Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Modules Error DNS Media IPsec Browser' = '%APPDATA%\qmlslxqhxfrb\mxwapjdvwhes.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\qmlslxqhxfrb\iibabbwatoiz.exe' "%APPDATA%\qmlslxqhxfrb\mxwapjdvwhes.exe"
- '%APPDATA%\qmlslxqhxfrb\mxwapjdvwhes.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\qmlslxqhxfrb\mxwapjdvwhes.swjsr
- %APPDATA%\qmlslxqhxfrb\iibabbwatoiz.exe
- %APPDATA%\qmlslxqhxfrb\mxwapjdvwhes.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\qmlslxqhxfrb\iibabbwatoiz.exe
- %APPDATA%\qmlslxqhxfrb\mxwapjdvwhes.exe
Network activity:
Connects to:
- 'fo####partial.net':80
- 'in####sestrike.net':80
- 'fo####strike.net':80
- 'in####separtial.net':80
- 'wo####osition.net':80
- 're####ernumber.net':80
- 'wo###number.net':80
- 'th####hpartial.net':80
- 'ef####partial.net':80
- 'th####hstrike.net':80
- 'fo####number.net':80
- 'in#####eposition.net':80
- 'fo####position.net':80
- 'in####senumber.net':80
- 're#####rposition.net':80
- 'hu####dneighbor.net':80
- 'jo####yneighbor.net':80
- 'hu####dsquare.net':80
- 'jo####yspread.net':80
- 'li####attempt.net':80
- 'de####yattempt.net':80
- 'hu####dspread.net':80
- 'wo####artial.net':80
- 're####erstrike.net':80
- 'wo###strike.net':80
- 're####erpartial.net':80
- 'jo####ysquare.net':80
- 'hu####dattempt.net':80
- 'jo####yattempt.net':80
- 'th###number.net':80
- 'ch###number.net':80
- 'be####partial.net':80
- 'ch####osition.net':80
- 'th###strike.net':80
- 'ch###strike.net':80
- 'th####osition.net':80
- 'ri####position.net':80
- 'be####number.net':80
- 'ri####number.net':80
- 'be####position.net':80
- 'ri####partial.net':80
- 'be####strike.net':80
- 'ri####strike.net':80
- 'ch####artial.net':80
- 'ef####number.net':80
- 'su####partial.net':80
- 'wi####partial.net':80
- 'th####hnumber.net':80
- 'ef####strike.net':80
- 'th####hposition.net':80
- 'ef####position.net':80
- 'su####number.net':80
- 'wi####number.net':80
- 'th####artial.net':80
- 'wi####position.net':80
- 'su####strike.net':80
- 'wi####strike.net':80
- 'su####position.net':80
TCP:
HTTP GET requests:
- http://fo####partial.net/forum/search.php?em##############################
- http://in####sestrike.net/forum/search.php?em##############################
- http://fo####strike.net/forum/search.php?em##############################
- http://in####separtial.net/forum/search.php?em##############################
- http://wo####osition.net/forum/search.php?em##############################
- http://re####ernumber.net/forum/search.php?em##############################
- http://wo###number.net/forum/search.php?em##############################
- http://th####hpartial.net/forum/search.php?em##############################
- http://ef####partial.net/forum/search.php?em##############################
- http://th####hstrike.net/forum/search.php?em##############################
- http://fo####number.net/forum/search.php?em##############################
- http://in#####eposition.net/forum/search.php?em##############################
- http://fo####position.net/forum/search.php?em##############################
- http://in####senumber.net/forum/search.php?em##############################
- http://re#####rposition.net/forum/search.php?em##############################
- http://hu####dneighbor.net/forum/search.php?em##############################
- http://jo####yneighbor.net/forum/search.php?em##############################
- http://hu####dsquare.net/forum/search.php?em##############################
- http://jo####yspread.net/forum/search.php?em##############################
- http://li####attempt.net/forum/search.php?em##############################
- http://de####yattempt.net/forum/search.php?em##############################
- http://hu####dspread.net/forum/search.php?em##############################
- http://wo####artial.net/forum/search.php?em##############################
- http://re####erstrike.net/forum/search.php?em##############################
- http://wo###strike.net/forum/search.php?em##############################
- http://re####erpartial.net/forum/search.php?em##############################
