Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Interactive IP Parental Link-Layer' = 'C:\givvrxf\azlztsjngm.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Disk Tablet UserMode DLL Spooler Input] 'ImagePath' = 'C:\givvrxf\azlztsjngm.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Disk Tablet UserMode DLL Spooler Input] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\givvrxf\cldhwqx.exe' "c:\givvrxf\azlztsjngm.exe"
- 'C:\givvrxf\azlztsjngm.exe'
- 'C:\givvrxf\qrabkrhb2idhrsuzsztoqvcq.exe'
Modifies file system:
Creates the following files:
- C:\givvrxf\azlztsjngm.exe
- C:\givvrxf\cldhwqx.exe
- C:\givvrxf\oys1xphzgoae
- %WINDIR%\givvrxf\rxcokma5
- C:\givvrxf\rxcokma5
- C:\givvrxf\qrabkrhb2idhrsuzsztoqvcq.exe
Sets the 'hidden' attribute to the following files:
- C:\givvrxf\cldhwqx.exe
- C:\givvrxf\azlztsjngm.exe
Deletes the following files:
- C:\givvrxf\qrabkrhb2idhrsuzsztoqvcq.exe
- %WINDIR%\givvrxf\rxcokma5
Network activity:
Connects to:
- 'ma#####ttaanjelica.net':80
- 'ch#####anneanjelica.net':80
- 'ma#####ttashaniqua.net':80
- 'ch#####pherharmonie.net':80
- 'ma#####ttaveronica.net':80
- 'ch#####anneveronica.net':80
- 'ja#####ineveronica.net':80
- 'ge#####nnaveronica.net':80
- 'ja#####ineanjelica.net':80
- 'ch#####anneshaniqua.net':80
- 'ma#####ttaharmonie.net':80
- 'ch#####anneharmonie.net':80
- 'mo#####eryshaniqua.net':80
- 'mo#####eryharmonie.net':80
- 'te#####nceveronica.net':80
- 'al#####reaharmonie.net':80
- 'mo#####eryveronica.net':80
- 'mo#####eryanjelica.net':80
- 'te#####nceshaniqua.net':80
- 'ch#####phershaniqua.net':80
- 'te#####nceharmonie.net':80
- 'ch#####pherveronica.net':80
- 'te#####nceanjelica.net':80
- 'ch#####pheranjelica.net':80
- 'ge#####nnaanjelica.net':80
- 'ki#####eighanjelica.net':80
- 'be#####tteshaniqua.net':80
- 'ki#####eighshaniqua.net':80
- 'be#####tteveronica.net':80
- 'ki#####eighveronica.net':80
- 'be#####tteanjelica.net':80
- 'ch######elleveronica.net':80
- 'al#####riaanjelica.net':80
- 'ch######elleanjelica.net':80
- 'be#####tteharmonie.net':80
- 'ki#####eighharmonie.net':80
- 'al#####riaveronica.net':80
- 'ge#####nnaharmonie.net':80
- 're#####nneveronica.net':80
- 'ch#####belveronica.net':80
- 'ja#####ineshaniqua.net':80
- 'ge#####nnashaniqua.net':80
- 'ja#####ineharmonie.net':80
- 'ch#####belshaniqua.net':80
- 're#####nneharmonie.net':80
- 'ch#####belharmonie.net':80
- 're#####nneanjelica.net':80
- 'ch#####belanjelica.net':80
- 're#####nneshaniqua.net':80
TCP:
HTTP GET requests:
- http://ma#####ttaanjelica.net/index.php
- http://ch#####anneanjelica.net/index.php
- http://ma#####ttashaniqua.net/index.php
- http://ch#####pherharmonie.net/index.php
- http://ma#####ttaveronica.net/index.php
- http://ch#####anneveronica.net/index.php
- http://ja#####ineveronica.net/index.php
- http://ge#####nnaveronica.net/index.php
- http://ja#####ineanjelica.net/index.php
- http://ch#####anneshaniqua.net/index.php
- http://ma#####ttaharmonie.net/index.php
- http://ch#####anneharmonie.net/index.php
- http://mo#####eryshaniqua.net/index.php
- http://mo#####eryharmonie.net/index.php
- http://te#####nceveronica.net/index.php
