Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Play Quality Builder Print Profile' = 'C:\phuzuams\jgqncxwp.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Health Driver UPnP Now Disk Gateway] 'ImagePath' = 'C:\phuzuams\jgqncxwp.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Health Driver UPnP Now Disk Gateway] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\phuzuams\tkjzxjd.exe' "c:\phuzuams\jgqncxwp.exe"
- 'C:\phuzuams\jgqncxwp.exe'
- 'C:\phuzuams\ejdpu32otetlk6s9oxp.exe'
Modifies file system:
Creates the following files:
- C:\phuzuams\jgqncxwp.exe
- C:\phuzuams\tkjzxjd.exe
- C:\phuzuams\vcffyknlj
- %WINDIR%\phuzuams\dznewbqpnwkx
- C:\phuzuams\dznewbqpnwkx
- C:\phuzuams\ejdpu32otetlk6s9oxp.exe
Sets the 'hidden' attribute to the following files:
- C:\phuzuams\tkjzxjd.exe
- C:\phuzuams\jgqncxwp.exe
Deletes the following files:
- C:\phuzuams\ejdpu32otetlk6s9oxp.exe
- %WINDIR%\phuzuams\dznewbqpnwkx
Network activity:
Connects to:
- 'li###edried.net':80
- 'de####yfifteen.net':80
- 'de####ydried.net':80
- 'jo####yarticle.net':80
- 'hu####darticle.net':80
- 'de####yarticle.net':80
- 'li####article.net':80
- 'li###eangry.net':80
- 'li####fifteen.net':80
- 'de####yangry.net':80
- 're####erbutter.net':80
- 'jo####ydried.net':80
- 'wo###butter.net':80
- 'wo###behind.net':80
- 're####erbehind.net':80
- 'jo####yangry.net':80
- 'hu####dangry.net':80
- 'hu####dfifteen.net':80
- 'hu####ddried.net':80
- 'jo####yfifteen.net':80
- 'ri###ndried.net':80
- 'ch####rticle.net':80
- 'th####rticle.net':80
- 'th###angry.net':80
- 'th####ifteen.net':80
- 'ch###angry.net':80
- 'su####fifteen.net':80
- 'wi###nangry.net':80
- 'wi####fifteen.net':80
- 'wi###ndried.net':80
- 'su###rdried.net':80
- 'ri###nangry.net':80
- 'be###gangry.net':80
- 'be####fifteen.net':80
- 'be###gdried.net':80
- 'ri####fifteen.net':80
- 'th###dried.net':80
- 'ch####ifteen.net':80
- 'ch###dried.net':80
- 'ri####article.net':80
- 'be####article.net':80
- 're####erbroad.net':80
- 'th###butter.net':80
- 'wi#####nderstand.net':80
- 'ch###butter.net':80
- 'ch###behind.net':80
- 'th###behind.net':80
- 'wi####behind.net':80
- 'su####behind.net':80
- 'su###rbroad.net':80
- 'su#####nderstand.net':80
- 'wi###nbroad.net':80
- 'be####behind.net':80
- 'ri####butter.net':80
- 'ri####behind.net':80
- 'ri###nbroad.net':80
- 'be###gbroad.net':80
- 'ch###broad.net':80
- 'th###broad.net':80
- 'th####nderstand.net':80
- 'be####butter.net':80
- 'ch####nderstand.net':80
- 'wi####butter.net':80
- 'fo####behind.net':80
- 'in####sebehind.net':80
- 'in####sebroad.net':80
- 'in#####eunderstand.net':80
- 'fo###tbroad.net':80
- 're#####runderstand.net':80
- 'wo###broad.net':80
- 'wo####nderstand.net':80
- 'fo####butter.net':80
- 'in####sebutter.net':80
- 'ef###tbroad.net':80
- 'th####hbroad.net':80
- 'th#####understand.net':80
- 'su####butter.net':80
- 'ef#####nderstand.net':80
- 'th####hbutter.net':80
- 'fo#####nderstand.net':80
- 'ef####butter.net':80
- 'ef####behind.net':80
- 'th####hbehind.net':80
TCP:
HTTP GET requests:
- http://li###edried.net/index.php?me########
- http://de####yfifteen.net/index.php?me########
- http://de####ydried.net/index.php?me########
- http://jo####yarticle.net/index.php?me########
- http://hu####darticle.net/index.php?me########
- http://de####yarticle.net/index.php?me########
- http://li####article.net/index.php?me########
- http://li###eangry.net/index.php?me########
- http://li####fifteen.net/index.php?me########
- http://de####yangry.net/index.php?me########
- http://re####erbutter.net/index.php?me########
- http://jo####ydried.net/index.php?me########
- http://wo###butter.net/index.php?me########
- http://wo###behind.net/index.php?me########
- http://re####erbehind.net/index.php?me########
