Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'Microsoft Windows Driver' = '%WINDIR%\346528901\sysgnzs.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'Microsoft Windows Driver' = '%WINDIR%\346528901\sysgnzs.exe'
Infects the following executable files
- <Drive name for removable media>:\__\utorrent.exe
- <Drive name for removable media>:\__\skypesetup.exe
- <Drive name for removable media>:\__\wrar520.exe
- <Drive name for removable media>:\__\dotnetfx45_full_setup.exe
- <Drive name for removable media>:\__\winmine.exe
- <Drive name for removable media>:\__\chromesetup.exe
- <Drive name for removable media>:\__\jre-7u75-windows-i586-iftw.exe
Creates the following files on removable media
- <Drive name for removable media>:\__\drivemgr.exe
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\asaprojectcompetition.pptx
- <Drive name for removable media>:\sim_gametheory_to_finance.ppt
- <Drive name for removable media>:\file1.ppt
- <Drive name for removable media>:\accountsreceivable.ppt
- <Drive name for removable media>:\mappingconcepthubberlin.ppt
- <Drive name for removable media>:\proposaltemplates.ppt
- <Drive name for removable media>:\background.png
- <Drive name for removable media>:\cleanlyrics.png
- <Drive name for removable media>:\bg_search_box.png
- <Drive name for removable media>:\digest.rdf
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\calibre.png
- <Drive name for removable media>:\dissolveanother.png
- <Drive name for removable media>:\block.png
- <Drive name for removable media>:\hhhlcert.pem
- <Drive name for removable media>:\irgeek.pem
- <Drive name for removable media>:\server.pem
- <Drive name for removable media>:\investmentbankca_ca8.pem
- <Drive name for removable media>:\tunpersonalca1.pem
- <Drive name for removable media>:\dualectls.pdf
- <Drive name for removable media>:\fil_20060629111052.pdf
- <Drive name for removable media>:\cbz.png
- <Drive name for removable media>:\advice_process.htm
- <Drive name for removable media>:\sioc.rdf
- <Drive name for removable media>:\removedtitles_records.zip
- <Drive name for removable media>:\contractualdeadlines.zip
- <Drive name for removable media>:\calculatorworksheet.zip
- <Drive name for removable media>:\price.zip
- <Drive name for removable media>:\highly_cited_2001.xlsx
- <Drive name for removable media>:\national_autism_preparation_programs.xlsx
- <Drive name for removable media>:\trtf_matrix2012_oct.xlsx
- <Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx
- <Drive name for removable media>:\2013_smccc_competition_points_jul2013.xlsx
- <Drive name for removable media>:\disclosuredetails.xlsx
- <Drive name for removable media>:\2013_finalsummaryforweb.xlsx
- <Drive name for removable media>:\fiche_inscription_2015.xls
- <Drive name for removable media>:\productos.xls
- <Drive name for removable media>:\guide_reorganization_mapping.xls
- <Drive name for removable media>:\subjectclassification.xls
- <Drive name for removable media>:\excel_example.xls
- <Drive name for removable media>:\passport_pal.wmv
- <Drive name for removable media>:\flower_trans_matte.wmv
- <Drive name for removable media>:\fungalnameauthors.rtf
- <Drive name for removable media>:\taxus_baccata.rdf
- <Drive name for removable media>:\elvisimp.rdf
- <Drive name for removable media>:\schema.rdf
- <Drive name for removable media>:\foaf.rdf
- <Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf
- <Drive name for removable media>:\breakpoint.png
- <Drive name for removable media>:\ff_ot_user_guide.pdf
- <Drive name for removable media>:\10thingscondoms.pdf
- <Drive name for removable media>:\spib_pima.pdf
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
- <Drive name for removable media>:\chromesetup.exe
- <Drive name for removable media>:\winmine.exe
- <Drive name for removable media>:\dotnetfx45_full_setup.exe
- <Drive name for removable media>:\wrar520.exe
- <Drive name for removable media>:\skypesetup.exe
- <Drive name for removable media>:\utorrent.exe
- <Drive name for removable media>:\issi2013_template_for_posters.docx
- <Drive name for removable media>:\file_p_00000000_1371597592.docx
- <Drive name for removable media>:\cveuropeo.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\64bit_notes.htm
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\.lnk
- <Drive name for removable media>:\1sm_price.zip
- <Drive name for removable media>:\contenttypes.rdf
- <Drive name for removable media>:\garden.htm
- <Drive name for removable media>:\trivial-merge.html
- <Drive name for removable media>:\iisstart.htm
- <Drive name for removable media>:\clip_1080_5sec_10mbps_h264.mp4
- <Drive name for removable media>:\video.mp4
- <Drive name for removable media>:\dag2_panel1_320_ref.mov
- <Drive name for removable media>:\scan.mov
- <Drive name for removable media>:\parnas_01.jpg
- <Drive name for removable media>:\168.jpg
- <Drive name for removable media>:\210252809.jpg
- <Drive name for removable media>:\13.jpg
- <Drive name for removable media>:\region-north-karelia.jpg
- <Drive name for removable media>:\4f0bf7ff71f28.jpg
- <Drive name for removable media>:\13.jpeg
- <Drive name for removable media>:\pushkin.jpeg
- <Drive name for removable media>:\3.jpeg
- <Drive name for removable media>:\1189.jpeg
- <Drive name for removable media>:\parnas_01.jpeg
- <Drive name for removable media>:\ituneshelpunavailable.html
- <Drive name for removable media>:\browse.html
- <Drive name for removable media>:\adadsi.html
- <Drive name for removable media>:\iisstart.html
- <Drive name for removable media>:\about.html
- <Drive name for removable media>:\tree_view.html
- <Drive name for removable media>:\howto-index.html
- <Drive name for removable media>:\trivial-merge.htm
- <Drive name for removable media>:\subjectclassification.zip
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\346528901\sysgnzs.exe' = '%WINDIR%\346528901\sysgnzs.exe:...
