Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Services User-mode Video Collector' = 'C:\ysuogwgu\ofiqkya.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Receiver Event WWAN Font PC iSCSI] 'ImagePath' = 'C:\ysuogwgu\ofiqkya.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Receiver Event WWAN Font PC iSCSI] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\ysuogwgu\tikyzjojipt.exe' "c:\ysuogwgu\ofiqkya.exe"
- 'C:\ysuogwgu\ofiqkya.exe'
- 'C:\ysuogwgu\ifx316kdx4qiftnt3w.exe'
Modifies file system:
Creates the following files:
- C:\ysuogwgu\ofiqkya.exe
- C:\ysuogwgu\tikyzjojipt.exe
- C:\ysuogwgu\ifx316kdx4qiftnt3w.exe
- %WINDIR%\ysuogwgu\mgixet9flyi
- C:\ysuogwgu\mgixet9flyi
Sets the 'hidden' attribute to the following files:
- C:\ysuogwgu\tikyzjojipt.exe
- C:\ysuogwgu\ofiqkya.exe
Deletes the following files:
- C:\ysuogwgu\ifx316kdx4qiftnt3w.exe
- %WINDIR%\ysuogwgu\mgixet9flyi
Substitutes the following files:
- %WINDIR%\ysuogwgu\mgixet9flyi
Network activity:
Connects to:
- 'ag####tfurther.net':80
- 'se####govern.net':80
- 'ag####tcover.net':80
- 'do####urther.net':80
- 'qu###enough.net':80
- 'se####needle.net':80
- 'qu###govern.net':80
- 'se####enough.net':80
- 'do###cover.net':80
- 'de####further.net':80
- 'ni####urther.net':80
- 'de###ecover.net':80
- 'ni###cover.net':80
- 'do###become.net':80
- 'ag####tbecome.net':80
- 'do####ompany.net':80
- 'ag####tcompany.net':80
- 'ga####govern.net':80
- 'be####govern.net':80
- 'br###nature.net':80
- 'fl###nature.net':80
- 'ga####needle.net':80
- 'be####needle.net':80
- 'ga####enough.net':80
- 'be####enough.net':80
- 'fl###needle.net':80
- 'qu###nature.net':80
- 'br###govern.net':80
- 'qu###needle.net':80
- 'se####nature.net':80
- 'fl###enough.net':80
- 'br###needle.net':80
- 'fl###govern.net':80
- 'br###enough.net':80
TCP:
HTTP GET requests:
- http://ag####tfurther.net/index.php
- http://se####govern.net/index.php
- http://ag####tcover.net/index.php
- http://do####urther.net/index.php
- http://qu###enough.net/index.php
- http://se####needle.net/index.php
- http://qu###govern.net/index.php
- http://se####enough.net/index.php
- http://do###cover.net/index.php
- http://de####further.net/index.php
- http://ni####urther.net/index.php
- http://de###ecover.net/index.php
- http://ni###cover.net/index.php
- http://do###become.net/index.php
- http://ag####tbecome.net/index.php
- http://do####ompany.net/index.php
- http://ag####tcompany.net/index.php
- http://ga####govern.net/index.php
- http://be####govern.net/index.php
- http://br###nature.net/index.php
- http://fl###nature.net/index.php
- http://ga####needle.net/index.php
- http://be####needle.net/index.php
- http://ga####enough.net/index.php
- http://be####enough.net/index.php
- http://fl###needle.net/index.php
- http://qu###nature.net/index.php
- http://br###govern.net/index.php
- http://qu###needle.net/index.php
- http://se####nature.net/index.php
- http://fl###enough.net/index.php
- http://br###needle.net/index.php
- http://fl###govern.net/index.php
- http://br###enough.net/index.php
UDP:
- DNS ASK do####urther.net
- DNS ASK ag####tfurther.net
- DNS ASK do###cover.net
- DNS ASK ag####tcover.net
- DNS ASK se####enough.net
- DNS ASK qu###enough.net
- DNS ASK se####govern.net
- DNS ASK qu###govern.net
- DNS ASK ag####tbecome.net
- DNS ASK ni###cover.net
- DNS ASK de####further.net
- DNS ASK ni###become.net
- DNS ASK de###ecover.net
- DNS ASK ag####tcompany.net
- DNS ASK do###become.net
- DNS ASK ni####urther.net
- DNS ASK do####ompany.net
- DNS ASK se####needle.net
- DNS ASK ga####govern.net
- DNS ASK be####govern.net
- DNS ASK br###nature.net
- DNS ASK fl###nature.net
- DNS ASK ga####needle.net
- DNS ASK be####needle.net
- DNS ASK ga####enough.net
- DNS ASK be####enough.net
- DNS ASK fl###needle.net
- DNS ASK qu###nature.net
- DNS ASK br###govern.net
- DNS ASK qu###needle.net
- DNS ASK se####nature.net
- DNS ASK fl###enough.net
- DNS ASK br###needle.net
- DNS ASK fl###govern.net
- DNS ASK br###enough.net
