Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Wired Launcher Upgrade Config Control' = '<LS_APPDATA>\yqyxruplfmgdy\sukwvymzvoqo.exe'
Malicious functions:
Creates and executes the following:
- '<LS_APPDATA>\yqyxruplfmgdy\qyrnacjoftv.exe' "<LS_APPDATA>\yqyxruplfmgdy\sukwvymzvoqo.exe"
- '<LS_APPDATA>\yqyxruplfmgdy\sukwvymzvoqo.exe'
Modifies file system :
Creates the following files:
- <LS_APPDATA>\yqyxruplfmgdy\sukwvymzvoqo.vlhdb
- <LS_APPDATA>\yqyxruplfmgdy\qyrnacjoftv.exe
- <LS_APPDATA>\yqyxruplfmgdy\sukwvymzvoqo.exe
Sets the 'hidden' attribute to the following files:
- <LS_APPDATA>\yqyxruplfmgdy\qyrnacjoftv.exe
- <LS_APPDATA>\yqyxruplfmgdy\sukwvymzvoqo.exe
Network activity:
Connects to:
- 'st####thpartial.net':80
- 'st####thstrike.net':80
- 'st####osition.net':80
- 'mo####ntattempt.net':80
- 'ou####esquare.net':80
- 'mo####ntsquare.net':80
- 'ou####eattempt.net':80
- 'pr####epartial.net':80
- 'de####strike.net':80
- 'pr####estrike.net':80
- 'de####partial.net':80
- 'st#####hposition.net':80
- 'st###number.net':80
- 'st####thnumber.net':80
- 'ev####gneighbor.net':80
- 'bu#####gneighbor.net':80
- 'ev####gsquare.net':80
- 'bu####ngspread.net':80
- 'mi####ttempt.net':80
- 'st####ttempt.net':80
- 'ev####gspread.net':80
- 'mo####ntspread.net':80
- 'ou####eneighbor.net':80
- 'mo#####tneighbor.net':80
- 'ou####espread.net':80
- 'bu####ngsquare.net':80
- 'ev####gattempt.net':80
- 'bu####ngattempt.net':80
- 'de####position.net':80
- 'do####strike.net':80
- 'pr####position.net':80
- 'do####position.net':80
- 'pr####strike.net':80
- 'fe####number.net':80
- 'pr####partial.net':80
- 'do####partial.net':80
- 'mi###strike.net':80
- 'st###strike.net':80
- 'mi####osition.net':80
- 'st####artial.net':80
- 'pr####number.net':80
- 'do####number.net':80
- 'mi####artial.net':80
- 'br####partial.net':80
- 're####strike.net':80
- 'br####strike.net':80
- 're####partial.net':80
- 'pr####eposition.net':80
- 'de####number.net':80
- 'pr####enumber.net':80
- 'fe####partial.net':80
- 'fe####strike.net':80
- 'fe####position.net':80
- 'br####number.net':80
- 're####position.net':80
- 'br####position.net':80
- 're####number.net':80
TCP:
HTTP GET requests:
- http://st####thpartial.net/forum/search.php?em##################################
- http://st####thstrike.net/forum/search.php?em##################################
- http://st####osition.net/forum/search.php?em##################################
- http://mo####ntattempt.net/forum/search.php?em##################################
- http://ou####esquare.net/forum/search.php?em##################################
- http://mo####ntsquare.net/forum/search.php?em##################################
- http://ou####eattempt.net/forum/search.php?em##################################
- http://pr####epartial.net/forum/search.php?em##################################
- http://de####strike.net/forum/search.php?em##################################
- http://pr####estrike.net/forum/search.php?em##################################
- http://de####partial.net/forum/search.php?em##################################
- http://st#####hposition.net/forum/search.php?em##################################
- http://st###number.net/forum/search.php?em##################################
- http://st####thnumber.net/forum/search.php?em##################################
- http://ev####gneighbor.net/forum/search.php?em##################################
- http://bu#####gneighbor.net/forum/search.php?em##################################
- http://ev####gsquare.net/forum/search.php?em##################################
- http://bu####ngspread.net/forum/search.php?em##################################
- http://mi####ttempt.net/forum/search.php?em##################################
- http://st####ttempt.net/forum/search.php?em##################################
- http://ev####gspread.net/forum/search.php?em##################################
- http://mo####ntspread.net/forum/search.php?em##################################
- http://ou####eneighbor.net/forum/search.php?em##################################
- http://mo#####tneighbor.net/forum/search.php?em##################################
- http://ou####espread.net/forum/search.php?em##################################
