Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Problem Bluetooth Management IKE Service' = 'C:\puqexyd\mcak45m.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Search Services WWAN SSDP Connection] 'ImagePath' = 'C:\puqexyd\mcak45m.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Search Services WWAN SSDP Connection] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\puqexyd\kj0z3lxcy.exe' "c:\puqexyd\mcak45m.exe"
- 'C:\puqexyd\mcak45m.exe'
- 'C:\puqexyd\scm8hoh3e54sgfeciselfsya.exe'
Modifies file system:
Creates the following files:
- C:\puqexyd\mcak45m.exe
- C:\puqexyd\kj0z3lxcy.exe
- C:\puqexyd\zrmgnwip
- %WINDIR%\puqexyd\w0hswqm9
- C:\puqexyd\w0hswqm9
- C:\puqexyd\scm8hoh3e54sgfeciselfsya.exe
Sets the 'hidden' attribute to the following files:
- C:\puqexyd\kj0z3lxcy.exe
- C:\puqexyd\mcak45m.exe
Deletes the following files:
- C:\puqexyd\scm8hoh3e54sgfeciselfsya.exe
- %WINDIR%\puqexyd\w0hswqm9
Substitutes the following files:
- %WINDIR%\puqexyd\w0hswqm9
Network activity:
Connects to:
- 'za#####ahroyceston.net':80
- 'ar#####ldroyceston.net':80
- 'ge#####nahoneysett.net':80
- 'ge#####naarkwright.net':80
- 'ch#####lehoneysett.net':80
- 'za#####ahsouthgate.net':80
- 'za#####ahhoneysett.net':80
- 'ar#####ldhoneysett.net':80
- 'ar#####ldarkwright.net':80
- 'ar#####ldsouthgate.net':80
- 'za#####aharkwright.net':80
- 'an#####learkwright.net':80
- 'gu#####enhoneysett.net':80
- 'gu#####enarkwright.net':80
- 'gu#####ensouthgate.net':80
- 'an#####lesouthgate.net':80
- 'an#####lehoneysett.net':80
- 'ge#####nasouthgate.net':80
- 'ch#####learkwright.net':80
- 'ch#####lesouthgate.net':80
- 'ch#####leroyceston.net':80
- 'ge#####naroyceston.net':80
- 'ce#####nehoneysett.net':80
- 'am#####nehoneysett.net':80
- 'am#####nearkwright.net':80
- 'am#####nesouthgate.net':80
- 'ce#####nearkwright.net':80
- 'al#####raroyceston.net':80
- 'al#####raarkwright.net':80
- 'ma#####naarkwright.net':80
- 'ma#####nasouthgate.net':80
- 'ma#####naroyceston.net':80
- 'al#####rasouthgate.net':80
- 'ch#####nesouthgate.net':80
- 'sh#####learkwright.net':80
- 'sh#####lesouthgate.net':80
- 'sh#####leroyceston.net':80
- 'ch#####neroyceston.net':80
- 'ch#####nearkwright.net':80
- 'am#####neroyceston.net':80
- 'ce#####nesouthgate.net':80
- 'ce#####neroyceston.net':80
- 'sh#####lehoneysett.net':80
- 'ch#####nehoneysett.net':80
TCP:
HTTP GET requests:
- http://za#####ahroyceston.net/index.php
- http://ar#####ldroyceston.net/index.php
- http://ge#####nahoneysett.net/index.php
- http://ge#####naarkwright.net/index.php
- http://ch#####lehoneysett.net/index.php
- http://za#####ahsouthgate.net/index.php
- http://za#####ahhoneysett.net/index.php
- http://ar#####ldhoneysett.net/index.php
- http://ar#####ldarkwright.net/index.php
- http://ar#####ldsouthgate.net/index.php
- http://za#####aharkwright.net/index.php
- http://an#####learkwright.net/index.php
- http://gu#####enhoneysett.net/index.php
- http://gu#####enarkwright.net/index.php
- http://gu#####ensouthgate.net/index.php
- http://an#####lesouthgate.net/index.php
- http://an#####lehoneysett.net/index.php
- http://ge#####nasouthgate.net/index.php
- http://ch#####learkwright.net/index.php
- http://ch#####lesouthgate.net/index.php
- http://ch#####leroyceston.net/index.php
- http://ge#####naroyceston.net/index.php
- http://ce#####nehoneysett.net/index.php
- http://am#####nehoneysett.net/index.php
- http://am#####nearkwright.net/index.php
- http://am#####nesouthgate.net/index.php
- http://ce#####nearkwright.net/index.php
- http://al#####raroyceston.net/index.php
- http://al#####raarkwright.net/index.php
- http://ma#####naarkwright.net/index.php
- http://ma#####nasouthgate.net/index.php
- http://ma#####naroyceston.net/index.php
- http://al#####rasouthgate.net/index.php
- http://ch#####nesouthgate.net/index.php
- http://sh#####learkwright.net/index.php
- http://sh#####lesouthgate.net/index.php
- http://sh#####leroyceston.net/index.php
- http://ch#####neroyceston.net/index.php
- http://ch#####nearkwright.net/index.php
- http://am#####neroyceston.net/index.php
- http://ce#####nesouthgate.net/index.php
- http://ce#####neroyceston.net/index.php
- http://sh#####lehoneysett.net/index.php
- http://ch#####nehoneysett.net/index.php
UDP:
- DNS ASK za#####ahroyceston.net
- DNS ASK ar#####ldroyceston.net
- DNS ASK ge#####nahoneysett.net
- DNS ASK ge#####naarkwright.net
- DNS ASK ch#####lehoneysett.net
- DNS ASK za#####ahsouthgate.net
- DNS ASK za#####ahhoneysett.net
- DNS ASK ar#####ldhoneysett.net
- DNS ASK ar#####ldarkwright.net
- DNS ASK ar#####ldsouthgate.net
- DNS ASK za#####aharkwright.net
- DNS ASK an#####learkwright.net
- DNS ASK gu#####enhoneysett.net
- DNS ASK gu#####enarkwright.net
- DNS ASK gu#####ensouthgate.net
- DNS ASK an#####lesouthgate.net
- DNS ASK an#####lehoneysett.net
- DNS ASK ge#####nasouthgate.net
- DNS ASK ch#####learkwright.net
- DNS ASK ch#####lesouthgate.net
- DNS ASK ch#####leroyceston.net
- DNS ASK ge#####naroyceston.net
- DNS ASK ce#####nehoneysett.net
- DNS ASK am#####nehoneysett.net
- DNS ASK am#####nearkwright.net
- DNS ASK am#####nesouthgate.net
- DNS ASK ce#####nearkwright.net
- DNS ASK al#####raroyceston.net
- DNS ASK al#####raarkwright.net
- DNS ASK ma#####naarkwright.net
- DNS ASK ma#####nasouthgate.net
- DNS ASK ma#####naroyceston.net
- DNS ASK al#####rasouthgate.net
- DNS ASK ch#####nesouthgate.net
- DNS ASK sh#####learkwright.net
- DNS ASK sh#####lesouthgate.net
- DNS ASK sh#####leroyceston.net
- DNS ASK ch#####neroyceston.net
- DNS ASK ch#####nearkwright.net
- DNS ASK am#####neroyceston.net
- DNS ASK ce#####nesouthgate.net
- DNS ASK ce#####neroyceston.net
- DNS ASK sh#####lehoneysett.net
- DNS ASK ch#####nehoneysett.net
