Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NGEN Class User NetBIOS Base Web PC AutoConfig' = 'C:\vtuu2nzoqtq\hghhnqmb7rg.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Foundation Removal Cryptographic] 'ImagePath' = 'C:\vtuu2nzoqtq\hghhnqmb7rg.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Foundation Removal Cryptographic] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\vtuu2nzoqtq\a1egzr0ir.exe' "c:\vtuu2nzoqtq\hghhnqmb7rg.exe"
- 'C:\vtuu2nzoqtq\hghhnqmb7rg.exe'
- 'C:\vtuu2nzoqtq\jm0naloh3ap0zm4iqk3xnsa.exe'
Modifies file system:
Creates the following files:
- C:\vtuu2nzoqtq\hghhnqmb7rg.exe
- C:\vtuu2nzoqtq\a1egzr0ir.exe
- C:\vtuu2nzoqtq\bsxssc1v9a9x
- %WINDIR%\vtuu2nzoqtq\tjt3vf
- C:\vtuu2nzoqtq\tjt3vf
- C:\vtuu2nzoqtq\jm0naloh3ap0zm4iqk3xnsa.exe
Sets the 'hidden' attribute to the following files:
- C:\vtuu2nzoqtq\a1egzr0ir.exe
- C:\vtuu2nzoqtq\hghhnqmb7rg.exe
Deletes the following files:
- C:\vtuu2nzoqtq\jm0naloh3ap0zm4iqk3xnsa.exe
- %WINDIR%\vtuu2nzoqtq\tjt3vf
Network activity:
Connects to:
- 'ea#####inewalterson.net':80
- 'wa#####tonwalterson.net':80
- 'ea#####inewestbrook.net':80
- 'sa######ellblakeslee.net':80
- 'wi#####inaalexander.net':80
- 'sa######ellalexander.net':80
- 'wi#####inablakeslee.net':80
- 'wa#####tonwestbrook.net':80
- 'du#####llawalterson.net':80
- 'ch#####anawalterson.net':80
- 'du#####llawestbrook.net':80
- 'wa#####tonblakeslee.net':80
- 'ea#####inealexander.net':80
- 'wa#####tonalexander.net':80
- 'ea#####ineblakeslee.net':80
- 'ma######ianwalterson.net':80
- 'gw#####inewestbrook.net':80
- 'ma######ianwestbrook.net':80
- 'gw#####inewalterson.net':80
- 'be#####ardalexander.net':80
- 'ev#####inablakeslee.net':80
- 'be#####ardblakeslee.net':80
- 'gw#####inealexander.net':80
- 'sa######ellwalterson.net':80
- 'wi#####inawestbrook.net':80
- 'sa######ellwestbrook.net':80
- 'wi#####inawalterson.net':80
- 'ma######ianalexander.net':80
- 'gw#####ineblakeslee.net':80
- 'ma######ianblakeslee.net':80
- 'ch#####anawestbrook.net':80
- 'al######inablakeslee.net':80
- 'ev#####inemasterson.net':80
- 'ri#####inemasterson.net':80
- 'ma#####llablakeslee.net':80
- 'al######inawestbrook.net':80
- 'ma#####llaalexander.net':80
- 'al######inaalexander.net':80
- 'ev#####ineoliverson.net':80
- 'ri#####ineblackburn.net':80
- 'ev#####inamasterson.net':80
- 'be#####ardmasterson.net':80
- 'ev#####ineblackburn.net':80
- 'ri#####ineoliverson.net':80
- 'ev#####inepemberton.net':80
- 'ri#####inepemberton.net':80
- 'wi#####hbywalterson.net':80
- 'ba######mewwalterson.net':80
- 'wi#####hbywestbrook.net':80
- 'ch#####anablakeslee.net':80
- 'du#####llaalexander.net':80
- 'ch#####anaalexander.net':80
- 'du#####llablakeslee.net':80
- 'ba######mewwestbrook.net':80
- 'ma#####llawalterson.net':80
- 'al######inawalterson.net':80
- 'ma#####llawestbrook.net':80
- 'ba######mewblakeslee.net':80
- 'wi#####hbyalexander.net':80
- 'ba######mewalexander.net':80
- 'wi#####hbyblakeslee.net':80
TCP:
HTTP GET requests:
- http://ea#####inewalterson.net/index.php
- http://wa#####tonwalterson.net/index.php
- http://ea#####inewestbrook.net/index.php
- http://sa######ellblakeslee.net/index.php
- http://wi#####inaalexander.net/index.php
- http://sa######ellalexander.net/index.php
- http://wi#####inablakeslee.net/index.php
- http://wa#####tonwestbrook.net/index.php
- http://du#####llawalterson.net/index.php
- http://ch#####anawalterson.net/index.php
- http://du#####llawestbrook.net/index.php
- http://wa#####tonblakeslee.net/index.php
- http://ea#####inealexander.net/index.php
- http://wa#####tonalexander.net/index.php
- http://ea#####ineblakeslee.net/index.php
- http://ma######ianwalterson.net/index.php
- http://gw#####inewestbrook.net/index.php
- http://ma######ianwestbrook.net/index.php
- http://gw#####inewalterson.net/index.php
- http://be#####ardalexander.net/index.php
- http://ev#####inablakeslee.net/index.php
