Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Bluetooth Auto Collector Media' = 'C:\nkdppfhqmdzu\cnfzxmyvge.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Time Remote Resource Adaptive] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Time Remote Resource Adaptive] 'ImagePath' = 'C:\nkdppfhqmdzu\cnfzxmyvge.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\nkdppfhqmdzu\xzlrlkgw
- C:\nkdppfhqmdzu\xzlrlkgw
- C:\nkdppfhqmdzu\sqkcl54a4xqbb7taiyi.exe
- C:\nkdppfhqmdzu\cnfzxmyvge.exe
- C:\nkdppfhqmdzu\hkofjeb.exe
Sets the 'hidden' attribute to the following files:
- C:\nkdppfhqmdzu\cnfzxmyvge.exe
- C:\nkdppfhqmdzu\hkofjeb.exe
Deletes the following files:
- %WINDIR%\nkdppfhqmdzu\xzlrlkgw
- C:\nkdppfhqmdzu\sqkcl54a4xqbb7taiyi.exe
Substitutes the following files:
- %WINDIR%\nkdppfhqmdzu\xzlrlkgw
Network activity:
Connects to:
- 'be###anger.net':80
- 'wa###wheat.net':80
- 'th####twheat.net':80
- 'cr###forest.net':80
- 'su####forest.net':80
- 'cr###always.net':80
- 'su####always.net':80
- 'cr###anger.net':80
- 'su###ranger.net':80
- 'cr###wheat.net':80
- 'su###rwheat.net':80
- 'kn###forest.net':80
- 'be###forest.net':80
- 'kn###always.net':80
- 'be###always.net':80
- 'kn###anger.net':80
- 'th####tanger.net':80
- 'wa###anger.net':80
TCP:
HTTP GET requests:
- http://be###anger.net/index.php
- http://wa###wheat.net/index.php
- http://th####twheat.net/index.php
- http://cr###forest.net/index.php
- http://su####forest.net/index.php
- http://cr###always.net/index.php
- http://su####always.net/index.php
- http://cr###anger.net/index.php
- http://su###ranger.net/index.php
- http://cr###wheat.net/index.php
- http://su###rwheat.net/index.php
- http://kn###forest.net/index.php
- http://be###forest.net/index.php
- http://kn###always.net/index.php
- http://be###always.net/index.php
- http://kn###anger.net/index.php
- http://th####tanger.net/index.php
- http://wa###anger.net/index.php
UDP:
- DNS ASK be###anger.net
- DNS ASK th####tanger.net
- DNS ASK wa###wheat.net
- DNS ASK th####twheat.net
- DNS ASK cr###forest.net
- DNS ASK su####forest.net
- DNS ASK cr###always.net
- DNS ASK su####always.net
- DNS ASK wa###anger.net
- DNS ASK cr###anger.net
- DNS ASK cr###wheat.net
- DNS ASK su###rwheat.net
- DNS ASK kn###forest.net
- DNS ASK be###forest.net
- DNS ASK kn###always.net
- DNS ASK be###always.net
- DNS ASK kn###anger.net
- DNS ASK su###ranger.net
- DNS ASK th####talways.net
Miscellaneous:
Creates and executes the following:
- 'C:\nkdppfhqmdzu\sqkcl54a4xqbb7taiyi.exe'
- 'C:\nkdppfhqmdzu\cnfzxmyvge.exe'
- 'C:\nkdppfhqmdzu\hkofjeb.exe' "c:\nkdppfhqmdzu\cnfzxmyvge.exe"
