Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender' = '<Full path to file>'
Modifies file system
Creates the following files
- %TEMP%\dddddddddddd
- %TEMP%\s33333333333
- %TEMP%\lttttttttttt
- %TEMP%\t66666666666
- %TEMP%\fggggggggggi
- %TEMP%\kmmmmmmmmmmm
- %TEMP%\elllllllllln
- %TEMP%\ciiikkkkkkkk
- %TEMP%\kuuuuuuuuuuu
- %TEMP%\t44444666666
- %TEMP%\t33333333333
- %TEMP%\immmmmmmmmmm
- %TEMP%\vbbbbbbbbbbb
- %TEMP%\p00001111111
- %TEMP%\ciiiiiiiiiii
- %TEMP%\zeeeeeeeeeee
- %TEMP%\osssssssssss
- %TEMP%\rvvvvvvvvvyy
- %TEMP%\muuuuuuuuuuu
- %TEMP%\mvvvvvvvvvvv
- %TEMP%\osuuuuuuuuuu
- %TEMP%\orrrrrrrrrrr
- %TEMP%\ptttttvvvvvv
- %TEMP%\bbbbbbbbbbbb
- %TEMP%\fggggggggggg
- %TEMP%\djjjjjjjjjjj
- %TEMP%\dkkkkkkkkkkk
- %TEMP%\r11111111113
- %TEMP%\gnnnnnnnnnnn
- %TEMP%\knnnnnnnnnnn
- %TEMP%\cddddddddddd
- %TEMP%\r11111111111
- %TEMP%\hooooooooooo
- %TEMP%\jrtttttttttt
- %TEMP%\x77777777777
- %TEMP%\xcceeeeeeeee
- %TEMP%\uzzzzzzzzzzz
- %TEMP%\ikkkkkkkkkkk
- %TEMP%\hooooooooqqq
- %TEMP%\vbbccccccccc
- %TEMP%\y99999999999
- %TEMP%\abbbbbbbbbbb
- %TEMP%\psssssssssss
- %TEMP%\yiiiiiiiiiii
- %TEMP%\beeeeeeeeeee
- %TEMP%\hppppppppppp
- %TEMP%\taaaaaaaaaaa
- %TEMP%\ovvvvvvvvvvv
- %TEMP%\t55555555555
- %TEMP%\ekkkkkkkkkkk
- %TEMP%\fggggiiiiiii
- %TEMP%\ammmmmmmmmmm
- %TEMP%\hjjjjjjjjjjj
- %TEMP%\v77777777777
- %TEMP%\aaaaaaaaaaaa
- %TEMP%\rvvvvvvvvvvv
- %TEMP%\nqqqqqqqqqqq
- %TEMP%\xcccccccccee
- %TEMP%\gppppppppppp
- %TEMP%\ijjjjjjjjjjj
- %TEMP%\xcccccceeeee
- %TEMP%\uzzzzbbbbbbf
- %TEMP%\ekkkkkkkkkkm
- %TEMP%\v66666666666
- %TEMP%\ybbbbbbbbbbb
- %TEMP%\lnnnnnnnnnnn
- %TEMP%\hjjjjjjlllll
- %TEMP%\dkkkkkkkkmmm
- %TEMP%\afhhhhhhhhhh
- %TEMP%\iqqqqqqqqqqq
- %TEMP%\eeeeeeeeeeee
- %TEMP%\pyyyyyyyy000
- %TEMP%\bhhhhhhhhhhh
- %TEMP%\quuuuuuuuuuu
- %TEMP%\elllllllllll
Deletes the following files
- %TEMP%\dddddddddddd
- %TEMP%\s33333333333
- %TEMP%\lttttttttttt
- %TEMP%\t66666666666
- %TEMP%\fggggggggggi
- %TEMP%\kmmmmmmmmmmm
- %TEMP%\elllllllllln
- %TEMP%\ciiikkkkkkkk
- %TEMP%\kuuuuuuuuuuu
- %TEMP%\t44444666666