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
- Windows Security Center
Modifies file system
Creates the following files
- %WINDIR%\346528901\sysgnzs.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\346528901\sysgnzs.exe
- <Drive name for removable media>:\.lnk
Network activity
Connects to
- '19#.#2.161.73':80
UDP
- DNS ASK he####fiehggglaf.co
- DNS ASK oe####euoeuoaztd.io
- DNS ASK ou####sgoahutztd.io
- DNS ASK ro####risioroztd.io
- DNS ASK ei####ihoaeruztd.io
- DNS ASK so####soeuhugztd.io
- DNS ASK he####fiehgggztd.io
- DNS ASK gs####irhgsgrztd.io
- DNS ASK ou####aoaoeeuztd.io
- DNS ASK ai####zezeezeztd.io
- DNS ASK pl####iszsgettrs.cc
- DNS ASK aa####iifoogetrs.cc
- DNS ASK ba####bfbfigotrs.cc
- DNS ASK in####infinigtrs.cc
- DNS ASK aa####iiioffftrs.cc
- DNS ASK aa####eieiieetrs.cc
- DNS ASK eo####ubfeuuetrs.cc
- DNS ASK bn####arubgzdtrs.cc
- DNS ASK ho####irjgrijlaf.co
- DNS ASK oe####ueueuueztd.io
- DNS ASK aa####iifoogepnr.su
- DNS ASK ba####bfbfigopnr.su
- DNS ASK in####infinigpnr.su
- DNS ASK aa####iiiofffpnr.su
- DNS ASK aa####eieiieepnr.su
- DNS ASK eo####ubfeuuepnr.su
- DNS ASK oe####ueueuuepnr.su
- DNS ASK ou####sgoahutpnr.su
- DNS ASK ro####risioropnr.su
- DNS ASK ei####ihoaerupnr.su
- DNS ASK so####soeuhugpnr.su
- DNS ASK he####fiehgggpnr.su
- DNS ASK gs####irhgsgrpnr.su
- DNS ASK ba####bfbfigoztd.io
- DNS ASK in####infinigztd.io
- DNS ASK aa####iiiofffztd.io
- DNS ASK aa####eieiieeztd.io
- DNS ASK oe####ueueuuetrs.cc
- DNS ASK ev####eigohehtrs.cc
- DNS ASK ou####aoaoeeutrs.cc
- DNS ASK ai####zezeezetrs.cc
- DNS ASK oe####euoeuoatrs.cc
- DNS ASK oe####ueueuuelaf.co
- DNS ASK ev####eigohehlaf.co
- DNS ASK pl####iszsgetlaf.co
- DNS ASK aa####iifoogelaf.co
- DNS ASK ba####bfbfigolaf.co
- DNS ASK in####infiniglaf.co
- DNS ASK aa####iiioffflaf.co
- DNS ASK eo####ubfeuuelaf.co
- DNS ASK ou####aoaoeeulaf.co
- DNS ASK ai####aaanggilaf.co
- DNS ASK ai####zezeezelaf.co
- DNS ASK oe####euoeuoalaf.co
- DNS ASK ou####sgoahutlaf.co
- DNS ASK ro####risiorolaf.co
- DNS ASK ei####ihoaerulaf.co
- DNS ASK so####soeuhuglaf.co
- DNS ASK gs####irhgsgrlaf.co
- DNS ASK pl####iszsgetpnr.su
- DNS ASK eo####ubfeuueztd.io
- DNS ASK gh####rruheudlaf.co
- DNS ASK ne####heudhuelaf.co
- DNS ASK bn####arubgzdlaf.co
- DNS ASK ou####sgoahuttrs.cc
- DNS ASK ro####risiorotrs.cc
- DNS ASK ei####ihoaerutrs.cc
- DNS ASK ae####aeoueorlaf.co
- DNS ASK fg####fouehurlaf.co
- DNS ASK lp####hzieuaelaf.co
- DNS ASK bu####oaoeoadlaf.co
- DNS ASK bu####fuueofhlaf.co
- DNS ASK fe####anednuelaf.co
- DNS ASK gu####hdaouehlaf.co
- DNS ASK ae####aeudofrlaf.co
- DNS ASK rg####houaefelaf.co
- DNS ASK gh####uahfuohlaf.co
- DNS ASK ae####aueajdulaf.co
- DNS ASK ru####fhefhuglaf.co
- DNS ASK go####ofhrufhlaf.co
- DNS ASK gh####uofeofhlaf.co
- DNS ASK ev####eigohehpnr.su
Miscellaneous
Creates and executes the following
- '%WINDIR%\346528901\sysgnzs.exe'
