Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Secondary Redirector Task Assistant Services' = 'C:\hpxtdaejlcxoeyx\xnxoxrctd.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Telephony Configuration Identity] 'ImagePath' = 'C:\hpxtdaejlcxoeyx\xnxoxrctd.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Telephony Configuration Identity] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\hpxtdaejlcxoeyx\dtgxlic.exe' "c:\hpxtdaejlcxoeyx\xnxoxrctd.exe"
- 'C:\hpxtdaejlcxoeyx\xnxoxrctd.exe'
- 'C:\hpxtdaejlcxoeyx\tsnr2zg2gpenx8sbvz.exe'
Modifies file system:
Creates the following files:
- C:\hpxtdaejlcxoeyx\xnxoxrctd.exe
- C:\hpxtdaejlcxoeyx\dtgxlic.exe
- C:\hpxtdaejlcxoeyx\tsnr2zg2gpenx8sbvz.exe
- %WINDIR%\hpxtdaejlcxoeyx\b9lqsua
- C:\hpxtdaejlcxoeyx\b9lqsua
Sets the 'hidden' attribute to the following files:
- C:\hpxtdaejlcxoeyx\dtgxlic.exe
- C:\hpxtdaejlcxoeyx\xnxoxrctd.exe
Deletes the following files:
- C:\hpxtdaejlcxoeyx\tsnr2zg2gpenx8sbvz.exe
- %WINDIR%\hpxtdaejlcxoeyx\b9lqsua
Substitutes the following files:
- %WINDIR%\hpxtdaejlcxoeyx\b9lqsua
Network activity:
Connects to:
- 're####further.net':80
- 'ca####ncompany.net':80
- 'la####ompany.net':80
- 'el####iccover.net':80
- 're###dcover.net':80
- 'el####icfurther.net':80
- 'ca####nbecome.net':80
- 'ca####nfurther.net':80
- 'la####urther.net':80
- 'de####company.net':80
- 'la###become.net':80
- 'ca####ncover.net':80
- 'la###cover.net':80
- 'tr###become.net':80
- 'st####become.net':80
- 'tr###cover.net':80
- 'be####further.net':80
- 'tr####ompany.net':80
- 'st####company.net':80
- 'st###tcover.net':80
- 're####company.net':80
- 'el####icbecome.net':80
- 're####become.net':80
- 'tr####urther.net':80
- 'st####further.net':80
- 'el####iccompany.net':80
- 'qu###govern.net':80
- 'se####enough.net':80
- 'qu###enough.net':80
- 'do####urther.net':80
- 'ag####tfurther.net':80
- 'se####govern.net':80
- 'se####needle.net':80
- 'br###govern.net':80
- 'fl###govern.net':80
- 'br###enough.net':80
- 'qu###needle.net':80
- 'se####nature.net':80
- 'qu###nature.net':80
- 'de###ecover.net':80
- 'ni###cover.net':80
- 'de####further.net':80
- 'ni####ompany.net':80
- 'de####become.net':80
- 'ni###become.net':80
- 'ni####urther.net':80
- 'ag####tbecome.net':80
- 'do###cover.net':80
- 'ag####tcover.net':80
- 'do####ompany.net':80
- 'ag####tcompany.net':80
- 'do###become.net':80
TCP:
HTTP GET requests:
- http://re####further.net/index.php
- http://ca####ncompany.net/index.php
- http://la####ompany.net/index.php
- http://el####iccover.net/index.php
- http://re###dcover.net/index.php
- http://el####icfurther.net/index.php
- http://ca####nbecome.net/index.php
- http://ca####nfurther.net/index.php
- http://la####urther.net/index.php
- http://de####company.net/index.php
- http://la###become.net/index.php
- http://ca####ncover.net/index.php
- http://la###cover.net/index.php
- http://tr###become.net/index.php
- http://st####become.net/index.php
- http://tr###cover.net/index.php
- http://be####further.net/index.php
- http://tr####ompany.net/index.php
- http://st####company.net/index.php
- http://st###tcover.net/index.php
- http://re####company.net/index.php
- http://el####icbecome.net/index.php
- http://re####become.net/index.php
- http://tr####urther.net/index.php
- http://st####further.net/index.php
- http://el####iccompany.net/index.php
- http://qu###govern.net/index.php
- http://se####enough.net/index.php
- http://qu###enough.net/index.php
- http://do####urther.net/index.php
- http://ag####tfurther.net/index.php
- http://se####govern.net/index.php
- http://se####needle.net/index.php
- http://br###govern.net/index.php
- http://fl###govern.net/index.php
- http://br###enough.net/index.php
- http://qu###needle.net/index.php
- http://se####nature.net/index.php
- http://qu###nature.net/index.php
- http://de###ecover.net/index.php
- http://ni###cover.net/index.php
- http://de####further.net/index.php
- http://ni####ompany.net/index.php
- http://de####become.net/index.php
- http://ni###become.net/index.php
- http://ni####urther.net/index.php
- http://ag####tbecome.net/index.php
- http://do###cover.net/index.php
- http://ag####tcover.net/index.php
- http://do####ompany.net/index.php
- http://ag####tcompany.net/index.php
- http://do###become.net/index.php
UDP:
- DNS ASK el####icfurther.net
- DNS ASK re####further.net
- DNS ASK ca####ncompany.net
- DNS ASK re####become.net
- DNS ASK el####iccover.net
- DNS ASK re###dcover.net
- DNS ASK la####ompany.net
- DNS ASK la###cover.net
- DNS ASK ca####nfurther.net
- DNS ASK la####urther.net
- DNS ASK ca####nbecome.net
- DNS ASK la###become.net
- DNS ASK ca####ncover.net
- DNS ASK st####company.net
- DNS ASK tr###become.net
- DNS ASK st####become.net
- DNS ASK ga####further.net
- DNS ASK be####further.net
- DNS ASK tr####ompany.net
- DNS ASK tr###cover.net
- DNS ASK el####iccompany.net
- DNS ASK re####company.net
- DNS ASK el####icbecome.net
- DNS ASK st###tcover.net
- DNS ASK tr####urther.net
- DNS ASK st####further.net
- DNS ASK de####company.net
- DNS ASK qu###govern.net
- DNS ASK se####enough.net
- DNS ASK qu###enough.net
- DNS ASK do####urther.net
- DNS ASK ag####tfurther.net
- DNS ASK se####govern.net
- DNS ASK se####needle.net
- DNS ASK br###govern.net
- DNS ASK fl###govern.net
- DNS ASK br###enough.net
- DNS ASK qu###needle.net
- DNS ASK se####nature.net
- DNS ASK qu###nature.net
- DNS ASK de###ecover.net
- DNS ASK ni###cover.net
- DNS ASK de####further.net
- DNS ASK ni####ompany.net
- DNS ASK de####become.net
- DNS ASK ni###become.net
- DNS ASK ni####urther.net
- DNS ASK ag####tbecome.net
- DNS ASK do###cover.net
- DNS ASK ag####tcover.net
- DNS ASK do####ompany.net
- DNS ASK ag####tcompany.net
- DNS ASK do###become.net
