Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Protection Engine AuthIP Video NGEN IKE' = '<SYSTEM32>\kqdseusawas.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Encrypting Locator Secure] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\xcmgikwr.exe' "<SYSTEM32>\kqdseusawas.exe"
- '%WINDIR%\Temp\cngphw2sn9iyj.exe' -r 29072 tcp
- '%TEMP%\cngphw2mkiiyjsyc0xf.exe'
- '<SYSTEM32>\kqdseusawas.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\elojibutfacpklb\run
- <SYSTEM32>\elojibutfacpklb\rng
- %WINDIR%\Temp\cngphw2sn9iyj.exe
- <SYSTEM32>\elojibutfacpklb\cfg
- <SYSTEM32>\xcmgikwr.exe
- %TEMP%\cngphw2mkiiyjsyc0xf.exe
- <SYSTEM32>\elojibutfacpklb\tst
- <SYSTEM32>\kqdseusawas.exe
- <SYSTEM32>\elojibutfacpklb\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\xcmgikwr.exe
- <SYSTEM32>\kqdseusawas.exe
Deletes the following files:
- %WINDIR%\Temp\cngphw2sn9iyj.exe
- %TEMP%\cngphw2mkiiyjsyc0xf.exe
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'lo###ast.net':80
- 'so###ast.net':80
- 'lo###ing.net':80
- 'so###ing.net':80
- 'lo###ady.net':80
- 'so###ish.net':80
- 'wh###wing.net':80
- 'so###ady.net':80
- 'lo###ish.net':80
- 'de####erhalf.net':80
- 'al###name.net':80
- 'fr###ylate.net':80
- 'al###half.net':80
- 'de####ername.net':80
- 'al###late.net':80
- 'de####erlate.net':80
- 'al###guide.net':80
- 'de####erguide.net':80
- 'st###lady.net':80
- 'ba###ady.net':80
- 'st###past.net':80
- 'ba###ast.net':80
- 'st###fish.net':80
- 'li###ing.net':80
- 'en###past.net':80
- 'ba###ish.net':80
- 'en###wing.net':80
- 'sa###ast.net':80
- 'wh###lady.net':80
- 'sa###ing.net':80
- 'wh###past.net':80
- 'sa###ady.net':80
- 'st###wing.net':80
- 'ba###ing.net':80
- 'wh###fish.net':80
- 'sa###ish.net':80
- 'en###late.net':80
- 'li###ate.net':80
- 'th####hcountry.net':80
- 'li###uide.net':80
- 'mo###half.net':80
- 'ti###ame.net':80
- 'mo###guide.net':80
- 'ti###alf.net':80
- 'mo###name.net':80
- 'mi####lossary.net':80
- 're####eneither.net':80
- 'st###march.net':80
- 'ta###fruit.net':80
- 'ge####friend.net':80
- 're####erpaint.net':80
- 'li####appear.net':80
- 'gl###health.net':80
- 'ne####arydress.net':80
- 'pu###alf.net':80
- 'fr###yhalf.net':80
- 'sh###late.net':80
- 'de###ate.net':80
- 'pu###ame.net':80
- 'fr###yguide.net':80
- 'pu###ate.net':80
- 'fr###yname.net':80
- 'pu###uide.net':80
- 'ti###ate.net':80
- 'sh###half.net':80
- 'ti###uide.net':80
- 'mo###late.net':80
- 'de###alf.net':80
- 'sh###guide.net':80
- 'de###uide.net':80
- 'sh###name.net':80
- 'de###ame.net':80
TCP:
HTTP GET requests:
- lo###ast.net/forum/search.php?me#########################################
- so###ast.net/forum/search.php?me#########################################
- lo###ing.net/forum/search.php?me#########################################
- so###ing.net/forum/search.php?me#########################################
- lo###ady.net/forum/search.php?me#########################################
- so###ish.net/forum/search.php?me#########################################
- wh###wing.net/forum/search.php?me#########################################
- so###ady.net/forum/search.php?me#########################################
- lo###ish.net/forum/search.php?me#########################################
- de####erhalf.net/forum/search.php?me#########################################
- al###name.net/forum/search.php?me#########################################
- fr###ylate.net/forum/search.php?me#########################################
- al###half.net/forum/search.php?me#########################################
- de####ername.net/forum/search.php?me#########################################
- al###late.net/forum/search.php?me#########################################
- de####erlate.net/forum/search.php?me#########################################
- al###guide.net/forum/search.php?me#########################################
- de####erguide.net/forum/search.php?me#########################################
- st###lady.net/forum/search.php?me#########################################
- ba###ady.net/forum/search.php?me#########################################
- st###past.net/forum/search.php?me#########################################
- ba###ast.net/forum/search.php?me#########################################
- st###fish.net/forum/search.php?me#########################################
- li###ing.net/forum/search.php?me#########################################
- en###past.net/forum/search.php?me#########################################
- ba###ish.net/forum/search.php?me#########################################
- en###wing.net/forum/search.php?me#########################################
- sa###ast.net/forum/search.php?me#########################################
- wh###lady.net/forum/search.php?me#########################################
- sa###ing.net/forum/search.php?me#########################################
- wh###past.net/forum/search.php?me#########################################
