Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\19372260\wqn.exe %TEMP%\19372260\vtq=alp'
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Searches for registry branches where third party applications store passwords:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander]
- [<HKCU>\Software\Paltalk]
Modifies file system:
Creates the following files:
- %TEMP%\19372260\fpw.jpg
- %TEMP%\19372260\ggf.mp4
- %TEMP%\19372260\fqf.bmp
- %TEMP%\19372260\hks.txt
- %TEMP%\19372260\xgd.docx
- %TEMP%\19372260\swf.mp4
- %TEMP%\19372260\mha.docx
- %TEMP%\19372260\ruq.dat
- %TEMP%\19372260\nnl.dat
- %TEMP%\19372260\bkq.mp3
- %TEMP%\19372260\akl.xl
- %TEMP%\19372260\gvb.ppt
- %TEMP%\19372260\naw.icm
- %TEMP%\19372260\iex.pdf
- %TEMP%\19372260\ftq.bmp
- %TEMP%\19372260\PSXMK
- %TEMP%\19372260\ccd.mp4
- %TEMP%\19372260\vnj.txt
- %TEMP%\19372260\vst.xl
- %TEMP%\19372260\sbj.txt
- %TEMP%\19372260\nti.mp4
- %TEMP%\19372260\plm.pdf
- %TEMP%\19372260\uvp.jpg
- %TEMP%\19372260\dwb.jpg
- %TEMP%\19372260\xlw.xl
- %TEMP%\19372260\xhr.dat
- %TEMP%\19372260\twu.ico
- %TEMP%\19372260\ovo.mp3
- %TEMP%\19372260\ims.xl
- %TEMP%\19372260\oph.ico
- %TEMP%\19372260\isk.bmp
- %TEMP%\19372260\wqn.exe
- %TEMP%\19372260\vtq=alp
- %TEMP%\19372260\qbc.icm
- %TEMP%\19372260\hwr.pdf
- %TEMP%\19372260\hwj.jpg
- %TEMP%\19372260\gxh.mp3
- %TEMP%\19372260\wmx.pdf
- %TEMP%\19372260\bbs.dat
- %TEMP%\19372260\dwl.mp3
- %TEMP%\19372260\ebg.icm
- %TEMP%\19372260\inc.icm
- %TEMP%\19372260\uun.txt
- %TEMP%\19372260\jhp.bmp
- %TEMP%\19372260\hxa.jpg
- %TEMP%\19372260\iuc.txt
- %TEMP%\19372260\wnk.dat
- %TEMP%\19372260\rqp.jpg
- %TEMP%\19372260\ruq.ppt
Sets the 'hidden' attribute to the following files:
- %TEMP%\19372260\ruq.dat
- %TEMP%\19372260\rqp.jpg
- %TEMP%\19372260\qbc.icm
- %TEMP%\19372260\swf.mp4
- %TEMP%\19372260\sbj.txt
- %TEMP%\19372260\ruq.ppt
- %TEMP%\19372260\nti.mp4
- %TEMP%\19372260\nnl.dat
- %TEMP%\19372260\naw.icm
- %TEMP%\19372260\plm.pdf
- %TEMP%\19372260\ovo.mp3
- %TEMP%\19372260\oph.ico
- %TEMP%\19372260\wqn.exe
- %TEMP%\19372260\wnk.dat
- %TEMP%\19372260\wmx.pdf
- %TEMP%\19372260\xlw.xl
- %TEMP%\19372260\xhr.dat
- %TEMP%\19372260\xgd.docx
- %TEMP%\19372260\uvp.jpg
- %TEMP%\19372260\uun.txt
- %TEMP%\19372260\twu.ico
- %TEMP%\19372260\vtq=alp
- %TEMP%\19372260\vst.xl
- %TEMP%\19372260\vnj.txt
- %TEMP%\19372260\fqf.bmp
- %TEMP%\19372260\fpw.jpg
- %TEMP%\19372260\ebg.icm
- %TEMP%\19372260\gvb.ppt
- %TEMP%\19372260\ggf.mp4
- %TEMP%\19372260\ftq.bmp
- %TEMP%\19372260\bkq.mp3
- %TEMP%\19372260\bbs.dat
- %TEMP%\19372260\akl.xl
- %TEMP%\19372260\dwl.mp3
- %TEMP%\19372260\dwb.jpg
- %TEMP%\19372260\ccd.mp4
- %TEMP%\19372260\isk.bmp
- %TEMP%\19372260\inc.icm
- %TEMP%\19372260\ims.xl
- %TEMP%\19372260\mha.docx
- %TEMP%\19372260\jhp.bmp
- %TEMP%\19372260\iuc.txt
- %TEMP%\19372260\hwj.jpg
- %TEMP%\19372260\hks.txt
- %TEMP%\19372260\gxh.mp3
- %TEMP%\19372260\iex.pdf
- %TEMP%\19372260\hxa.jpg
- %TEMP%\19372260\hwr.pdf
Deletes the following files:
- %TEMP%\19372260\PSXMK
Network activity:
Connects to:
- 'ch####p.dyndns.org':80
- 'wp#d':80
TCP:
HTTP GET requests:
- http://ch####p.dyndns.org/
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK ch####p.dyndns.org
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\19372260\wqn.exe' %TEMP%\19372260\PSXMK
- '%TEMP%\19372260\wqn.exe' vtq=alp
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
