Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%LOCALAPPDATA%\bngceggw\jqurrgmn.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'JquRrgmn' = '%LOCALAPPDATA%\bngceggw\jqurrgmn.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\jqurrgmn.exe
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Micorsoft Windows Service] 'ImagePath' = '%TEMP%\qfvyrdia.sys'
Creates the following services
- 'Micorsoft Windows Service' %TEMP%\qfvyrdia.sys
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
- Windows Update
- Windows Security Center
- Windows Defender
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\bysmtiot.exe
- %ALLUSERSPROFILE%\xxpfiwli.log
- %LOCALAPPDATA%\kwkkkfhh.log
- %LOCALAPPDATA%\bngceggw\jqurrgmn.exe
- %TEMP%\qfvyrdia.sys
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\jqurrgmn.exe
Deletes the following files
- %TEMP%\qfvyrdia.sys
Network activity
Connects to
- 'google.com':80
- 'ax####njgrnryt.com':443
- 'ax####yldgeq.com':443
- 'rk####wmesvwhpc.com':443
- 'ue#####jiyxnnvws.com':443
- 'vu####rewjwl.com':443
- 'ad####bhiwoccqa.com':443
- 'ra###hgme.com':443
- 'aj####etyjkj.com':443
TCP
Other
- 'ax####yldgeq.com':443
- 'rk####wmesvwhpc.com':443
- 'vu####rewjwl.com':443
- 'ue#####jiyxnnvws.com':443
- 'ra###hgme.com':443
UDP
- DNS ASK ax####yldgeq.com
- DNS ASK to###vfw.com
- DNS ASK jp#####rcyyjhxgfe.com
- DNS ASK lg#####welloqvoapja.com
- DNS ASK jq###kahjy.com
- DNS ASK qs###npxs.com
- DNS ASK jd####imckmliwg.com
- DNS ASK lj####xdwkng.com
- DNS ASK tr###lysgaw.com
- DNS ASK yw####sgdcotai.com
- DNS ASK gd####eqhmsp.com
- DNS ASK fq#####vxeqvhwurneo.com
- DNS ASK oe###tnpiw.com
- DNS ASK hy###sfjrxm.com
- DNS ASK rg###ejio.com
- DNS ASK vs###vgn.com
- DNS ASK kw###ybys.com
- DNS ASK er####swjoaljqn.com
- DNS ASK pc#####rnotxtpnf.com
- DNS ASK jm####ksibdgmd.com
- DNS ASK wm#####mchdlylshccm.com
- DNS ASK lb####okirnhlif.com
- DNS ASK sk###apnsqe.com
- DNS ASK go####famwpp.com
- DNS ASK yl###gaeya.com
- DNS ASK po####brdndnlm.com
- DNS ASK jq#####hettmbknif.com
- DNS ASK oe####nhskhbiy.com
- DNS ASK qw#####ilkuliegjpyv.com
- DNS ASK xf#####xdeualrdfs.com
- DNS ASK jl#####diatjebvatqs.com
- DNS ASK cm#####fjwedynauvf.com
- DNS ASK bj#####mxvdhgfqit.com
- DNS ASK nu###dvrwwk.com
- DNS ASK no####frclygo.com
- DNS ASK ca###rotpxh.com
- DNS ASK lb###kjo.com
- DNS ASK cq#####jaqpvfiosqek.com
- DNS ASK if####qfvmueks.com
- DNS ASK kj####wvufccay.com
- DNS ASK un####uglpsrmnh.com
- DNS ASK op####ygeahskm.com
- DNS ASK ng###nmsgwx.com
- DNS ASK ip#####qcnbyhwxsdn.com
- DNS ASK ub####cxmsgtxtx.com
- DNS ASK da###bnoiu.com
- DNS ASK pp####wimaeibyp.com
- DNS ASK rx####snlgobkn.com
- DNS ASK ul####amcnlo.com
- DNS ASK ib####tvubjmwdp.com
- DNS ASK ey#####idnsfoqvl.com
- DNS ASK mw###jqskbl.com
- DNS ASK ys####fgsybxkf.com
- DNS ASK hi####amuwhhb.com
- DNS ASK rh####yaaknox.com
- DNS ASK lm###ifkguc.com
- DNS ASK my###jcl.com
- DNS ASK ag###tkxxko.com
- DNS ASK wd#####rruclcbxev.com
- DNS ASK ui####nfgvexm.com
- DNS ASK ro###med.com
- DNS ASK ps###jew.com
- DNS ASK ea#####yomvtkksj.com
- DNS ASK jy###fskeyr.com
- DNS ASK ql####yvdlqth.com
- DNS ASK uu#####hygyetfyk.com
- DNS ASK jk#####nliqcplhhb.com
- DNS ASK lg###ttqjbd.com
- DNS ASK ai###caopi.com
- DNS ASK hg###yrq.com
- DNS ASK rx###adfied.com
- DNS ASK op###vfc.com
- DNS ASK nj####hogvyhjoy.com
- DNS ASK ki####gwjdhew.com
- DNS ASK gu###bclj.com
- DNS ASK jr#####jkjdivjco.com
- DNS ASK cw###odbrv.com
- DNS ASK fj###sghky.com
- DNS ASK ik####xnntips.com
- DNS ASK rp#####mcvvkhrgp.com
- DNS ASK ji###whvmxj.com
- DNS ASK ax###xdyeyn.com
- DNS ASK gi###ckpl.com