- %TEMP%\t33333333333
- %TEMP%\immmmmmmmmmm
- %TEMP%\vbbbbbbbbbbb
- %TEMP%\p00001111111
- %TEMP%\ciiiiiiiiiii
- %TEMP%\zeeeeeeeeeee
- %TEMP%\osssssssssss
- %TEMP%\rvvvvvvvvvyy
- %TEMP%\muuuuuuuuuuu
- %TEMP%\mvvvvvvvvvvv
- %TEMP%\osuuuuuuuuuu
- %TEMP%\orrrrrrrrrrr
- %TEMP%\ptttttvvvvvv
- %TEMP%\bbbbbbbbbbbb
- %TEMP%\fggggggggggg
- %TEMP%\djjjjjjjjjjj
- %TEMP%\dkkkkkkkkkkk
- %TEMP%\r11111111113
- %TEMP%\gnnnnnnnnnnn
- %TEMP%\knnnnnnnnnnn
- %TEMP%\cddddddddddd
- %TEMP%\r11111111111
- %TEMP%\hooooooooooo
- %TEMP%\jrtttttttttt
- %TEMP%\x77777777777
- %TEMP%\xcceeeeeeeee
- %TEMP%\uzzzzzzzzzzz
- %TEMP%\ikkkkkkkkkkk
- %TEMP%\hooooooooqqq
- %TEMP%\vbbccccccccc
- %TEMP%\y99999999999
- %TEMP%\abbbbbbbbbbb
- %TEMP%\psssssssssss
- %TEMP%\yiiiiiiiiiii
- %TEMP%\beeeeeeeeeee
- %TEMP%\hppppppppppp
- %TEMP%\taaaaaaaaaaa
- %TEMP%\ovvvvvvvvvvv
- %TEMP%\t55555555555
- %TEMP%\ekkkkkkkkkkk
- %TEMP%\fggggiiiiiii
- %TEMP%\ammmmmmmmmmm
- %TEMP%\hjjjjjjjjjjj
- %TEMP%\v77777777777
- %TEMP%\aaaaaaaaaaaa
- %TEMP%\rvvvvvvvvvvv
- %TEMP%\nqqqqqqqqqqq
- %TEMP%\xcccccccccee
- %TEMP%\gppppppppppp
- %TEMP%\ijjjjjjjjjjj
- %TEMP%\xcccccceeeee
- %TEMP%\uzzzzbbbbbbf
- %TEMP%\ekkkkkkkkkkm
- %TEMP%\v66666666666
- %TEMP%\ybbbbbbbbbbb
- %TEMP%\lnnnnnnnnnnn
- %TEMP%\hjjjjjjlllll
- %TEMP%\dkkkkkkkkmmm
- %TEMP%\afhhhhhhhhhh
- %TEMP%\iqqqqqqqqqqq
- %TEMP%\eeeeeeeeeeee
- %TEMP%\pyyyyyyyy000
- %TEMP%\bhhhhhhhhhhh
- %TEMP%\quuuuuuuuuuu
- %TEMP%\elllllllllll
Substitutes the following files
- %TEMP%\v77777777777
- %TEMP%\psssssssssss
- %TEMP%\lnnnnnnnnnnn
- %TEMP%\iqqqqqqqqqqq
- %TEMP%\quuuuuuuuuuu
- %TEMP%\y99999999999
- %TEMP%\ikkkkkkkkkkk
- %TEMP%\zeeeeeeeeeee
- %TEMP%\dkkkkkkkkkkk
- %TEMP%\vbbbbbbbbbbb
Network activity
TCP
HTTP GET requests
- http://www.go###e.com.br/intl/pt-BR_br/images/logo.gif
UDP
- DNS ASK go###e.com.br
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Log Project'
Creates and executes the following
- '%WINDIR%\syswow64\sc.exe' query updates' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' query updates
