Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Studio TCP/IP SSDP Accounts Certificate Color' = 'C:\gtcdsqo\ubdhcklxqbev.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Background Connections Propagation Files] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Background Connections Propagation Files] 'ImagePath' = 'C:\gtcdsqo\ubdhcklxqbev.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\gtcdsqo\ad90wryxay
- C:\gtcdsqo\ad90wryxay
- C:\gtcdsqo\www2ufxmgmsxc0vtcqyc.exe
- C:\gtcdsqo\ubdhcklxqbev.exe
- C:\gtcdsqo\jpaqjzcq.exe
- C:\gtcdsqo\ayxuuk
Sets the 'hidden' attribute to the following files:
- C:\gtcdsqo\ubdhcklxqbev.exe
- C:\gtcdsqo\jpaqjzcq.exe
Deletes the following files:
- %WINDIR%\gtcdsqo\ad90wryxay
- C:\gtcdsqo\www2ufxmgmsxc0vtcqyc.exe
Substitutes the following files:
- %WINDIR%\gtcdsqo\ad90wryxay
Network activity:
Connects to:
- 'su####tsucceed.net':80
- 'ma####alstudent.net':80
- 'se###around.net':80
- 'la###round.net':80
- 'se####glossary.net':80
- 'la####lossary.net':80
- 'se####likely.net':80
- 'la###likely.net':80
- 'se###aworth.net':80
- 'la###worth.net':80
- 'si###eround.net':80
- 'fi####student.net':80
- 'mo###rround.net':80
- 'mo####glossary.net':80
- 'si####likely.net':80
- 'mo####likely.net':80
- 'si###eworth.net':80
- 'mo###rworth.net':80
- 'mo####inround.net':80
- 'po####leround.net':80
- 'mo#####nglossary.net':80
- 'po#####eglossary.net':80
- 'mo####inlikely.net':80
- 'ma####alproduce.net':80
- 'se####lstudent.net':80
- 'se####lproduce.net':80
- 'ma####albetween.net':80
- 'se####lbetween.net':80
- 'su####tbetween.net':80
- 'wi####produce.net':80
- 'su####tproduce.net':80
- 'wi####student.net':80
- 'su####tstudent.net':80
- 'fi####succeed.net':80
- 'le####ucceed.net':80
- 'fi####between.net':80
- 'le####etween.net':80
- 'fi####produce.net':80
- 'po####lelikely.net':80
- 'si####glossary.net':80
- 'le####roduce.net':80
- 'sw####ucceed.net':80
- 'pr####lysucceed.net':80
- 'sw####etween.net':80
- 'pr####lybetween.net':80
- 'sw####roduce.net':80
- 'pr####lyproduce.net':80
- 'sw####tudent.net':80
- 'pr####lystudent.net':80
- 'se####lsucceed.net':80
- 'ma####alsucceed.net':80
- 'wi####between.net':80
- 'le####tudent.net':80
- 'mo####inworth.net':80
TCP:
HTTP GET requests:
- http://su####tsucceed.net/index.php
- http://ma####alstudent.net/index.php
- http://se###around.net/index.php
- http://la###round.net/index.php
- http://se####glossary.net/index.php
- http://la####lossary.net/index.php
- http://se####likely.net/index.php
- http://la###likely.net/index.php
- http://se###aworth.net/index.php
- http://la###worth.net/index.php
- http://si###eround.net/index.php
- http://fi####student.net/index.php
- http://mo###rround.net/index.php
- http://mo####glossary.net/index.php
- http://si####likely.net/index.php
- http://mo####likely.net/index.php
- http://si###eworth.net/index.php
- http://mo###rworth.net/index.php
- http://mo####inround.net/index.php
- http://po####leround.net/index.php
- http://mo#####nglossary.net/index.php
- http://po#####eglossary.net/index.php
- http://mo####inlikely.net/index.php
- http://ma####alproduce.net/index.php
- http://se####lstudent.net/index.php
- http://se####lproduce.net/index.php
- http://ma####albetween.net/index.php
- http://se####lbetween.net/index.php
- http://su####tbetween.net/index.php
- http://wi####produce.net/index.php
- http://su####tproduce.net/index.php
- http://wi####student.net/index.php
- http://su####tstudent.net/index.php
- http://fi####succeed.net/index.php
- http://le####ucceed.net/index.php
- http://fi####between.net/index.php
- http://le####etween.net/index.php
- http://fi####produce.net/index.php
- http://po####lelikely.net/index.php
- http://si####glossary.net/index.php
- http://le####roduce.net/index.php
- http://sw####ucceed.net/index.php
- http://pr####lysucceed.net/index.php
- http://sw####etween.net/index.php
- http://pr####lybetween.net/index.php
- http://sw####roduce.net/index.php
- http://pr####lyproduce.net/index.php
- http://sw####tudent.net/index.php
- http://pr####lystudent.net/index.php
- http://se####lsucceed.net/index.php
- http://ma####alsucceed.net/index.php
- http://wi####between.net/index.php
- http://le####tudent.net/index.php
- http://mo####inworth.net/index.php
UDP:
- DNS ASK su####tsucceed.net
- DNS ASK se####lstudent.net
- DNS ASK ma####alstudent.net
- DNS ASK se###around.net
- DNS ASK la###round.net
- DNS ASK se####glossary.net
- DNS ASK la####lossary.net
- DNS ASK se####likely.net
- DNS ASK la###likely.net
- DNS ASK se###aworth.net
- DNS ASK la###worth.net
- DNS ASK si###eround.net
- DNS ASK si####glossary.net
- DNS ASK mo####inworth.net
- DNS ASK mo####glossary.net
- DNS ASK si####likely.net
- DNS ASK mo####likely.net
- DNS ASK si###eworth.net
- DNS ASK mo###rworth.net
- DNS ASK mo####inround.net
- DNS ASK po####leround.net
- DNS ASK mo#####nglossary.net
- DNS ASK po#####eglossary.net
- DNS ASK mo####inlikely.net
- DNS ASK po####lelikely.net
- DNS ASK ma####alproduce.net
- DNS ASK mo###rround.net
- DNS ASK se####lproduce.net
- DNS ASK le####roduce.net
- DNS ASK wi####between.net
- DNS ASK su####tbetween.net
- DNS ASK wi####produce.net
- DNS ASK su####tproduce.net
- DNS ASK wi####student.net
- DNS ASK su####tstudent.net
- DNS ASK fi####succeed.net
- DNS ASK le####ucceed.net
- DNS ASK fi####between.net
- DNS ASK le####etween.net
- DNS ASK fi####produce.net
- DNS ASK fi####student.net
- DNS ASK se####lbetween.net
- DNS ASK le####tudent.net
- DNS ASK sw####ucceed.net
- DNS ASK pr####lysucceed.net
- DNS ASK sw####etween.net
- DNS ASK pr####lybetween.net
- DNS ASK sw####roduce.net
- DNS ASK pr####lyproduce.net
- DNS ASK sw####tudent.net
- DNS ASK pr####lystudent.net
- DNS ASK se####lsucceed.net
- DNS ASK ma####alsucceed.net
- DNS ASK ma####albetween.net
- DNS ASK po####leworth.net
Miscellaneous:
Creates and executes the following:
- 'C:\gtcdsqo\www2ufxmgmsxc0vtcqyc.exe'
- 'C:\gtcdsqo\ubdhcklxqbev.exe'
- 'C:\gtcdsqo\jpaqjzcq.exe' "c:\gtcdsqo\ubdhcklxqbev.exe"