- http://bu####ngsquare.net/forum/search.php?em##################################
- http://ev####gattempt.net/forum/search.php?em##################################
- http://bu####ngattempt.net/forum/search.php?em##################################
- http://de####position.net/forum/search.php?em##################################
- http://do####strike.net/forum/search.php?em##################################
- http://pr####position.net/forum/search.php?em##################################
- http://do####position.net/forum/search.php?em##################################
- http://pr####strike.net/forum/search.php?em##################################
- http://fe####number.net/forum/search.php?em##################################
- http://pr####partial.net/forum/search.php?em##################################
- http://do####partial.net/forum/search.php?em##################################
- http://mi###strike.net/forum/search.php?em##################################
- http://st###strike.net/forum/search.php?em##################################
- http://mi####osition.net/forum/search.php?em##################################
- http://st####artial.net/forum/search.php?em##################################
- http://pr####number.net/forum/search.php?em##################################
- http://do####number.net/forum/search.php?em##################################
- http://mi####artial.net/forum/search.php?em##################################
- http://br####partial.net/forum/search.php?em##################################
- http://re####strike.net/forum/search.php?em##################################
- http://br####strike.net/forum/search.php?em##################################
- http://re####partial.net/forum/search.php?em##################################
- http://pr####eposition.net/forum/search.php?em##################################
- http://de####number.net/forum/search.php?em##################################
- http://pr####enumber.net/forum/search.php?em##################################
- http://fe####partial.net/forum/search.php?em##################################
- http://fe####strike.net/forum/search.php?em##################################
- http://fe####position.net/forum/search.php?em##################################
- http://br####number.net/forum/search.php?em##################################
- http://re####position.net/forum/search.php?em##################################
- http://br####position.net/forum/search.php?em##################################
- http://re####number.net/forum/search.php?em##################################
UDP:
- DNS ASK st####thpartial.net
- DNS ASK st####thstrike.net
- DNS ASK st####osition.net
- DNS ASK mo####ntattempt.net
- DNS ASK ou####esquare.net
- DNS ASK mo####ntsquare.net
- DNS ASK ou####eattempt.net
- DNS ASK pr####epartial.net
- DNS ASK de####strike.net
- DNS ASK pr####estrike.net
- DNS ASK de####partial.net
- DNS ASK st#####hposition.net
- DNS ASK st###number.net
- DNS ASK st####thnumber.net
- DNS ASK mo#####tneighbor.net
- DNS ASK bu####ngspread.net
- DNS ASK ev####gneighbor.net
- DNS ASK bu#####gneighbor.net
- DNS ASK ev####gspread.net
- DNS ASK st###square.net
- DNS ASK mi####ttempt.net
- DNS ASK st####ttempt.net
- DNS ASK ou####espread.net
- DNS ASK mo####ntspread.net
- DNS ASK ou####eneighbor.net
- DNS ASK bu####ngattempt.net
- DNS ASK ev####gsquare.net
- DNS ASK bu####ngsquare.net
- DNS ASK ev####gattempt.net
- DNS ASK do####strike.net
- DNS ASK pr####position.net
- DNS ASK do####position.net
- DNS ASK pr####strike.net
- DNS ASK fe####number.net
- DNS ASK pr####partial.net
- DNS ASK do####partial.net
- DNS ASK mi###strike.net
- DNS ASK st###strike.net
- DNS ASK mi####osition.net
- DNS ASK st####artial.net
- DNS ASK pr####number.net
- DNS ASK do####number.net
- DNS ASK mi####artial.net
- DNS ASK fe####position.net
- DNS ASK re####partial.net
- DNS ASK br####partial.net
- DNS ASK re####strike.net
- DNS ASK pr####enumber.net
- DNS ASK de####position.net
- DNS ASK pr####eposition.net
- DNS ASK de####number.net
- DNS ASK br####number.net
- DNS ASK fe####partial.net
- DNS ASK fe####strike.net
- DNS ASK re####number.net
- DNS ASK br####strike.net
- DNS ASK re####position.net
- DNS ASK br####position.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
