Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Initiator Gateway Isolation Now TCP/IP' = 'C:\kvyeoare\ffyldezc.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Copy Connections Program Cache UserMode Internet] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Copy Connections Program Cache UserMode Internet] 'ImagePath' = 'C:\kvyeoare\ffyldezc.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\kvyeoare\hfnwvujd
- C:\kvyeoare\hfnwvujd
- C:\kvyeoare\iw35scd4xcnhg7wig.exe
- C:\kvyeoare\ffyldezc.exe
- C:\kvyeoare\nydjgpi.exe
- C:\kvyeoare\b4vboqvdc
Sets the 'hidden' attribute to the following files:
- C:\kvyeoare\ffyldezc.exe
- C:\kvyeoare\nydjgpi.exe
Deletes the following files:
- %WINDIR%\kvyeoare\hfnwvujd
- C:\kvyeoare\iw35scd4xcnhg7wig.exe
Substitutes the following files:
- %WINDIR%\kvyeoare\hfnwvujd
Network activity:
Connects to:
- 'si####supply.net':80
- 'fi####office.net':80
- 'le###office.net':80
- 'fi####arrive.net':80
- 'le###arrive.net':80
- 'sw###supply.net':80
- 'pr####lysupply.net':80
- 'sw####istance.net':80
- 'pr#####ydistance.net':80
- 'sw###office.net':80
- 'pr####lyoffice.net':80
- 'sw###arrive.net':80
- 'mo####inarrive.net':80
- 'pr####lyarrive.net':80
- 'ma####alsupply.net':80
- 'se####ldistance.net':80
- 'ma#####ldistance.net':80
- 'se####loffice.net':80
- 'ma####aloffice.net':80
- 'se####larrive.net':80
- 'ma####alarrive.net':80
- 'se####strong.net':80
- 'la###strong.net':80
- 'se####trouble.net':80
- 'la####rouble.net':80
- 'fi####distance.net':80
- 'le####istance.net':80
- 'le###supply.net':80
- 'fi####supply.net':80
- 'su####tarrive.net':80
- 'si####distance.net':80
- 'mo####distance.net':80
- 'si####office.net':80
- 'mo####office.net':80
- 'si####arrive.net':80
- 'mo####arrive.net':80
- 'mo####insupply.net':80
- 'po####lesupply.net':80
- 'mo#####ndistance.net':80
- 'po#####edistance.net':80
- 'mo####inoffice.net':80
- 'se####president.net':80
- 'se####lsupply.net':80
- 'po####leoffice.net':80
- 'pe####ssupply.net':80
- 'wi####supply.net':80
- 'pe####sdistance.net':80
- 'wi####distance.net':80
- 'pe####soffice.net':80
- 'wi####office.net':80
- 'pe####sarrive.net':80
- 'wi####arrive.net':80
- 'su####tsupply.net':80
- 'su####tdistance.net':80
- 'su####toffice.net':80
- 'mo####supply.net':80
- 'po####learrive.net':80
- 'la####resident.net':80
TCP:
HTTP GET requests:
- http://si####supply.net/index.php?me########
- http://fi####office.net/index.php?me########
- http://le###office.net/index.php?me########
- http://fi####arrive.net/index.php?me########
- http://le###arrive.net/index.php?me########
- http://sw###supply.net/index.php?me########
- http://pr####lysupply.net/index.php?me########
- http://sw####istance.net/index.php?me########
- http://pr#####ydistance.net/index.php?me########
- http://sw###office.net/index.php?me########
- http://pr####lyoffice.net/index.php?me########
- http://sw###arrive.net/index.php?me########
- http://mo####inarrive.net/index.php?me########
- http://pr####lyarrive.net/index.php?me########
- http://ma####alsupply.net/index.php?me########
- http://se####ldistance.net/index.php?me########
- http://ma#####ldistance.net/index.php?me########
- http://se####loffice.net/index.php?me########
- http://ma####aloffice.net/index.php?me########
- http://se####larrive.net/index.php?me########
- http://ma####alarrive.net/index.php?me########
- http://se####strong.net/index.php?me########
- http://la###strong.net/index.php?me########
- http://se####trouble.net/index.php?me########
