Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'XlcXdvxd' = '<LS_APPDATA>\pfklsvom\xlcxdvxd.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,<LS_APPDATA>\pfklsvom\xlcxdvxd.exe'
Creates or modifies the following files
- %HOMEPATH%\start menu\programs\startup\xlcxdvxd.exe
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Security Center
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\hhtdkihg.exe
- %ALLUSERSPROFILE%\application data\fiewxiva.log
- <LS_APPDATA>\rihbxaec.log
- %TEMP%\onbvidvb.exe
- <LS_APPDATA>\pfklsvom\xlcxdvxd.exe
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\start menu\programs\startup\xlcxdvxd.exe
Network activity
UDP
- DNS ASK google.com
- DNS ASK ly###mlekk.com
- DNS ASK oq####vvednfp.com
- DNS ASK ya##o.com
- DNS ASK mx####ljeqiaca.com
- DNS ASK se####jkqinjgh.com
- DNS ASK cc#####cxdgmmjtyrvv.com
- DNS ASK fy####wawvlxtk.com
- DNS ASK ot#####lppubfbqhgv.com
- DNS ASK dr###gjmrp.com
- DNS ASK cg###wlvs.com
- DNS ASK pa#####isflssooa.com
- DNS ASK cn###kryu.com
- DNS ASK ui####fiknlfh.com
- DNS ASK ps####fiispnbu.com
- DNS ASK bx####lgiphd.com
- DNS ASK dp#####ywkhhanyvw.com
- DNS ASK yw###sta.com
- DNS ASK au####gdsuinxk.com
- DNS ASK sc###efrgu.com
- DNS ASK sj####jflusmbb.com
- DNS ASK do#####hxojkwvjsflr.com
- DNS ASK ra####nkfeyayw.com
- DNS ASK ab#####wpcqnpeop.com
- DNS ASK ul#####unugnqjsf.com
- DNS ASK pw####dbykfarg.com
- DNS ASK rg###dyw.com
- DNS ASK th#####lptfeelnwc.com
- DNS ASK nm####bcyqss.com
- DNS ASK vb###sjdy.com
- DNS ASK xe#####jcqagcqeic.com
- DNS ASK mn#####gxeniuxpioq.com
- DNS ASK lp####jkrvtkpgw.com
- DNS ASK ki###rqr.com
- DNS ASK fc#####nanhtkedt.com
- DNS ASK vt####lifdlryd.com
- DNS ASK fd###cvlrx.com
- DNS ASK km###sdbqk.com
- DNS ASK kg###pbn.com
- DNS ASK dv####oqmtoct.com
- DNS ASK bing.com
- DNS ASK lh###ieidru.com
- DNS ASK bg#####abditnyvle.com
- DNS ASK qw#####knmilfrrniyl.com
- DNS ASK tl###bolig.com
- DNS ASK nn#####spyheuhralrt.com
- DNS ASK hi###lol.com
- DNS ASK dj####xvpmko.com
- DNS ASK te####inxfhasw.com
- DNS ASK er###nfmgrq.com
- DNS ASK ws####wsqmao.com
- DNS ASK as###ssomy.com
- DNS ASK co#####uxvlputvd.com
- DNS ASK bw#####uqivnnlcbmif.com
Miscellaneous
Creates and executes the following
- '%TEMP%\hhtdkihg.exe'
Executes the following
- '<SYSTEM32>\svchost.exe'
