Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Defragmenter Internet Endpoint Extender' = 'C:\hufcdlqfctpl\ldpzucrh.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Presentation RPC Secondary Encrypting] 'ImagePath' = 'C:\hufcdlqfctpl\ldpzucrh.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Presentation RPC Secondary Encrypting] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\hufcdlqfctpl\cuxllhpth.exe' "c:\hufcdlqfctpl\ldpzucrh.exe"
- 'C:\hufcdlqfctpl\ldpzucrh.exe'
- 'C:\hufcdlqfctpl\xazj4lx3mygvmna4a.exe'
Modifies file system:
Creates the following files:
- C:\hufcdlqfctpl\ldpzucrh.exe
- C:\hufcdlqfctpl\cuxllhpth.exe
- C:\hufcdlqfctpl\xazj4lx3mygvmna4a.exe
- %WINDIR%\hufcdlqfctpl\em9wml
- C:\hufcdlqfctpl\em9wml
Sets the 'hidden' attribute to the following files:
- C:\hufcdlqfctpl\cuxllhpth.exe
- C:\hufcdlqfctpl\ldpzucrh.exe
Deletes the following files:
- C:\hufcdlqfctpl\xazj4lx3mygvmna4a.exe
- %WINDIR%\hufcdlqfctpl\em9wml
Substitutes the following files:
- %WINDIR%\hufcdlqfctpl\em9wml
Network activity:
Connects to:
- 'se####company.net':80
- 'ag####tuntil.net':80
- 'se####become.net':80
- 'qu####ompany.net':80
- 'do###until.net':80
- 'ag####tshoulder.net':80
- 'do####houlder.net':80
- 'ag####tabove.net':80
- 'do###above.net':80
- 'fl####ompany.net':80
- 'br####ompany.net':80
- 'fl###become.net':80
- 'br###become.net':80
- 'qu####urther.net':80
- 'se###ncover.net':80
- 'qu###become.net':80
- 'se####further.net':80
- 'qu###cover.net':80
TCP:
HTTP GET requests:
- http://se####company.net/index.php
- http://ag####tuntil.net/index.php
- http://se####become.net/index.php
- http://qu####ompany.net/index.php
- http://do###until.net/index.php
- http://ag####tshoulder.net/index.php
- http://do####houlder.net/index.php
- http://ag####tabove.net/index.php
- http://do###above.net/index.php
- http://fl####ompany.net/index.php
- http://br####ompany.net/index.php
- http://fl###become.net/index.php
- http://br###become.net/index.php
- http://qu####urther.net/index.php
- http://se###ncover.net/index.php
- http://qu###become.net/index.php
- http://se####further.net/index.php
- http://qu###cover.net/index.php
UDP:
- DNS ASK ag####tuntil.net
- DNS ASK do###until.net
- DNS ASK qu####ompany.net
- DNS ASK se####company.net
- DNS ASK ag####tabove.net
- DNS ASK do####houlder.net
- DNS ASK ag####tfinger.net
- DNS ASK do###above.net
- DNS ASK ag####tshoulder.net
- DNS ASK se####become.net
- DNS ASK fl####ompany.net
- DNS ASK br####ompany.net
- DNS ASK fl###become.net
- DNS ASK br###become.net
- DNS ASK qu####urther.net
- DNS ASK se###ncover.net
- DNS ASK qu###become.net
- DNS ASK se####further.net
- DNS ASK qu###cover.net
