNS ASK th###bridge.net
- DNS ASK su####bicycle.net
- DNS ASK wi####bicycle.net
- DNS ASK su####bridge.net
- DNS ASK ef####except.net
- DNS ASK su###rwhose.net
- DNS ASK wi###nwhose.net
- DNS ASK wi####bridge.net
- DNS ASK ch###whose.net
- DNS ASK th####icycle.net
- DNS ASK ch####icycle.net
- DNS ASK su####except.net
- DNS ASK wi####except.net
- DNS ASK th###whose.net
- DNS ASK li####bicycle.net
- DNS ASK re####erladder.net
- DNS ASK wo###ladder.net
- DNS ASK re#####rcharacter.net
- DNS ASK wo###enter.net
- DNS ASK re####erboard.net
- DNS ASK wo###board.net
- DNS ASK wo####haracter.net
- DNS ASK fo###tboard.net
- DNS ASK in####seladder.net
- DNS ASK fo####ladder.net
- DNS ASK in####seenter.net
- DNS ASK fo###tenter.net
- DNS ASK in####seboard.net
- DNS ASK re####erenter.net
- DNS ASK li####except.net
- DNS ASK de####yexcept.net
- DNS ASK hu####dwhose.net
- DNS ASK de####ybicycle.net
- DNS ASK li####bridge.net
- DNS ASK de####ybridge.net
- DNS ASK jo####ywhose.net
- DNS ASK jo####ybridge.net
- DNS ASK hu####dexcept.net
- DNS ASK jo####yexcept.net
- DNS ASK hu####dbicycle.net
- DNS ASK jo####ybicycle.net
- DNS ASK hu####dbridge.net
