Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Link-Layer Access iSCSI Portable' = 'C:\qgnuhysuenni\pdayvrkikn.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ActiveX SPP Configuration Framework Ordering] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ActiveX SPP Configuration Framework Ordering] 'ImagePath' = 'C:\qgnuhysuenni\pdayvrkikn.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\qgnuhysuenni\sveunjudw
- C:\qgnuhysuenni\sveunjudw
- C:\qgnuhysuenni\jcu1rtcd35ako7gxawdau.exe
- C:\qgnuhysuenni\pdayvrkikn.exe
- C:\qgnuhysuenni\cdwzntmnqx.exe
- C:\qgnuhysuenni\ejwdxcj
Sets the 'hidden' attribute to the following files:
- C:\qgnuhysuenni\pdayvrkikn.exe
- C:\qgnuhysuenni\cdwzntmnqx.exe
Deletes the following files:
- %WINDIR%\qgnuhysuenni\sveunjudw
- C:\qgnuhysuenni\jcu1rtcd35ako7gxawdau.exe
Substitutes the following files:
- %WINDIR%\qgnuhysuenni\sveunjudw
Network activity:
Connects to:
- 'mo#####erycharissa.net':80
- 'be#####ttegretchen.net':80
- 'ki#####eighcalanthe.net':80
- 'be#####ttecalanthe.net':80
- 'ki#####eighashleigh.net':80
- 'be#####tteashleigh.net':80
- 'ch#####belchauncey.net':80
- 're#####nnechauncey.net':80
- 'ch#####belgretchen.net':80
- 're#####nnegretchen.net':80
- 'ch#####belcalanthe.net':80
- 're#####nnecalanthe.net':80
- 'ch#####belashleigh.net':80
- 're#####nneashleigh.net':80
- 'ge#####nnachauncey.net':80
- 'ja#####inechauncey.net':80
- 'ge#####nnagretchen.net':80
- 'ja#####inegretchen.net':80
- 'ki#####eighgretchen.net':80
- 'ge#####nnacalanthe.net':80
- 'be#####ttechauncey.net':80
- 'al#####riaashleigh.net':80
- 'ch#####belvirginia.net':80
- 'mo#####eryvirginia.net':80
- 'al#####reaangelina.net':80
- 'er#####udeangelina.net':80
- 'al#####reamaddison.net':80
- 'er#####udemaddison.net':80
- 'al#####reacharissa.net':80
- 'er#####udecharissa.net':80
- 'al#####reavirginia.net':80
- 'er#####udevirginia.net':80
- 'ch######ellechauncey.net':80
- 'al#####riachauncey.net':80
- 'ch######ellegretchen.net':80
- 'al#####riagretchen.net':80
- 'ch######ellecalanthe.net':80
- 'al#####riacalanthe.net':80
- 'ch######elleashleigh.net':80
- 'ki#####eighchauncey.net':80
- 'ja#####inecalanthe.net':80
TCP:
HTTP GET requests:
- http://mo#####erycharissa.net/index.php
- http://be#####ttegretchen.net/index.php
- http://ki#####eighcalanthe.net/index.php
- http://be#####ttecalanthe.net/index.php
- http://ki#####eighashleigh.net/index.php
- http://be#####tteashleigh.net/index.php
- http://ch#####belchauncey.net/index.php
- http://re#####nnechauncey.net/index.php
- http://ch#####belgretchen.net/index.php
- http://re#####nnegretchen.net/index.php
- http://ch#####belcalanthe.net/index.php
- http://re#####nnecalanthe.net/index.php
- http://ch#####belashleigh.net/index.php
- http://re#####nneashleigh.net/index.php
- http://ge#####nnachauncey.net/index.php
- http://ja#####inechauncey.net/index.php
- http://ge#####nnagretchen.net/index.php
- http://ja#####inegretchen.net/index.php
- http://ki#####eighgretchen.net/index.php
- http://ge#####nnacalanthe.net/index.php
- http://be#####ttechauncey.net/index.php
- http://al#####riaashleigh.net/index.php
- http://ch#####belvirginia.net/index.php
- http://mo#####eryvirginia.net/index.php
- http://al#####reaangelina.net/index.php
- http://er#####udeangelina.net/index.php
- http://al#####reamaddison.net/index.php
- http://er#####udemaddison.net/index.php
- http://al#####reacharissa.net/index.php
- http://er#####udecharissa.net/index.php
- http://al#####reavirginia.net/index.php
- http://er#####udevirginia.net/index.php
- http://ch######ellechauncey.net/index.php
- http://al#####riachauncey.net/index.php
- http://ch######ellegretchen.net/index.php
- http://al#####riagretchen.net/index.php
- http://ch######ellecalanthe.net/index.php
- http://al#####riacalanthe.net/index.php
- http://ch######elleashleigh.net/index.php
- http://ki#####eighchauncey.net/index.php
- http://ja#####inecalanthe.net/index.php
UDP:
- DNS ASK mo#####erycharissa.net
- DNS ASK be#####ttecalanthe.net
- DNS ASK ki#####eighashleigh.net
- DNS ASK be#####tteashleigh.net
- DNS ASK ch#####belchauncey.net
- DNS ASK re#####nnechauncey.net
- DNS ASK ch#####belgretchen.net
- DNS ASK re#####nnegretchen.net
- DNS ASK er#####udevirginia.net
- DNS ASK ch#####belcalanthe.net
- DNS ASK ch#####belashleigh.net
- DNS ASK re#####nneashleigh.net
- DNS ASK ge#####nnachauncey.net
- DNS ASK ja#####inechauncey.net
- DNS ASK ge#####nnagretchen.net
- DNS ASK ja#####inegretchen.net
- DNS ASK ge#####nnacalanthe.net
- DNS ASK be#####ttegretchen.net
- DNS ASK ki#####eighcalanthe.net
- DNS ASK ki#####eighgretchen.net
- DNS ASK be#####ttechauncey.net
- DNS ASK ki#####eighchauncey.net
- DNS ASK mo#####eryvirginia.net
- DNS ASK al#####reaangelina.net
- DNS ASK er#####udeangelina.net
- DNS ASK al#####reamaddison.net
- DNS ASK er#####udemaddison.net
- DNS ASK al#####reacharissa.net
- DNS ASK er#####udecharissa.net
- DNS ASK ja#####inecalanthe.net
- DNS ASK re#####nnecalanthe.net
- DNS ASK al#####reavirginia.net
- DNS ASK al#####riachauncey.net
- DNS ASK ch######ellegretchen.net
- DNS ASK al#####riagretchen.net
- DNS ASK ch######ellecalanthe.net
- DNS ASK al#####riacalanthe.net
- DNS ASK ch######elleashleigh.net
- DNS ASK al#####riaashleigh.net
- DNS ASK ch#####belvirginia.net
- DNS ASK ch######ellechauncey.net
- DNS ASK ge#####nnaashleigh.net
Miscellaneous:
Creates and executes the following:
- 'C:\qgnuhysuenni\jcu1rtcd35ako7gxawdau.exe'
- 'C:\qgnuhysuenni\pdayvrkikn.exe'
- 'C:\qgnuhysuenni\cdwzntmnqx.exe' "c:\qgnuhysuenni\pdayvrkikn.exe"
