Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Visual Diagnostic Link-Layer WMI' = 'C:\muqatjmxf\calwtxx7xiyc.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\User-mode Remote CNG Protection Name Event] 'ImagePath' = 'C:\muqatjmxf\calwtxx7xiyc.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\User-mode Remote CNG Protection Name Event] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\muqatjmxf\kotvsa6wjjwdj.exe' "c:\muqatjmxf\calwtxx7xiyc.exe"
- 'C:\muqatjmxf\calwtxx7xiyc.exe'
- 'C:\muqatjmxf\hze3pt369ar6afvcrcbdwug.exe'
Modifies file system:
Creates the following files:
- C:\muqatjmxf\calwtxx7xiyc.exe
- C:\muqatjmxf\kotvsa6wjjwdj.exe
- C:\muqatjmxf\clmsksxo7hld
- %WINDIR%\muqatjmxf\nynkqvabojz
- C:\muqatjmxf\nynkqvabojz
- C:\muqatjmxf\hze3pt369ar6afvcrcbdwug.exe
Sets the 'hidden' attribute to the following files:
- C:\muqatjmxf\kotvsa6wjjwdj.exe
- C:\muqatjmxf\calwtxx7xiyc.exe
Deletes the following files:
- C:\muqatjmxf\hze3pt369ar6afvcrcbdwug.exe
- %WINDIR%\muqatjmxf\nynkqvabojz
Network activity:
Connects to:
- 'be#####ardtallulah.net':80
- 'ev#####inacathleen.net':80
- 'be#####ardcathleen.net':80
- 'ev#####inacharleen.net':80
- 'be#####ardcharleen.net':80
- 'ev#####inatallulah.net':80
- 'ma#####liancharleen.net':80
- 'gw#####inetallulah.net':80
- 'ma#####liantallulah.net':80
- 'ev#####inamarianna.net':80
- 'be#####ardmarianna.net':80
- 'gw#####inecharleen.net':80
- 'ri#####inemarianna.net':80
- 'ma#####llawilkinson.net':80
- 'al######inawilkinson.net':80
- 'ev#####inecharleen.net':80
- 'al######inawilkerson.net':80
- 'ma#####llamathewson.net':80
- 'al######inamathewson.net':80
- 'ev#####inecathleen.net':80
- 'ri#####inecathleen.net':80
- 'ev#####inemarianna.net':80
- 'ri#####inecharleen.net':80
- 'ev#####inetallulah.net':80
- 'ri#####inetallulah.net':80
- 'gw#####inecathleen.net':80
- 'wa#####toncathleen.net':80
- 'ea#####inemarianna.net':80
- 'wa#####tonmarianna.net':80
- 'ea#####inetallulah.net':80
- 'wa#####tontallulah.net':80
- 'ea#####inecathleen.net':80
- 'ch#####anatallulah.net':80
- 'du#####llacathleen.net':80
- 'ch#####anacathleen.net':80
- 'du#####llacharleen.net':80
- 'ch#####anacharleen.net':80
- 'du#####llatallulah.net':80
- 'wa#####toncharleen.net':80
- 'wi#####inacharleen.net':80
- 'sa#####rellcharleen.net':80
- 'wi#####inatallulah.net':80
- 'ma#####liancathleen.net':80
- 'gw#####inemarianna.net':80
- 'ma#####lianmarianna.net':80
- 'wi#####inamarianna.net':80
- 'sa#####rellmarianna.net':80
- 'ea#####inecharleen.net':80
- 'sa#####relltallulah.net':80
- 'wi#####inacathleen.net':80
- 'sa#####rellcathleen.net':80
TCP:
HTTP GET requests:
- http://be#####ardtallulah.net/index.php
- http://ev#####inacathleen.net/index.php
- http://be#####ardcathleen.net/index.php
- http://ev#####inacharleen.net/index.php
- http://be#####ardcharleen.net/index.php
- http://ev#####inatallulah.net/index.php
- http://ma#####liancharleen.net/index.php
- http://gw#####inetallulah.net/index.php
- http://ma#####liantallulah.net/index.php
- http://ev#####inamarianna.net/index.php
- http://be#####ardmarianna.net/index.php
- http://gw#####inecharleen.net/index.php
- http://ri#####inemarianna.net/index.php
- http://ma#####llawilkinson.net/index.php
- http://al######inawilkinson.net/index.php