- http://al#####reaharmonie.net/index.php
- http://mo#####eryveronica.net/index.php
- http://mo#####eryanjelica.net/index.php
- http://te#####nceshaniqua.net/index.php
- http://ch#####phershaniqua.net/index.php
- http://te#####nceharmonie.net/index.php
- http://ch#####pherveronica.net/index.php
- http://te#####nceanjelica.net/index.php
- http://ch#####pheranjelica.net/index.php
- http://ge#####nnaanjelica.net/index.php
- http://ki#####eighanjelica.net/index.php
- http://be#####tteshaniqua.net/index.php
- http://ki#####eighshaniqua.net/index.php
- http://be#####tteveronica.net/index.php
- http://ki#####eighveronica.net/index.php
- http://be#####tteanjelica.net/index.php
- http://ch######elleveronica.net/index.php
- http://al#####riaanjelica.net/index.php
- http://ch######elleanjelica.net/index.php
- http://be#####tteharmonie.net/index.php
- http://ki#####eighharmonie.net/index.php
- http://al#####riaveronica.net/index.php
- http://ge#####nnaharmonie.net/index.php
- http://re#####nneveronica.net/index.php
- http://ch#####belveronica.net/index.php
- http://ja#####ineshaniqua.net/index.php
- http://ge#####nnashaniqua.net/index.php
- http://ja#####ineharmonie.net/index.php
- http://ch#####belshaniqua.net/index.php
- http://re#####nneharmonie.net/index.php
- http://ch#####belharmonie.net/index.php
- http://re#####nneanjelica.net/index.php
- http://ch#####belanjelica.net/index.php
- http://re#####nneshaniqua.net/index.php
UDP:
- DNS ASK ma#####ttaanjelica.net
- DNS ASK ch#####anneanjelica.net
- DNS ASK ma#####ttashaniqua.net
- DNS ASK ch#####pherharmonie.net
- DNS ASK ma#####ttaveronica.net
- DNS ASK ch#####anneveronica.net
- DNS ASK ja#####ineveronica.net
- DNS ASK ge#####nnaveronica.net
- DNS ASK ja#####ineanjelica.net
- DNS ASK ch#####anneshaniqua.net
- DNS ASK ma#####ttaharmonie.net
- DNS ASK ch#####anneharmonie.net
- DNS ASK te#####nceharmonie.net
- DNS ASK mo#####eryanjelica.net
- DNS ASK mo#####eryshaniqua.net
- DNS ASK mo#####eryharmonie.net
- DNS ASK er#####udeharmonie.net
- DNS ASK al#####reaharmonie.net
- DNS ASK mo#####eryveronica.net
- DNS ASK ch#####pheranjelica.net
- DNS ASK te#####nceshaniqua.net
- DNS ASK ch#####phershaniqua.net
- DNS ASK te#####nceveronica.net
- DNS ASK ch#####pherveronica.net
- DNS ASK te#####nceanjelica.net
- DNS ASK ki#####eighanjelica.net
- DNS ASK be#####tteshaniqua.net
- DNS ASK ki#####eighshaniqua.net
- DNS ASK be#####tteveronica.net
- DNS ASK ki#####eighveronica.net
- DNS ASK be#####tteanjelica.net
- DNS ASK ch######elleveronica.net
- DNS ASK al#####riaanjelica.net
- DNS ASK ch######elleanjelica.net
- DNS ASK be#####tteharmonie.net
- DNS ASK ki#####eighharmonie.net
- DNS ASK al#####riaveronica.net
- DNS ASK ch#####belharmonie.net
- DNS ASK ja#####ineharmonie.net
- DNS ASK ge#####nnaharmonie.net
- DNS ASK re#####nneveronica.net
- DNS ASK ge#####nnaanjelica.net
- DNS ASK ja#####ineshaniqua.net
- DNS ASK ge#####nnashaniqua.net
- DNS ASK re#####nneshaniqua.net
- DNS ASK ch#####belshaniqua.net
- DNS ASK re#####nneharmonie.net
- DNS ASK ch#####belveronica.net
- DNS ASK re#####nneanjelica.net
- DNS ASK ch#####belanjelica.net
