Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Offline Secondary Peer Diagnostic IKE Auto Disk] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Offline Secondary Peer Diagnostic IKE Auto Disk] 'ImagePath' = '%WINDIR%\nnglgfk.exe'
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode disable
Modifies file system
Creates the following files
- %WINDIR%\ehklfihmvezmvb\tst
- %TEMP%\oxsfpqaxxacv6cpnnoptffta.exe
- %WINDIR%\nnglgfk.exe
- %WINDIR%\qbsmuvcszs.exe
- %WINDIR%\ehklfihmvezmvb\rng
- %WINDIR%\ehklfihmvezmvb\run
- %WINDIR%\ehklfihmvezmvb\cfg
- %WINDIR%\temp\oxsfpqaxsizes0pnn.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\nnglgfk.exe
- %WINDIR%\qbsmuvcszs.exe
Deletes the following files
- %TEMP%\oxsfpqaxxacv6cpnnoptffta.exe
- %WINDIR%\temp\oxsfpqaxsizes0pnn.exe
Network activity
TCP
HTTP GET requests
- http://gr###compe.net/index.php
- http://wa###count.net/index.php
- http://th###ompe.net/index.php
UDP
- DNS ASK do####object.net
- DNS ASK sp###fell.net
- DNS ASK vi###fell.net
- DNS ASK sp###count.net
- DNS ASK vi###count.net
- DNS ASK wa###compe.net
- DNS ASK fa###ompe.net
- DNS ASK wa###hour.net
- DNS ASK fa###our.net
- DNS ASK wa###fell.net
- DNS ASK fa###ell.net
- DNS ASK so###left.net
- DNS ASK wa###count.net
- DNS ASK dr###compe.net
- DNS ASK th###ompe.net
- DNS ASK dr###hour.net
- DNS ASK th###our.net
- DNS ASK dr###fell.net
- DNS ASK th###ell.net
- DNS ASK dr###count.net
- DNS ASK th###ount.net
- DNS ASK ar###hope.net
- DNS ASK so###hope.net
- DNS ASK sp###hour.net
- DNS ASK vi###hour.net
- DNS ASK vi###compe.net
- DNS ASK sp###compe.net
- DNS ASK gr###count.net
- DNS ASK mi####pecial.net
- DNS ASK ri###nstorm.net
- DNS ASK du#####llamartinson.net
- DNS ASK ma#####llabotwright.net
- DNS ASK si#####tesherisse.net
- DNS ASK de####between.net
- DNS ASK al####eighbor.net
- DNS ASK ge###eangry.net
- DNS ASK gw#####ynhuddleston.net
- DNS ASK ar###left.net
- DNS ASK si######edwerryhouse.net
- DNS ASK fa###ount.net
- DNS ASK of####urprise.net
- DNS ASK mo####gduring.net
- DNS ASK wi###bout.net
- DNS ASK ca###tep.net
- DNS ASK gr###compe.net
- DNS ASK eq###hour.net
- DNS ASK gr###hour.net
- DNS ASK eq###fell.net
- DNS ASK gr###fell.net
- DNS ASK eq###count.net
- DNS ASK se####strong.net
- DNS ASK br###nthird.net
- DNS ASK ch####nother.net
- '23#.#55.255.250':1900
Miscellaneous
Creates and executes the following
- '%TEMP%\oxsfpqaxxacv6cpnnoptffta.exe'
- '%WINDIR%\nnglgfk.exe'
- '%WINDIR%\qbsmuvcszs.exe' "%WINDIR%\nnglgfk.exe"
- '%WINDIR%\temp\oxsfpqaxsizes0pnn.exe' -r 48560 tcp
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode disable' (with hidden window)
- '%WINDIR%\temp\oxsfpqaxsizes0pnn.exe' -r 48560 tcp' (with hidden window)
