Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DHCP Wired Parental Base NGEN' = '<SYSTEM32>\qinxobwfvhu.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Extender Profile Group Transaction] 'ImagePath' = '<SYSTEM32>\qinxobwfvhu.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Extender Profile Group Transaction] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Modifies file system:
Creates the following files:
- <SYSTEM32>\bjeobdhrqabwnb\run
- <SYSTEM32>\bjeobdhrqabwnb\rng
- %WINDIR%\Temp\uvwdgtj98985bcjf.exe
- <SYSTEM32>\bjeobdhrqabwnb\cfg
- %TEMP%\uvwdgtj8gv9gocjfcgurobx.exe
- <SYSTEM32>\bjeobdhrqabwnb\tst
- <SYSTEM32>\pmsjgnawder.exe
- <SYSTEM32>\qinxobwfvhu.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\pmsjgnawder.exe
- <SYSTEM32>\qinxobwfvhu.exe
Deletes the following files:
- %WINDIR%\Temp\uvwdgtj98985bcjf.exe
- %TEMP%\uvwdgtj8gv9gocjfcgurobx.exe
Network activity:
Connects to:
- 'he###here.net':80
- 'he###rms.net':80
- 'ca###here.ru':80
- 'ca###here.net':80
- 'he###tone.ru':80
- 'he###tone.net':80
- 'ca###rms.net':80
- 'ca###tone.net':80
- 'ko###rpig.xyz':80
- 'la###aha.xyz':80
- 'lo####thepings.ru':80
- 'ch###boris.ru':80
- 'bi###rfans.top':80
- 'ru##nds.top':80
- 'po###alal.site':80
- 'ri###nafap.site':80
TCP:
HTTP GET requests:
- http://he###here.net/index.php
- http://he###rms.net/index.php
- http://ca###here.ru/index.php
- http://ca###here.net/index.php
- http://he###tone.ru/index.php
- http://he###tone.net/index.php
- http://ca###rms.net/index.php
- http://ca###tone.net/index.php
- http://ko###rpig.xyz/index.php
- http://la###aha.xyz/index.php
- http://lo####thepings.ru/index.php
- http://ch###boris.ru/index.php
- http://bi###rfans.top/index.php
- http://ru##nds.top/index.php
- http://po###alal.site/index.php
- http://ri###nafap.site/index.php
UDP:
- DNS ASK mi###ower.net
- DNS ASK tr####omorrow.net
- DNS ASK mi###ower.ru
- DNS ASK cl###side.net
- DNS ASK da###ide.net
- DNS ASK tr###lower.net
- DNS ASK tr###wide.net
- DNS ASK tr###kiss.net
- DNS ASK mi###ide.net
- DNS ASK tr###wide.ru
- DNS ASK mi####morrow.net
- DNS ASK si###rms.net
- DNS ASK me###ide.net
- DNS ASK me##side.ru
- DNS ASK si###ide.net
- DNS ASK me###rms.net
- DNS ASK da###here.net
- DNS ASK cl###stone.net
- DNS ASK da###tone.net
- DNS ASK da###rms.net
- DNS ASK cl###arms.net
- DNS ASK da##arms.ru
- DNS ASK wi###ower.net
- DNS ASK si###lower.net
- DNS ASK th###kiss.net
- DNS ASK si####omorrow.net
- DNS ASK th###wide.ru
- DNS ASK th####omorrow.net
- DNS ASK si###wide.net
- DNS ASK th###wide.net
- DNS ASK ca###ower.net
- DNS ASK si###kiss.net
- DNS ASK he###ower.ru
- DNS ASK he###ower.net
- DNS ASK du###ide.net
- DNS ASK du####morrow.net
- DNS ASK wi###omorrow.ru
- DNS ASK mi###iss.net
- DNS ASK du###ower.net
- DNS ASK du##kiss.ru
- DNS ASK wi####morrow.net
- DNS ASK th###lower.net
- DNS ASK wi###iss.net
- DNS ASK wi###ide.net
- DNS ASK du###iss.net
- DNS ASK ca###tone.net
- DNS ASK he###tone.ru
- DNS ASK he###rms.net
- DNS ASK he###here.net
- DNS ASK ca###rms.net
- DNS ASK he###tone.net
- DNS ASK me###here.net
- DNS ASK su###ystone.net
- DNS ASK si###here.ru
- DNS ASK ca###ide.net
- DNS ASK he###ide.net
- DNS ASK ko###rpig.xyz
- DNS ASK la###aha.xyz
- DNS ASK ch###boris.ru
- DNS ASK lo####thepings.ru
- DNS ASK po###lols.ru
- DNS ASK po###alal.site
- DNS ASK ca###here.ru
- DNS ASK ca###here.net
- DNS ASK ru##nds.top
- DNS ASK ri###nafap.site
- DNS ASK bi###rfans.top
- DNS ASK qu###there.net
- DNS ASK qu###arms.ru
- DNS ASK su###ythere.net
- DNS ASK su###yside.net
- DNS ASK th###rms.net
- DNS ASK th##side.ru
- DNS ASK th###here.net
- DNS ASK me###tone.net
- DNS ASK cl###there.net
- DNS ASK mo###rms.net
- DNS ASK mo###ide.net
- DNS ASK qu###side.net
- DNS ASK mo###here.net
- DNS ASK su###yarms.net
- DNS ASK si###tone.net
- DNS ASK th###tone.net
- DNS ASK th###ide.net
- DNS ASK su###ystone.ru
- DNS ASK mo###tone.net
- DNS ASK qu###stone.net
- DNS ASK si###here.net
- DNS ASK qu###arms.net
- '23#.#55.255.250':1900
Miscellaneous:
Creates and executes the following:
- '<SYSTEM32>\pmsjgnawder.exe' "<SYSTEM32>\qinxobwfvhu.exe"
- '%WINDIR%\Temp\uvwdgtj98985bcjf.exe' -r 27483 tcp
- '%TEMP%\uvwdgtj8gv9gocjfcgurobx.exe'
- '<SYSTEM32>\qinxobwfvhu.exe'