- http://la####rouble.net/index.php?me########
- http://fi####distance.net/index.php?me########
- http://le####istance.net/index.php?me########
- http://le###supply.net/index.php?me########
- http://fi####supply.net/index.php?me########
- http://su####tarrive.net/index.php?me########
- http://si####distance.net/index.php?me########
- http://mo####distance.net/index.php?me########
- http://si####office.net/index.php?me########
- http://mo####office.net/index.php?me########
- http://si####arrive.net/index.php?me########
- http://mo####arrive.net/index.php?me########
- http://mo####insupply.net/index.php?me########
- http://po####lesupply.net/index.php?me########
- http://mo#####ndistance.net/index.php?me########
- http://po#####edistance.net/index.php?me########
- http://mo####inoffice.net/index.php?me########
- http://se####president.net/index.php?me########
- http://se####lsupply.net/index.php?me########
- http://po####leoffice.net/index.php?me########
- http://pe####ssupply.net/index.php?me########
- http://wi####supply.net/index.php?me########
- http://pe####sdistance.net/index.php?me########
- http://wi####distance.net/index.php?me########
- http://pe####soffice.net/index.php?me########
- http://wi####office.net/index.php?me########
- http://pe####sarrive.net/index.php?me########
- http://wi####arrive.net/index.php?me########
- http://su####tsupply.net/index.php?me########
- http://su####tdistance.net/index.php?me########
- http://su####toffice.net/index.php?me########
- http://mo####supply.net/index.php?me########
- http://po####learrive.net/index.php?me########
- http://la####resident.net/index.php?me########
UDP:
- DNS ASK si####supply.net
- DNS ASK le####istance.net
- DNS ASK fi####office.net
- DNS ASK le###office.net
- DNS ASK fi####arrive.net
- DNS ASK le###arrive.net
- DNS ASK sw###supply.net
- DNS ASK pr####lysupply.net
- DNS ASK sw####istance.net
- DNS ASK pr#####ydistance.net
- DNS ASK sw###office.net
- DNS ASK pr####lyoffice.net
- DNS ASK sw###arrive.net
- DNS ASK se####lsupply.net
- DNS ASK la####resident.net
- DNS ASK ma####alsupply.net
- DNS ASK se####ldistance.net
- DNS ASK ma#####ldistance.net
- DNS ASK se####loffice.net
- DNS ASK ma####aloffice.net
- DNS ASK se####larrive.net
- DNS ASK ma####alarrive.net
- DNS ASK se####strong.net
- DNS ASK la###strong.net
- DNS ASK se####trouble.net
- DNS ASK la####rouble.net
- DNS ASK se####president.net
- DNS ASK fi####distance.net
- DNS ASK pr####lyarrive.net
- DNS ASK le###supply.net
- DNS ASK po####leoffice.net
- DNS ASK mo####supply.net
- DNS ASK si####distance.net
- DNS ASK mo####distance.net
- DNS ASK si####office.net
- DNS ASK mo####office.net
- DNS ASK si####arrive.net
- DNS ASK mo####arrive.net
- DNS ASK mo####insupply.net
- DNS ASK po####lesupply.net
- DNS ASK mo#####ndistance.net
- DNS ASK po#####edistance.net
- DNS ASK mo####inoffice.net
- DNS ASK mo####inarrive.net
- DNS ASK su####tarrive.net
- DNS ASK po####learrive.net
- DNS ASK pe####ssupply.net
- DNS ASK wi####supply.net
- DNS ASK pe####sdistance.net
- DNS ASK wi####distance.net
- DNS ASK pe####soffice.net
- DNS ASK wi####office.net
- DNS ASK pe####sarrive.net
- DNS ASK wi####arrive.net
- DNS ASK su####tsupply.net
- DNS ASK su####tdistance.net
- DNS ASK su####toffice.net
- DNS ASK fi####supply.net
- DNS ASK se####caught.net
Miscellaneous:
Creates and executes the following:
- 'C:\kvyeoare\iw35scd4xcnhg7wig.exe'
- 'C:\kvyeoare\ffyldezc.exe'
- 'C:\kvyeoare\nydjgpi.exe' "c:\kvyeoare\ffyldezc.exe"