- http://be#####ardblakeslee.net/index.php
- http://gw#####inealexander.net/index.php
- http://sa######ellwalterson.net/index.php
- http://wi#####inawestbrook.net/index.php
- http://sa######ellwestbrook.net/index.php
- http://wi#####inawalterson.net/index.php
- http://ma######ianalexander.net/index.php
- http://gw#####ineblakeslee.net/index.php
- http://ma######ianblakeslee.net/index.php
- http://ch#####anawestbrook.net/index.php
- http://al######inablakeslee.net/index.php
- http://ev#####inemasterson.net/index.php
- http://ri#####inemasterson.net/index.php
- http://ma#####llablakeslee.net/index.php
- http://al######inawestbrook.net/index.php
- http://ma#####llaalexander.net/index.php
- http://al######inaalexander.net/index.php
- http://ev#####ineoliverson.net/index.php
- http://ri#####ineblackburn.net/index.php
- http://ev#####inamasterson.net/index.php
- http://be#####ardmasterson.net/index.php
- http://ev#####ineblackburn.net/index.php
- http://ri#####ineoliverson.net/index.php
- http://ev#####inepemberton.net/index.php
- http://ri#####inepemberton.net/index.php
- http://wi#####hbywalterson.net/index.php
- http://ba######mewwalterson.net/index.php
- http://wi#####hbywestbrook.net/index.php
- http://ch#####anablakeslee.net/index.php
- http://du#####llaalexander.net/index.php
- http://ch#####anaalexander.net/index.php
- http://du#####llablakeslee.net/index.php
- http://ba######mewwestbrook.net/index.php
- http://ma#####llawalterson.net/index.php
- http://al######inawalterson.net/index.php
- http://ma#####llawestbrook.net/index.php
- http://ba######mewblakeslee.net/index.php
- http://wi#####hbyalexander.net/index.php
- http://ba######mewalexander.net/index.php
- http://wi#####hbyblakeslee.net/index.php
UDP:
- DNS ASK ea#####inewalterson.net
- DNS ASK wa#####tonwalterson.net
- DNS ASK ea#####inewestbrook.net
- DNS ASK sa######ellblakeslee.net
- DNS ASK wi#####inaalexander.net
- DNS ASK sa######ellalexander.net
- DNS ASK wi#####inablakeslee.net
- DNS ASK wa#####tonwestbrook.net
- DNS ASK du#####llawalterson.net
- DNS ASK ch#####anawalterson.net
- DNS ASK du#####llawestbrook.net
- DNS ASK wa#####tonblakeslee.net
- DNS ASK ea#####inealexander.net
- DNS ASK wa#####tonalexander.net
- DNS ASK ea#####ineblakeslee.net
- DNS ASK sa######ellwestbrook.net
- DNS ASK gw#####inewalterson.net
- DNS ASK ma######ianwalterson.net
- DNS ASK gw#####inewestbrook.net
- DNS ASK be#####ardblakeslee.net
- DNS ASK ev#####inaalexander.net
- DNS ASK be#####ardalexander.net
- DNS ASK ev#####inablakeslee.net
- DNS ASK ma######ianwestbrook.net
- DNS ASK wi#####inawalterson.net
- DNS ASK sa######ellwalterson.net
- DNS ASK wi#####inawestbrook.net
- DNS ASK ma######ianblakeslee.net
- DNS ASK gw#####inealexander.net
- DNS ASK ma######ianalexander.net
- DNS ASK gw#####ineblakeslee.net
- DNS ASK al######inablakeslee.net
- DNS ASK ev#####inemasterson.net
- DNS ASK ri#####inemasterson.net
- DNS ASK ma#####llablakeslee.net
- DNS ASK al######inawestbrook.net
- DNS ASK ma#####llaalexander.net
- DNS ASK al######inaalexander.net
- DNS ASK ev#####ineoliverson.net
- DNS ASK ri#####ineblackburn.net
- DNS ASK ev#####inamasterson.net
- DNS ASK be#####ardmasterson.net
- DNS ASK ev#####ineblackburn.net
- DNS ASK ri#####ineoliverson.net
- DNS ASK ev#####inepemberton.net
- DNS ASK ri#####inepemberton.net
- DNS ASK ma#####llawestbrook.net
- DNS ASK ch#####anablakeslee.net
- DNS ASK wi#####hbywalterson.net
- DNS ASK ba######mewwalterson.net
- DNS ASK du#####llablakeslee.net
- DNS ASK ch#####anawestbrook.net
- DNS ASK du#####llaalexander.net
- DNS ASK ch#####anaalexander.net
- DNS ASK wi#####hbywestbrook.net
- DNS ASK ba######mewblakeslee.net
- DNS ASK ma#####llawalterson.net
- DNS ASK al######inawalterson.net
- DNS ASK wi#####hbyblakeslee.net
- DNS ASK ba######mewwestbrook.net
- DNS ASK wi#####hbyalexander.net
- DNS ASK ba######mewalexander.net