- http://jo####ysquare.net/forum/search.php?em##############################
- http://hu####dattempt.net/forum/search.php?em##############################
- http://jo####yattempt.net/forum/search.php?em##############################
- http://th###number.net/forum/search.php?em##############################
- http://ch###number.net/forum/search.php?em##############################
- http://be####partial.net/forum/search.php?em##############################
- http://ch####osition.net/forum/search.php?em##############################
- http://th###strike.net/forum/search.php?em##############################
- http://ch###strike.net/forum/search.php?em##############################
- http://th####osition.net/forum/search.php?em##############################
- http://ri####position.net/forum/search.php?em##############################
- http://be####number.net/forum/search.php?em##############################
- http://ri####number.net/forum/search.php?em##############################
- http://be####position.net/forum/search.php?em##############################
- http://ri####partial.net/forum/search.php?em##############################
- http://be####strike.net/forum/search.php?em##############################
- http://ri####strike.net/forum/search.php?em##############################
- http://ch####artial.net/forum/search.php?em##############################
- http://ef####number.net/forum/search.php?em##############################
- http://su####partial.net/forum/search.php?em##############################
- http://wi####partial.net/forum/search.php?em##############################
- http://th####hnumber.net/forum/search.php?em##############################
- http://ef####strike.net/forum/search.php?em##############################
- http://th####hposition.net/forum/search.php?em##############################
- http://ef####position.net/forum/search.php?em##############################
- http://su####number.net/forum/search.php?em##############################
- http://wi####number.net/forum/search.php?em##############################
- http://th####artial.net/forum/search.php?em##############################
- http://wi####position.net/forum/search.php?em##############################
- http://su####strike.net/forum/search.php?em##############################
- http://wi####strike.net/forum/search.php?em##############################
- http://su####position.net/forum/search.php?em##############################
UDP:
- DNS ASK in####separtial.net
- DNS ASK fo####partial.net
- DNS ASK in####sestrike.net
- DNS ASK wo###number.net
- DNS ASK re#####rposition.net
- DNS ASK wo####osition.net
- DNS ASK re####ernumber.net
- DNS ASK fo####number.net
- DNS ASK th####hpartial.net
- DNS ASK ef####partial.net
- DNS ASK in####senumber.net
- DNS ASK fo####strike.net
- DNS ASK in#####eposition.net
- DNS ASK fo####position.net
- DNS ASK wo###strike.net
- DNS ASK jo####yspread.net
- DNS ASK hu####dneighbor.net
- DNS ASK jo####yneighbor.net
- DNS ASK hu####dspread.net
- DNS ASK de####ysquare.net
- DNS ASK li####attempt.net
- DNS ASK de####yattempt.net
- DNS ASK re####erpartial.net
- DNS ASK wo####artial.net
- DNS ASK re####erstrike.net
- DNS ASK jo####yattempt.net
- DNS ASK hu####dsquare.net
- DNS ASK jo####ysquare.net
- DNS ASK hu####dattempt.net
- DNS ASK th####hstrike.net
- DNS ASK th###number.net
- DNS ASK ch###number.net
- DNS ASK be####partial.net
- DNS ASK ch####osition.net
- DNS ASK th###strike.net
- DNS ASK ch###strike.net
- DNS ASK th####osition.net
- DNS ASK ri####position.net
- DNS ASK be####number.net
- DNS ASK ri####number.net
- DNS ASK be####position.net
- DNS ASK ri####partial.net
- DNS ASK be####strike.net
- DNS ASK ri####strike.net
- DNS ASK ch####artial.net
- DNS ASK ef####number.net
- DNS ASK su####partial.net
- DNS ASK wi####partial.net
- DNS ASK th####hnumber.net
- DNS ASK ef####strike.net
- DNS ASK th####hposition.net
- DNS ASK ef####position.net
- DNS ASK su####number.net
- DNS ASK wi####number.net
- DNS ASK th####artial.net
- DNS ASK wi####position.net
- DNS ASK su####strike.net
- DNS ASK wi####strike.net
- DNS ASK su####position.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
