Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Extensible Level Tablet Auto Trap' = 'C:\hrgwrbukbydff\bgduiykea.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Connectivity Sharing Remote Plug] 'ImagePath' = 'C:\hrgwrbukbydff\bgduiykea.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Connectivity Sharing Remote Plug] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\hrgwrbukbydff\wwuzxzapduyf.exe' "c:\hrgwrbukbydff\bgduiykea.exe"
- 'C:\hrgwrbukbydff\bgduiykea.exe'
- 'C:\hrgwrbukbydff\qqe2y93vjfpobfen.exe'
Modifies file system:
Creates the following files:
- C:\hrgwrbukbydff\bgduiykea.exe
- C:\hrgwrbukbydff\wwuzxzapduyf.exe
- C:\hrgwrbukbydff\qqe2y93vjfpobfen.exe
- %WINDIR%\hrgwrbukbydff\algvm7kymwz
- C:\hrgwrbukbydff\algvm7kymwz
Sets the 'hidden' attribute to the following files:
- C:\hrgwrbukbydff\wwuzxzapduyf.exe
- C:\hrgwrbukbydff\bgduiykea.exe
Deletes the following files:
- C:\hrgwrbukbydff\qqe2y93vjfpobfen.exe
- %WINDIR%\hrgwrbukbydff\algvm7kymwz
Substitutes the following files:
- %WINDIR%\hrgwrbukbydff\algvm7kymwz
Network activity:
Connects to:
- 'se####needle.net':80
- 'qu###needle.net':80
- 'qu###enough.net':80
- 'qu###govern.net':80
- 'se####enough.net':80
- 'fl###govern.net':80
- 'br###enough.net':80
- 'br###govern.net':80
- 'se####nature.net':80
- 'qu###nature.net':80
- 'do###become.net':80
- 'ag####tbecome.net':80
- 'ag####tcompany.net':80
- 'ni####urther.net':80
- 'do####ompany.net':80
- 'ag####tfurther.net':80
- 'se####govern.net':80
- 'do####urther.net':80
- 'do###cover.net':80
- 'ag####tcover.net':80
- 'tr###govern.net':80
- 'st####govern.net':80
- 'be####nature.net':80
- 'be####needle.net':80
- 'ga####nature.net':80
- 'st####needle.net':80
- 'tr###nature.net':80
- 'tr###needle.net':80
- 'tr###enough.net':80
- 'st####enough.net':80
- 'br###nature.net':80
- 'fl###nature.net':80
- 'fl###needle.net':80
- 'fl###enough.net':80
- 'br###needle.net':80
- 'be####enough.net':80
- 'ga####needle.net':80
- 'ga####enough.net':80
- 'ga####govern.net':80
- 'be####govern.net':80
TCP:
HTTP GET requests:
- http://se####needle.net/index.php
- http://qu###needle.net/index.php
- http://qu###enough.net/index.php
- http://qu###govern.net/index.php
- http://se####enough.net/index.php
- http://fl###govern.net/index.php
- http://br###enough.net/index.php
- http://br###govern.net/index.php
- http://se####nature.net/index.php
- http://qu###nature.net/index.php
- http://do###become.net/index.php
- http://ag####tbecome.net/index.php
- http://ag####tcompany.net/index.php
- http://ni####urther.net/index.php
- http://do####ompany.net/index.php
- http://ag####tfurther.net/index.php
- http://se####govern.net/index.php
- http://do####urther.net/index.php
- http://do###cover.net/index.php
- http://ag####tcover.net/index.php
- http://tr###govern.net/index.php
- http://st####govern.net/index.php
- http://be####nature.net/index.php
- http://be####needle.net/index.php
- http://ga####nature.net/index.php
- http://st####needle.net/index.php
- http://tr###nature.net/index.php
- http://tr###needle.net/index.php
- http://tr###enough.net/index.php
- http://st####enough.net/index.php
- http://br###nature.net/index.php
- http://fl###nature.net/index.php
- http://fl###needle.net/index.php
- http://fl###enough.net/index.php
- http://br###needle.net/index.php
- http://be####enough.net/index.php
- http://ga####needle.net/index.php
- http://ga####enough.net/index.php
- http://ga####govern.net/index.php
- http://be####govern.net/index.php
UDP:
- DNS ASK qu###enough.net
- DNS ASK se####needle.net
- DNS ASK se####enough.net
- DNS ASK se####govern.net
- DNS ASK qu###govern.net
- DNS ASK br###govern.net
- DNS ASK fl###govern.net
- DNS ASK qu###nature.net
- DNS ASK qu###needle.net
- DNS ASK se####nature.net
- DNS ASK ag####tcompany.net
- DNS ASK do###become.net
- DNS ASK do####ompany.net
- DNS ASK de####further.net
- DNS ASK ni####urther.net
- DNS ASK do####urther.net
- DNS ASK ag####tfurther.net
- DNS ASK ag####tcover.net
- DNS ASK ag####tbecome.net
- DNS ASK do###cover.net
- DNS ASK br###enough.net
- DNS ASK tr###govern.net
- DNS ASK st####govern.net
- DNS ASK be####nature.net
- DNS ASK be####needle.net
- DNS ASK ga####nature.net
- DNS ASK st####needle.net
- DNS ASK tr###nature.net
- DNS ASK tr###needle.net
- DNS ASK tr###enough.net
- DNS ASK st####enough.net
- DNS ASK br###nature.net
- DNS ASK fl###nature.net
- DNS ASK fl###needle.net
- DNS ASK fl###enough.net
- DNS ASK br###needle.net
- DNS ASK be####enough.net
- DNS ASK ga####needle.net
- DNS ASK ga####enough.net
- DNS ASK ga####govern.net
- DNS ASK be####govern.net
