Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '*EvtMgr32' = '%WINDIR%\{01044D45-6B75-1FE8-7744-CA3E1F40881D}.exe'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\{01044D45-6B75-1FE8-7744-CA3E1F40881D}.exe' /rm "<Full path to virus>"
Modifies file system :
Creates the following files:
- %WINDIR%\{01044D45-6B75-1FE8-7744-CA3E1F40881D}.exe
Sets the 'hidden' attribute to the following files:
- %WINDIR%\{01044D45-6B75-1FE8-7744-CA3E1F40881D}.exe
Deletes itself.
Network activity:
Connects to:
- 'ub#####uqvpbdp.co.uk':80
- 'im####rhnsjxds.info':80
- 'hy####tiemvqmu.org':80
- 'gd####ofbeavdt.biz':80
- 'tf####urnntgdc.ru':80
- 'oy####ubjtppry.ru':80
- 'pm####yvvslvau.org':80
- 'wk####dwdkydvi.biz':80
- 'vo####xtacdidt.com':80
- 'ji####wkqbfsfu.net':80
- 'un####hvimqbfk.biz':80
- 'vy####gdjyppyn.ru':80
- 'ta####thftgqgi.net':80
- 'rs####btjsbuhg.info':80
- 'fu####qdmvgbhe.com':80
- 'ao####herickkm.com':80
- 'bc####usubmusu.net':80
- 'yd####iwqvdvjd.info':80
- 'wm####trmraahd.org':80
- 'xp#####indslki.co.uk':80
- 'ie####frcqvntc.org':80
- 'yp#####bttiesw.co.uk':80
- 'uc####piynqhte.ru':80
- 'sd####ksxsqqbb.net':80
- 'gf####acbvvwri.biz':80
- 'by####qdgirgem.biz':80
- 'cm####erjbcqdh.ru':80
- 'cc####gfxhsfbw.net':80
- 'ad####bpwmsory.info':80
- 'bo####squoiush.com':80
- 'rv####cxihuxlg.net':80
- 're####dgyqumfi.biz':80
- 'qi####xdviyrdr.com':80
- 'pu#####emclkbo.co.uk':80
- 'qi####eyybhqat.info':80
- 'ss####mgmyhfbb.info':80
- 'gu####cppcmlbg.com':80
- 'ev#####aohmurt.co.uk':80
- 'sr####hblpqseg.ru':80
- 'qt####hqlehobf.org':80
- 'iv####gnjdhnyb.com':80
- 'hq####dkvsxlqq.net':80
- 'hg####syqvxyqs.info':80
- 'fh####njpbxiqi.org':80
- 'gw#####xiihwpd.co.uk':80
- 'bn#####imchosy.co.uk':80
- 'op####buylbysh.info':80
- 'kf####vopuhqrx.org':80
- 'ig####qyoahaps.biz':80
- 'jp####iawnxcji.ru':80
- 'oc####bkifvkek.org':80
- 'dw#####qqeiuny.co.uk':80
- 'bx####lbpjiend.ru':80
- '17#.#38.171.62':80
- 'yl####tikviaqe.biz':80
- 'fg####grwvixru.biz':80
- 'sk####vbprvera.ru':80
- 'ql####qlowvnpg.net':80
- 'qb####gajavbnw.info':80
- 'dh####bcvbihyr.com':80
- 'pi####spvwrvtc.info':80
- 'le####nwwefbow.com':80
- 'ou#####ujxvpue.co.uk':80
- 'ny####cfdbjdlb.ru':80
- 'om####gapafjtp.org':80
- 'pt####oxfnrvhq.org':80
- 'dv#####hiqwcxx.co.uk':80
- 'bf####pcemtghs.ru':80
- 'yg####dgahkhfl.net':80
- 'nd####asbjoahn.biz':80
- 'sf####cvhuntlw.ru':80
- 'gy####iybigvuk.org':80
- 'fd####vjultjlv.biz':80
- 'cj####hxsytbuu.com':80
- 'pl####nkfinllp.net':80
