Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Audio CardSpace Encryption' = 'C:\nuowyslpyqbiak\ljjjpwlr.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Time Policy Trap Awareness Logon Gateway] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\nuowyslpyqbiak\jmmtdkvbldv.exe' "c:\nuowyslpyqbiak\ljjjpwlr.exe"
- 'C:\nuowyslpyqbiak\ljjjpwlr.exe'
- 'C:\nuowyslpyqbiak\xxash2unqvbrsk2gjra.exe'
Modifies file system :
Creates the following files:
- C:\nuowyslpyqbiak\ljjjpwlr.exe
- C:\nuowyslpyqbiak\jmmtdkvbldv.exe
- C:\nuowyslpyqbiak\whstr8src
- %WINDIR%\nuowyslpyqbiak\eoaxtvo
- C:\nuowyslpyqbiak\eoaxtvo
- C:\nuowyslpyqbiak\xxash2unqvbrsk2gjra.exe
Sets the 'hidden' attribute to the following files:
- C:\nuowyslpyqbiak\jmmtdkvbldv.exe
- C:\nuowyslpyqbiak\ljjjpwlr.exe
Deletes the following files:
- C:\nuowyslpyqbiak\xxash2unqvbrsk2gjra.exe
- %WINDIR%\nuowyslpyqbiak\eoaxtvo
Network activity:
Connects to:
- 'qu###office.net':80
- 'se####distance.net':80
- 'qu####istance.net':80
- 'se####office.net':80
- 'ag####tstrong.net':80
- 'se####arrive.net':80
- 'qu###arrive.net':80
- 'se####supply.net':80
- 'fl###office.net':80
- 'br####istance.net':80
- 'fl####istance.net':80
- 'br###office.net':80
- 'qu###supply.net':80
- 'br###arrive.net':80
- 'fl###arrive.net':80
- 'do###strong.net':80
- 'ni####resident.net':80
- 'de####trouble.net':80
- 'ni####rouble.net':80
- 'de####president.net':80
- 'la###strong.net':80
- 'de####caught.net':80
- 'ni###caught.net':80
- 'de####strong.net':80
- 'ag#####president.net':80
- 'do####rouble.net':80
- 'ag####ttrouble.net':80
- 'do####resident.net':80
- 'ni###strong.net':80
- 'do###caught.net':80
- 'ag####tcaught.net':80
- 'br###supply.net':80
- 're####office.net':80
- 'el#####cdistance.net':80
- 're####distance.net':80
- 'el####icoffice.net':80
- 'st####supply.net':80
- 'el####icarrive.net':80
- 're####arrive.net':80
- 'el####icsupply.net':80
- 'la###office.net':80
- 'ca####ndistance.net':80
- 'la####istance.net':80
- 'ca####noffice.net':80
- 're####supply.net':80
- 'ca####narrive.net':80
- 'la###arrive.net':80
- 'tr###supply.net':80
- 'be####office.net':80
- 'ga####distance.net':80
- 'be####distance.net':80
- 'ga####office.net':80
- 'fl###supply.net':80
- 'ga####arrive.net':80
- 'be####arrive.net':80
- 'ga####supply.net':80
- 'st####office.net':80
- 'tr####istance.net':80
- 'st####distance.net':80
- 'tr###office.net':80
- 'be####supply.net':80
- 'tr###arrive.net':80
- 'st####arrive.net':80
TCP:
HTTP GET requests:
- http://qu###office.net/index.php?me########
- http://se####distance.net/index.php?me########
- http://qu####istance.net/index.php?me########
- http://se####office.net/index.php?me########
- http://ag####tstrong.net/index.php?me########
- http://se####arrive.net/index.php?me########
- http://qu###arrive.net/index.php?me########
- http://se####supply.net/index.php?me########
- http://fl###office.net/index.php?me########
- http://br####istance.net/index.php?me########
- http://fl####istance.net/index.php?me########
- http://br###office.net/index.php?me########
- http://qu###supply.net/index.php?me########
- http://br###arrive.net/index.php?me########
- http://fl###arrive.net/index.php?me########
- http://do###strong.net/index.php?me########
- http://ni####resident.net/index.php?me########
- http://de####trouble.net/index.php?me########
- http://ni####rouble.net/index.php?me########
- http://de####president.net/index.php?me########
- http://la###strong.net/index.php?me########
- http://de####caught.net/index.php?me########
- http://ni###caught.net/index.php?me########
- http://de####strong.net/index.php?me########
- http://ag#####president.net/index.php?me########