- DNS ASK cr###xsejh.com
- DNS ASK xa####nhphspw.com
- DNS ASK mg###qybl.com
- DNS ASK eu#####clwmaqchisn.com
- DNS ASK vs####xghhmpcc.com
- DNS ASK nt####wecupvyu.com
- DNS ASK pi###yahadq.com
- DNS ASK nx####ijiweu.com
- DNS ASK lr#####xdyryuify.com
- DNS ASK wp#####ybqcqmyqbl.com
- DNS ASK uo####ioxcrla.com
- DNS ASK gm####qqplaklr.com
- DNS ASK kx####aqhnoxhew.com
- DNS ASK xl####errtyv.com
- DNS ASK rq####ppmlbg.com
- DNS ASK tu####ifpyrc.com
- DNS ASK aq####ddsxklxe.com
- DNS ASK su#####uweptmhlxyhq.com
- DNS ASK gv###wrivm.com
- DNS ASK vj#####jtbobafxmc.com
- DNS ASK ys###rulyic.com
- DNS ASK bo###bjn.com
- DNS ASK fh####ytwhsr.com
- DNS ASK eu###cxqqyg.com
- DNS ASK fu###rdol.com
- DNS ASK tg####ausony.com
- DNS ASK ad####bhiwoccqa.com
- DNS ASK in#####lbqalsalowfq.com
- DNS ASK mf###dcelh.com
- DNS ASK ne###fyokt.com
- DNS ASK ra###hgme.com
- DNS ASK ed###jyun.com
- DNS ASK lm###eowe.com
- DNS ASK fu###raut.com
- DNS ASK df#####cgpxdafddnx.com
- DNS ASK ao###touhnv.com
- DNS ASK tb###fsef.com
- DNS ASK hx####mmtdqqvo.com
- DNS ASK kk###xbsc.com
- DNS ASK wr####jkdhvlw.com
- DNS ASK ee####jommryy.com
- DNS ASK aj####etyjkj.com
- DNS ASK dt#####icjkdetclt.com
- DNS ASK tx###wwxfam.com
- DNS ASK ro####fvclppad.com
- DNS ASK sq#####qksckbfrs.com
- DNS ASK rw#####huiiucxkfckw.com
- DNS ASK rk####wmesvwhpc.com
- DNS ASK wx###fvmqi.com
- DNS ASK pm####uvmfmcajv.com
- DNS ASK nh###mmg.com
- DNS ASK yw####qktqxsxkt.com
- DNS ASK gv####qxpyrb.com
- DNS ASK nb#####emrpedccrcyp.com
- DNS ASK vu####rewjwl.com
- DNS ASK mg###qfisg.com
- DNS ASK dh#####shdrvpcpp.com
- DNS ASK xy####vhkvbje.com
- DNS ASK ij###lsdiw.com
- DNS ASK jh###brcyo.com
- DNS ASK sd####elyqary.com
- DNS ASK nq###nrafsi.com
- DNS ASK jp###ajhhv.com
- DNS ASK ue#####jiyxnnvws.com
- DNS ASK ff#####dkpvknrckkog.com
- DNS ASK dc#####vnaalcrviddw.com
- DNS ASK pa###vvipc.com
- DNS ASK dt###nnah.com
- DNS ASK ni###bpyig.com
- DNS ASK qd#####cnhbucojk.com
- DNS ASK oc###gvgn.com
- DNS ASK fq####ycbvcrw.com
- DNS ASK hr###oetf.com
- DNS ASK lp#####jdvpkyncdrl.com
- DNS ASK sv###eop.com
- DNS ASK kg#####opwjtoima.com
- DNS ASK cn###bnssw.com
- DNS ASK py#####pqmaymkho.com
- DNS ASK fv####ujmtnnk.com
- DNS ASK th#####llqexrctjby.com
- DNS ASK qn###vocb.com
- DNS ASK hm#####jfnccuratlh.com
- DNS ASK bq###pbphsg.com
- DNS ASK fi####fxwtdmn.com
- DNS ASK sl###lmyrwh.com
- DNS ASK np###bnvo.com
- DNS ASK qc#####funtohovjf.com
- DNS ASK wm####ffbjsj.com
- DNS ASK xo###slt.com
- DNS ASK ld####blghjgajw.com
- DNS ASK km####hxqkpop.com
- DNS ASK ex###wbvrb.com
- DNS ASK wi####evntsw.com
- DNS ASK kg####finlkn.com
- DNS ASK gh####xplacpt.com
- DNS ASK sx#####atcldovjljo.com
- DNS ASK oy###kdshy.com
- DNS ASK iy#####ycqvlnrun.com
- DNS ASK ul###fcxfe.com
- DNS ASK by###ajwmkl.com
- DNS ASK je####jagfudj.com
- DNS ASK yy###oxpn.com
- DNS ASK yw####yyvempl.com
- DNS ASK fl###wxtbhv.com
- DNS ASK ax####njgrnryt.com
- DNS ASK sl####fnacvbyj.com
- DNS ASK rw####skwvtnfcx.com
- DNS ASK av#####asuslrxswsyp.com
- DNS ASK gt###tnv.com
- DNS ASK qj#####hlkrkmdbe.com
- DNS ASK cx####xbujjcrxs.com
- DNS ASK lh####dlqexik.com
- DNS ASK ml####thipoh.com
- DNS ASK hh#####sbelfwlxywl.com
- DNS ASK rr####myfdrlks.com
- DNS ASK im####ikfcdp.com
- DNS ASK yn####gopbbplsi.com
- DNS ASK google.com
- 'localhost':50020
- 'localhost':61578
Miscellaneous
Creates and executes the following
- '%TEMP%\bysmtiot.exe' elevate
- '%TEMP%\bysmtiot.exe' admin
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\bysmtiot.exe"" admin
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\bysmtiot.exe"" admin' (with hidden window)