- sa###ady.net/forum/search.php?me#########################################
- st###wing.net/forum/search.php?me#########################################
- ba###ing.net/forum/search.php?me#########################################
- wh###fish.net/forum/search.php?me#########################################
- sa###ish.net/forum/search.php?me#########################################
- en###late.net/forum/search.php?me#########################################
- li###ate.net/forum/search.php?me#########################################
- th####hcountry.net/forum/search.php?me#########################################
- li###uide.net/forum/search.php?me#########################################
- mo###half.net/forum/search.php?me#########################################
- ti###ame.net/forum/search.php?me#########################################
- mo###guide.net/forum/search.php?me#########################################
- ti###alf.net/forum/search.php?me#########################################
- mo###name.net/forum/search.php?me#########################################
- mi####lossary.net/forum/search.php?me#########################################
- re####eneither.net/forum/search.php?me#########################################
- st###march.net/forum/search.php?me#########################################
- ta###fruit.net/forum/search.php?me#########################################
- ge####friend.net/forum/search.php?me#########################################
- re####erpaint.net/forum/search.php?me#########################################
- li####appear.net/forum/search.php?me#########################################
- gl###health.net/forum/search.php?me#########################################
- ne####arydress.net/forum/search.php?me#########################################
- pu###alf.net/forum/search.php?me#########################################
- fr###yhalf.net/forum/search.php?me#########################################
- sh###late.net/forum/search.php?me#########################################
- de###ate.net/forum/search.php?me#########################################
- pu###ame.net/forum/search.php?me#########################################
- fr###yguide.net/forum/search.php?me#########################################
- pu###ate.net/forum/search.php?me#########################################
- fr###yname.net/forum/search.php?me#########################################
- pu###uide.net/forum/search.php?me#########################################
- ti###ate.net/forum/search.php?me#########################################
- sh###half.net/forum/search.php?me#########################################
- ti###uide.net/forum/search.php?me#########################################
- mo###late.net/forum/search.php?me#########################################
- de###alf.net/forum/search.php?me#########################################
- sh###guide.net/forum/search.php?me#########################################
- de###uide.net/forum/search.php?me#########################################
- sh###name.net/forum/search.php?me#########################################
- de###ame.net/forum/search.php?me#########################################
UDP:
- DNS ASK lo###ast.net
- DNS ASK so###ast.net
- DNS ASK lo###ing.net
- DNS ASK so###ing.net
- DNS ASK lo###ady.net
- DNS ASK so###ish.net
- DNS ASK wh###wing.net
- DNS ASK so###ady.net
- DNS ASK lo###ish.net
- DNS ASK de####erhalf.net
- DNS ASK al###name.net
- DNS ASK fr###ylate.net
- DNS ASK al###half.net
- DNS ASK de####ername.net
- DNS ASK al###late.net
- DNS ASK de####erlate.net
- DNS ASK al###guide.net
- DNS ASK de####erguide.net
- DNS ASK sa###ing.net
- DNS ASK ba###ady.net
- DNS ASK st###fish.net
- DNS ASK ba###ast.net
- DNS ASK st###lady.net
- DNS ASK ba###ish.net
- DNS ASK en###past.net
- DNS ASK li###ast.net
- DNS ASK en###wing.net
- DNS ASK li###ing.net
- DNS ASK wh###lady.net
- DNS ASK sa###ady.net
- DNS ASK wh###past.net
- DNS ASK sa###ast.net
- DNS ASK wh###fish.net
- DNS ASK ba###ing.net
- DNS ASK st###past.net
- DNS ASK sa###ish.net
- DNS ASK st###wing.net
- DNS ASK en###late.net
- DNS ASK li###ate.net
- DNS ASK th####hcountry.net
- DNS ASK li###uide.net
- DNS ASK mo###half.net
- DNS ASK ti###ame.net
- DNS ASK mo###guide.net
- DNS ASK ti###alf.net
- DNS ASK mo###name.net
- DNS ASK mi####lossary.net
- DNS ASK re####eneither.net
- DNS ASK st###march.net
- DNS ASK ta###fruit.net
- DNS ASK ge####friend.net
- DNS ASK re####erpaint.net
- DNS ASK li####appear.net
- DNS ASK gl###health.net
- DNS ASK ne####arydress.net
- DNS ASK pu###alf.net
- DNS ASK fr###yhalf.net
- DNS ASK sh###late.net
- DNS ASK de###ate.net
- DNS ASK pu###ame.net
- DNS ASK fr###yguide.net
- DNS ASK pu###ate.net
- DNS ASK fr###yname.net
- DNS ASK pu###uide.net
- DNS ASK ti###ate.net
- DNS ASK sh###half.net
- DNS ASK ti###uide.net
- DNS ASK mo###late.net
- DNS ASK de###alf.net
- DNS ASK sh###guide.net
- DNS ASK de###uide.net
- DNS ASK sh###name.net
- DNS ASK de###ame.net
- '23#.#55.255.250':1900
