Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'VC Alerts Tunneling Event Card Experience' = 'C:\ssdiraaremcisl\dgieysoct.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Modules PnP-X Reporting Propagation] 'ImagePath' = 'C:\ssdiraaremcisl\dgieysoct.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Modules PnP-X Reporting Propagation] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\ssdiraaremcisl\wytnijdkc.exe' "c:\ssdiraaremcisl\dgieysoct.exe"
- 'C:\ssdiraaremcisl\dgieysoct.exe'
- 'C:\ssdiraaremcisl\jma2rpuxdebt8qvzuu.exe'
Modifies file system:
Creates the following files:
- C:\ssdiraaremcisl\dgieysoct.exe
- C:\ssdiraaremcisl\wytnijdkc.exe
- C:\ssdiraaremcisl\qncky5v4a
- %WINDIR%\ssdiraaremcisl\gwyvtwkt
- C:\ssdiraaremcisl\gwyvtwkt
- C:\ssdiraaremcisl\jma2rpuxdebt8qvzuu.exe
Sets the 'hidden' attribute to the following files:
- C:\ssdiraaremcisl\wytnijdkc.exe
- C:\ssdiraaremcisl\dgieysoct.exe
Deletes the following files:
- C:\ssdiraaremcisl\jma2rpuxdebt8qvzuu.exe
- %WINDIR%\ssdiraaremcisl\gwyvtwkt
Network activity:
Connects to:
- 'pi####eabove.net':80
- 'ci####tteuntil.net':80
- 'pi####euntil.net':80
- 'ci#####teshoulder.net':80
- 'pi####eshoulder.net':80
- 'ci####tteabove.net':80
- 'fi####shoulder.net':80
- 'th###habove.net':80
- 'fi###eabove.net':80
- 'th####finger.net':80
- 'fi####finger.net':80
- 'th####shoulder.net':80
- 'ch####enfinger.net':80
- 'fa####shoulder.net':80
- 'ch#####nshoulder.net':80
- 'en####huntil.net':80
- 'ei###runtil.net':80
- 'fa####finger.net':80
- 'ch####enuntil.net':80
- 'ci####ttefinger.net':80
- 'pi####efinger.net':80
- 'fa###yabove.net':80
- 'ch####enabove.net':80
- 'fa###yuntil.net':80
- 'th###huntil.net':80
- 'fo####nuntil.net':80
- 'su###nuntil.net':80
- 'ma####efinger.net':80
- 'su####shoulder.net':80
- 'fo####nabove.net':80
- 'su###nabove.net':80
- 'ma####eabove.net':80
- 'pe###nabove.net':80
- 'ma####euntil.net':80
- 'pe####finger.net':80
- 'ma####eshoulder.net':80
- 'pe####shoulder.net':80
- 'ri####houlder.net':80
- 'wh####rshoulder.net':80
- 'ri###above.net':80
- 'fi###euntil.net':80
- 'ri###finger.net':80
- 'wh####rfinger.net':80
- 'fo####nfinger.net':80
- 'su####finger.net':80
- 'fo####nshoulder.net':80
- 'wh####rabove.net':80
- 'ri###until.net':80
- 'wh####runtil.net':80
TCP:
HTTP GET requests:
- http://pi####eabove.net/index.php?me########
- http://ci####tteuntil.net/index.php?me########
- http://pi####euntil.net/index.php?me########
- http://ci#####teshoulder.net/index.php?me########
- http://pi####eshoulder.net/index.php?me########
- http://ci####tteabove.net/index.php?me########
- http://fi####shoulder.net/index.php?me########
- http://th###habove.net/index.php?me########
- http://fi###eabove.net/index.php?me########
- http://th####finger.net/index.php?me########
- http://fi####finger.net/index.php?me########
- http://th####shoulder.net/index.php?me########
- http://ch####enfinger.net/index.php?me########
- http://fa####shoulder.net/index.php?me########
- http://ch#####nshoulder.net/index.php?me########
- http://en####huntil.net/index.php?me########
- http://ei###runtil.net/index.php?me########
- http://fa####finger.net/index.php?me########
- http://ch####enuntil.net/index.php?me########
- http://ci####ttefinger.net/index.php?me########
- http://pi####efinger.net/index.php?me########
- http://fa###yabove.net/index.php?me########
- http://ch####enabove.net/index.php?me########
- http://fa###yuntil.net/index.php?me########
- http://th###huntil.net/index.php?me########
- http://fo####nuntil.net/index.php?me########
- http://su###nuntil.net/index.php?me########
- http://ma####efinger.net/index.php?me########
- http://su####shoulder.net/index.php?me########
- http://fo####nabove.net/index.php?me########
- http://su###nabove.net/index.php?me########
- http://ma####eabove.net/index.php?me########
- http://pe###nabove.net/index.php?me########
- http://ma####euntil.net/index.php?me########
- http://pe####finger.net/index.php?me########
- http://ma####eshoulder.net/index.php?me########
- http://pe####shoulder.net/index.php?me########
- http://ri####houlder.net/index.php?me########
- http://wh####rshoulder.net/index.php?me########
- http://ri###above.net/index.php?me########
- http://fi###euntil.net/index.php?me########
- http://ri###finger.net/index.php?me########
- http://wh####rfinger.net/index.php?me########
- http://fo####nfinger.net/index.php?me########
- http://su####finger.net/index.php?me########
- http://fo####nshoulder.net/index.php?me########
- http://wh####rabove.net/index.php?me########
- http://ri###until.net/index.php?me########
- http://wh####runtil.net/index.php?me########
UDP:
- DNS ASK pi####eabove.net
- DNS ASK ci####tteuntil.net
- DNS ASK pi####euntil.net
- DNS ASK ci#####teshoulder.net
- DNS ASK pi####eshoulder.net
- DNS ASK ci####tteabove.net
- DNS ASK fi####shoulder.net
- DNS ASK th###habove.net
- DNS ASK fi###eabove.net
- DNS ASK th####finger.net
- DNS ASK fi####finger.net
- DNS ASK th####shoulder.net
- DNS ASK pi####efinger.net
- DNS ASK fa####finger.net
- DNS ASK ch####enfinger.net
- DNS ASK fa####shoulder.net
- DNS ASK ei###rabove.net
- DNS ASK en####huntil.net
- DNS ASK ei###runtil.net
- DNS ASK fa###yuntil.net
- DNS ASK ch####enuntil.net
- DNS ASK ci####ttefinger.net
- DNS ASK ch#####nshoulder.net
- DNS ASK fa###yabove.net
- DNS ASK ch####enabove.net
- DNS ASK fo####nuntil.net
- DNS ASK su###nuntil.net
- DNS ASK ma####efinger.net
- DNS ASK su####shoulder.net
- DNS ASK fo####nabove.net
- DNS ASK su###nabove.net
- DNS ASK ma####eabove.net
- DNS ASK pe###nabove.net
- DNS ASK ma####euntil.net
- DNS ASK pe####finger.net
- DNS ASK ma####eshoulder.net
- DNS ASK pe####shoulder.net
- DNS ASK fo####nshoulder.net
- DNS ASK wh####rfinger.net
- DNS ASK ri####houlder.net
- DNS ASK wh####rshoulder.net
- DNS ASK th###huntil.net
- DNS ASK fi###euntil.net
- DNS ASK ri###finger.net
- DNS ASK wh####runtil.net
- DNS ASK fo####nfinger.net
- DNS ASK su####finger.net
- DNS ASK ri###above.net
- DNS ASK wh####rabove.net
- DNS ASK ri###until.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