- http://do####rouble.net/index.php?me########
- http://ag####ttrouble.net/index.php?me########
- http://do####resident.net/index.php?me########
- http://ni###strong.net/index.php?me########
- http://do###caught.net/index.php?me########
- http://ag####tcaught.net/index.php?me########
- http://br###supply.net/index.php?me########
- http://re####office.net/index.php?me########
- http://el#####cdistance.net/index.php?me########
- http://re####distance.net/index.php?me########
- http://el####icoffice.net/index.php?me########
- http://st####supply.net/index.php?me########
- http://el####icarrive.net/index.php?me########
- http://re####arrive.net/index.php?me########
- http://el####icsupply.net/index.php?me########
- http://la###office.net/index.php?me########
- http://ca####ndistance.net/index.php?me########
- http://la####istance.net/index.php?me########
- http://ca####noffice.net/index.php?me########
- http://re####supply.net/index.php?me########
- http://ca####narrive.net/index.php?me########
- http://la###arrive.net/index.php?me########
- http://tr###supply.net/index.php?me########
- http://be####office.net/index.php?me########
- http://ga####distance.net/index.php?me########
- http://be####distance.net/index.php?me########
- http://ga####office.net/index.php?me########
- http://fl###supply.net/index.php?me########
- http://ga####arrive.net/index.php?me########
- http://be####arrive.net/index.php?me########
- http://ga####supply.net/index.php?me########
- http://st####office.net/index.php?me########
- http://tr####istance.net/index.php?me########
- http://st####distance.net/index.php?me########
- http://tr###office.net/index.php?me########
- http://be####supply.net/index.php?me########
- http://tr###arrive.net/index.php?me########
- http://st####arrive.net/index.php?me########
UDP:
- DNS ASK qu###office.net
- DNS ASK se####office.net
- DNS ASK qu####istance.net
- DNS ASK se####distance.net
- DNS ASK ag####tstrong.net
- DNS ASK do###strong.net
- DNS ASK qu###arrive.net
- DNS ASK se####arrive.net
- DNS ASK fl###office.net
- DNS ASK br###office.net
- DNS ASK fl####istance.net
- DNS ASK br####istance.net
- DNS ASK qu###supply.net
- DNS ASK se####supply.net
- DNS ASK fl###arrive.net
- DNS ASK br###arrive.net
- DNS ASK ni####resident.net
- DNS ASK de####president.net
- DNS ASK ni####rouble.net
- DNS ASK de####trouble.net
- DNS ASK la###strong.net
- DNS ASK ca####nstrong.net
- DNS ASK ni###caught.net
- DNS ASK de####caught.net
- DNS ASK ag#####president.net
- DNS ASK do####resident.net
- DNS ASK ag####ttrouble.net
- DNS ASK do####rouble.net
- DNS ASK ni###strong.net
- DNS ASK de####strong.net
- DNS ASK ag####tcaught.net
- DNS ASK do###caught.net
- DNS ASK re####office.net
- DNS ASK el####icoffice.net
- DNS ASK re####distance.net
- DNS ASK el#####cdistance.net
- DNS ASK st####supply.net
- DNS ASK tr###supply.net
- DNS ASK re####arrive.net
- DNS ASK el####icarrive.net
- DNS ASK la###office.net
- DNS ASK ca####noffice.net
- DNS ASK la####istance.net
- DNS ASK ca####ndistance.net
- DNS ASK re####supply.net
- DNS ASK el####icsupply.net
- DNS ASK la###arrive.net
- DNS ASK ca####narrive.net
- DNS ASK be####office.net
- DNS ASK ga####office.net
- DNS ASK be####distance.net
- DNS ASK ga####distance.net
- DNS ASK fl###supply.net
- DNS ASK br###supply.net
- DNS ASK be####arrive.net
- DNS ASK ga####arrive.net
- DNS ASK st####office.net
- DNS ASK tr###office.net
- DNS ASK st####distance.net
- DNS ASK tr####istance.net
- DNS ASK be####supply.net
- DNS ASK ga####supply.net
- DNS ASK st####arrive.net
- DNS ASK tr###arrive.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