- http://ev#####inecharleen.net/index.php
- http://al######inawilkerson.net/index.php
- http://ma#####llamathewson.net/index.php
- http://al######inamathewson.net/index.php
- http://ev#####inecathleen.net/index.php
- http://ri#####inecathleen.net/index.php
- http://ev#####inemarianna.net/index.php
- http://ri#####inecharleen.net/index.php
- http://ev#####inetallulah.net/index.php
- http://ri#####inetallulah.net/index.php
- http://gw#####inecathleen.net/index.php
- http://wa#####toncathleen.net/index.php
- http://ea#####inemarianna.net/index.php
- http://wa#####tonmarianna.net/index.php
- http://ea#####inetallulah.net/index.php
- http://wa#####tontallulah.net/index.php
- http://ea#####inecathleen.net/index.php
- http://ch#####anatallulah.net/index.php
- http://du#####llacathleen.net/index.php
- http://ch#####anacathleen.net/index.php
- http://du#####llacharleen.net/index.php
- http://ch#####anacharleen.net/index.php
- http://du#####llatallulah.net/index.php
- http://wa#####toncharleen.net/index.php
- http://wi#####inacharleen.net/index.php
- http://sa#####rellcharleen.net/index.php
- http://wi#####inatallulah.net/index.php
- http://ma#####liancathleen.net/index.php
- http://gw#####inemarianna.net/index.php
- http://ma#####lianmarianna.net/index.php
- http://wi#####inamarianna.net/index.php
- http://sa#####rellmarianna.net/index.php
- http://ea#####inecharleen.net/index.php
- http://sa#####relltallulah.net/index.php
- http://wi#####inacathleen.net/index.php
- http://sa#####rellcathleen.net/index.php
UDP:
- DNS ASK be#####ardtallulah.net
- DNS ASK ev#####inacathleen.net
- DNS ASK be#####ardcathleen.net
- DNS ASK ev#####inacharleen.net
- DNS ASK be#####ardcharleen.net
- DNS ASK ev#####inatallulah.net
- DNS ASK ma#####liancharleen.net
- DNS ASK gw#####inetallulah.net
- DNS ASK ma#####liantallulah.net
- DNS ASK ev#####inamarianna.net
- DNS ASK be#####ardmarianna.net
- DNS ASK gw#####inecharleen.net
- DNS ASK ri#####inemarianna.net
- DNS ASK ma#####llawilkinson.net
- DNS ASK al######inawilkinson.net
- DNS ASK ev#####inecharleen.net
- DNS ASK al######inawilkerson.net
- DNS ASK ma#####llamathewson.net
- DNS ASK al######inamathewson.net
- DNS ASK ev#####inecathleen.net
- DNS ASK ri#####inecathleen.net
- DNS ASK ev#####inemarianna.net
- DNS ASK ri#####inecharleen.net
- DNS ASK ev#####inetallulah.net
- DNS ASK ri#####inetallulah.net
- DNS ASK gw#####inecathleen.net
- DNS ASK wa#####toncathleen.net
- DNS ASK ea#####inemarianna.net
- DNS ASK wa#####tonmarianna.net
- DNS ASK ea#####inetallulah.net
- DNS ASK wa#####tontallulah.net
- DNS ASK ea#####inecathleen.net
- DNS ASK ch#####anatallulah.net
- DNS ASK du#####llacathleen.net
- DNS ASK ch#####anacathleen.net
- DNS ASK du#####llacharleen.net
- DNS ASK ch#####anacharleen.net
- DNS ASK du#####llatallulah.net
- DNS ASK wa#####toncharleen.net
- DNS ASK wi#####inacharleen.net
- DNS ASK sa#####rellcharleen.net
- DNS ASK wi#####inatallulah.net
- DNS ASK ma#####liancathleen.net
- DNS ASK gw#####inemarianna.net
- DNS ASK ma#####lianmarianna.net
- DNS ASK wi#####inamarianna.net
- DNS ASK sa#####rellmarianna.net
- DNS ASK ea#####inecharleen.net
- DNS ASK sa#####relltallulah.net
- DNS ASK wi#####inacathleen.net
- DNS ASK sa#####rellcathleen.net