- 'kf####ntbojuji.net':80
- 'ls####ronnfbin.biz':80
- 'kw####fyhqsopt.com':80
- 'tb#####lnraglx.co.uk':80
- 'jj####beurwihx.info':80
UDP:
- DNS ASK ub#####uqvpbdp.co.uk
- DNS ASK im####rhnsjxds.info
- DNS ASK tf####urnntgdc.ru
- DNS ASK hy####tiemvqmu.org
- DNS ASK vo####xtacdidt.com
- DNS ASK oy####ubjtppry.ru
- DNS ASK pm####yvvslvau.org
- DNS ASK ji####wkqbfsfu.net
- DNS ASK wk####dwdkydvi.biz
- DNS ASK gd####ofbeavdt.biz
- DNS ASK un####hvimqbfk.biz
- DNS ASK vy####gdjyppyn.ru
- DNS ASK fu####qdmvgbhe.com
- DNS ASK ta####thftgqgi.net
- DNS ASK wm####trmraahd.org
- DNS ASK ao####herickkm.com
- DNS ASK bc####usubmusu.net
- DNS ASK xp#####indslki.co.uk
- DNS ASK yd####iwqvdvjd.info
- DNS ASK pu#####emclkbo.co.uk
- DNS ASK ie####frcqvntc.org
- DNS ASK yp#####bttiesw.co.uk
- DNS ASK gf####acbvvwri.biz
- DNS ASK uc####piynqhte.ru
- DNS ASK ad####bpwmsory.info
- DNS ASK by####qdgirgem.biz
- DNS ASK cm####erjbcqdh.ru
- DNS ASK bo####squoiush.com
- DNS ASK cc####gfxhsfbw.net
- DNS ASK sd####ksxsqqbb.net
- DNS ASK rv####cxihuxlg.net
- DNS ASK re####dgyqumfi.biz
- DNS ASK qi####eyybhqat.info
- DNS ASK qi####xdviyrdr.com
- DNS ASK sr####hblpqseg.ru
- DNS ASK ss####mgmyhfbb.info
- DNS ASK gu####cppcmlbg.com
- DNS ASK qt####hqlehobf.org
- DNS ASK ev#####aohmurt.co.uk
- DNS ASK rs####btjsbuhg.info
- DNS ASK iv####gnjdhnyb.com
- DNS ASK hq####dkvsxlqq.net
- DNS ASK gw#####xiihwpd.co.uk
- DNS ASK hg####syqvxyqs.info
- DNS ASK ig####qyoahaps.biz
- DNS ASK bn#####imchosy.co.uk
- DNS ASK op####buylbysh.info
- DNS ASK jp####iawnxcji.ru
- DNS ASK kf####vopuhqrx.org
- DNS ASK fh####njpbxiqi.org
- DNS ASK oc####bkifvkek.org
- DNS ASK dw#####qqeiuny.co.uk
- DNS ASK yl####tikviaqe.biz
- DNS ASK bx####lbpjiend.ru
- DNS ASK qb####gajavbnw.info
- DNS ASK fg####grwvixru.biz
- DNS ASK sk####vbprvera.ru
- DNS ASK dh####bcvbihyr.com
- DNS ASK ql####qlowvnpg.net
- DNS ASK cj####hxsytbuu.com
- DNS ASK pi####spvwrvtc.info
- DNS ASK le####nwwefbow.com
- DNS ASK om####gapafjtp.org
- DNS ASK ou#####ujxvpue.co.uk
- DNS ASK yg####dgahkhfl.net
- DNS ASK pt####oxfnrvhq.org
- DNS ASK dv#####hiqwcxx.co.uk
- DNS ASK nd####asbjoahn.biz
- DNS ASK bf####pcemtghs.ru
- DNS ASK ny####cfdbjdlb.ru
- DNS ASK sf####cvhuntlw.ru
- DNS ASK gy####iybigvuk.org
- DNS ASK pl####nkfinllp.net
- DNS ASK fd####vjultjlv.biz
- DNS ASK tb#####lnraglx.co.uk
- DNS ASK kf####ntbojuji.net
- DNS ASK ls####ronnfbin.biz
- DNS ASK jj####beurwihx.info
- DNS ASK kw####fyhqsopt.com
