Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Font Block HomeGroup Thread Now Driver' = 'C:\hatpciup5\oovycfd.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\NGEN Logs Fax Protected Modules] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\NGEN Logs Fax Protected Modules] 'ImagePath' = 'C:\hatpciup5\oovycfd.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\hatpciup5\x2relsobey
- C:\hatpciup5\x2relsobey
- C:\hatpciup5\heblsab345rkzjuudenem2we.exe
- C:\hatpciup5\oovycfd.exe
- C:\hatpciup5\jppiwveo6z.exe
- C:\hatpciup5\olu0sihiwcmi
Sets the 'hidden' attribute to the following files:
- C:\hatpciup5\oovycfd.exe
- C:\hatpciup5\jppiwveo6z.exe
Deletes the following files:
- %WINDIR%\hatpciup5\x2relsobey
- C:\hatpciup5\heblsab345rkzjuudenem2we.exe
Substitutes the following files:
- %WINDIR%\hatpciup5\x2relsobey
Network activity:
Connects to:
- 'ch######nneainsworth.net':80
- 'al#####reaainsworth.net':80
- 'er#####udeainsworth.net':80
- 'al#####reathrussell.net':80
- 'er#####udethrussell.net':80
- 'al#####reaandrewson.net':80
- 'er#####udeandrewson.net':80
- 'al#####reaalfredson.net':80
- 'ch######herthrussell.net':80
- 'er#####udealfredson.net':80
- 'al#####riacaileigh.net':80
- 'ch######ellecallista.net':80
- 'al#####riacallista.net':80
- 'ch######ellemarianne.net':80
- 'al#####riamarianne.net':80
- 'ch######ellecamellia.net':80
- 'al#####riacamellia.net':80
- 'ch#####belalfredson.net':80
- 'mo#####eryalfredson.net':80
- 'mo#####eryandrewson.net':80
- 'ch#####belandrewson.net':80
- 'mo#####erythrussell.net':80
- 'ch######nnethrussell.net':80
- 'ma#####ttathrussell.net':80
- 'ch######nneandrewson.net':80
- 'ma#####ttaandrewson.net':80
- 'ch######nnealfredson.net':80
- 'ma#####ttaalfredson.net':80
- 'ch######herainsworth.net':80
- 'ki#####eighcaileigh.net':80
- 'ch######ellecaileigh.net':80
- 'te#####nceainsworth.net':80
- 'ch######herandrewson.net':80
- 'te#####nceandrewson.net':80
- 'ch######heralfredson.net':80
- 'te#####ncealfredson.net':80
- 'ch#####belainsworth.net':80
- 'mo#####eryainsworth.net':80
- 'ch#####belthrussell.net':80
- 'ma#####ttaainsworth.net':80
- 'te#####ncethrussell.net':80
- 'be#####ttecaileigh.net':80
TCP:
HTTP GET requests:
- http://ch######nneainsworth.net/index.php
- http://al#####reaainsworth.net/index.php
- http://er#####udeainsworth.net/index.php
- http://al#####reathrussell.net/index.php
- http://er#####udethrussell.net/index.php
- http://al#####reaandrewson.net/index.php
- http://er#####udeandrewson.net/index.php
- http://al#####reaalfredson.net/index.php
- http://ch######herthrussell.net/index.php
- http://er#####udealfredson.net/index.php
- http://al#####riacaileigh.net/index.php
- http://ch######ellecallista.net/index.php
- http://al#####riacallista.net/index.php
- http://ch######ellemarianne.net/index.php
- http://al#####riamarianne.net/index.php
- http://ch######ellecamellia.net/index.php
- http://al#####riacamellia.net/index.php
- http://ch#####belalfredson.net/index.php
- http://mo#####eryalfredson.net/index.php
- http://mo#####eryandrewson.net/index.php
- http://ch#####belandrewson.net/index.php
- http://mo#####erythrussell.net/index.php
- http://ch######nnethrussell.net/index.php
- http://ma#####ttathrussell.net/index.php
- http://ch######nneandrewson.net/index.php
- http://ma#####ttaandrewson.net/index.php
- http://ch######nnealfredson.net/index.php
- http://ma#####ttaalfredson.net/index.php
- http://ch######herainsworth.net/index.php
- http://ki#####eighcaileigh.net/index.php
- http://ch######ellecaileigh.net/index.php
- http://te#####nceainsworth.net/index.php
- http://ch######herandrewson.net/index.php
- http://te#####nceandrewson.net/index.php
- http://ch######heralfredson.net/index.php
- http://te#####ncealfredson.net/index.php
- http://ch#####belainsworth.net/index.php
- http://mo#####eryainsworth.net/index.php
- http://ch#####belthrussell.net/index.php
- http://ma#####ttaainsworth.net/index.php
- http://te#####ncethrussell.net/index.php
- http://be#####ttecaileigh.net/index.php
UDP:
- DNS ASK ch######nneainsworth.net
- DNS ASK mo#####eryalfredson.net
- DNS ASK al#####reaainsworth.net
- DNS ASK er#####udeainsworth.net
- DNS ASK al#####reathrussell.net
- DNS ASK er#####udethrussell.net
- DNS ASK al#####reaandrewson.net
- DNS ASK er#####udeandrewson.net
- DNS ASK al#####reaalfredson.net
- DNS ASK ch######ellecaileigh.net
- DNS ASK be#####ttecaileigh.net
- DNS ASK al#####riacaileigh.net
- DNS ASK ch######ellecallista.net
- DNS ASK al#####riacallista.net
- DNS ASK ch######ellemarianne.net
- DNS ASK al#####riamarianne.net
- DNS ASK ch######ellecamellia.net
- DNS ASK al#####riacamellia.net
- DNS ASK ki#####eighcaileigh.net
- DNS ASK ch#####belalfredson.net
- DNS ASK er#####udealfredson.net
- DNS ASK mo#####eryandrewson.net
- DNS ASK te#####nceainsworth.net
- DNS ASK ma#####ttaainsworth.net
- DNS ASK ch######nnethrussell.net
- DNS ASK ma#####ttathrussell.net
- DNS ASK ch######nneandrewson.net
- DNS ASK ma#####ttaandrewson.net
- DNS ASK ch######nnealfredson.net
- DNS ASK ma#####ttaalfredson.net
- DNS ASK ch######herainsworth.net
- DNS ASK ch######herthrussell.net
- DNS ASK mo#####erythrussell.net
- DNS ASK te#####ncethrussell.net
- DNS ASK ch######herandrewson.net
- DNS ASK te#####nceandrewson.net
- DNS ASK ch######heralfredson.net
- DNS ASK te#####ncealfredson.net
- DNS ASK ch#####belainsworth.net
- DNS ASK mo#####eryainsworth.net
- DNS ASK ch#####belthrussell.net
- DNS ASK ch#####belandrewson.net
- DNS ASK ki#####eighcallista.net
Miscellaneous:
Creates and executes the following:
- 'C:\hatpciup5\heblsab345rkzjuudenem2we.exe'
- 'C:\hatpciup5\oovycfd.exe'
- 'C:\hatpciup5\jppiwveo6z.exe' "c:\hatpciup5\oovycfd.exe"