- http://jo####yangry.net/index.php?me########
- http://hu####dangry.net/index.php?me########
- http://hu####dfifteen.net/index.php?me########
- http://hu####ddried.net/index.php?me########
- http://jo####yfifteen.net/index.php?me########
- http://ri###ndried.net/index.php?me########
- http://ch####rticle.net/index.php?me########
- http://th####rticle.net/index.php?me########
- http://th###angry.net/index.php?me########
- http://th####ifteen.net/index.php?me########
- http://ch###angry.net/index.php?me########
- http://su####fifteen.net/index.php?me########
- http://wi###nangry.net/index.php?me########
- http://wi####fifteen.net/index.php?me########
- http://wi###ndried.net/index.php?me########
- http://su###rdried.net/index.php?me########
- http://ri###nangry.net/index.php?me########
- http://be###gangry.net/index.php?me########
- http://be####fifteen.net/index.php?me########
- http://be###gdried.net/index.php?me########
- http://ri####fifteen.net/index.php?me########
- http://th###dried.net/index.php?me########
- http://ch####ifteen.net/index.php?me########
- http://ch###dried.net/index.php?me########
- http://ri####article.net/index.php?me########
- http://be####article.net/index.php?me########
- http://re####erbroad.net/index.php?me########
- http://th###butter.net/index.php?me########
- http://wi#####nderstand.net/index.php?me########
- http://ch###butter.net/index.php?me########
- http://ch###behind.net/index.php?me########
- http://th###behind.net/index.php?me########
- http://wi####behind.net/index.php?me########
- http://su####behind.net/index.php?me########
- http://su###rbroad.net/index.php?me########
- http://su#####nderstand.net/index.php?me########
- http://wi###nbroad.net/index.php?me########
- http://be####behind.net/index.php?me########
- http://ri####butter.net/index.php?me########
- http://ri####behind.net/index.php?me########
- http://ri###nbroad.net/index.php?me########
- http://be###gbroad.net/index.php?me########
- http://ch###broad.net/index.php?me########
- http://th###broad.net/index.php?me########
- http://th####nderstand.net/index.php?me########
- http://be####butter.net/index.php?me########
- http://ch####nderstand.net/index.php?me########
- http://wi####butter.net/index.php?me########
- http://fo####behind.net/index.php?me########
- http://in####sebehind.net/index.php?me########
- http://in####sebroad.net/index.php?me########
- http://in#####eunderstand.net/index.php?me########
- http://fo###tbroad.net/index.php?me########
- http://re#####runderstand.net/index.php?me########
- http://wo###broad.net/index.php?me########
- http://wo####nderstand.net/index.php?me########
- http://fo####butter.net/index.php?me########
- http://in####sebutter.net/index.php?me########
- http://ef###tbroad.net/index.php?me########
- http://th####hbroad.net/index.php?me########
- http://th#####understand.net/index.php?me########
- http://su####butter.net/index.php?me########
- http://ef#####nderstand.net/index.php?me########
- http://th####hbutter.net/index.php?me########
- http://fo#####nderstand.net/index.php?me########
- http://ef####butter.net/index.php?me########
- http://ef####behind.net/index.php?me########
- http://th####hbehind.net/index.php?me########
UDP:
- DNS ASK de####yfifteen.net
- DNS ASK li####fifteen.net
- DNS ASK li###edried.net
- DNS ASK hu####darticle.net
- DNS ASK de####ydried.net
- DNS ASK li####article.net
- DNS ASK ri###ndried.net
- DNS ASK de####yarticle.net
- DNS ASK de####yangry.net
- DNS ASK li###eangry.net
- DNS ASK jo####yarticle.net
- DNS ASK re####erbutter.net
- DNS ASK jo####ydried.net
- DNS ASK wo###butter.net
- DNS ASK wo###behind.net
- DNS ASK re####erbehind.net
- DNS ASK jo####yangry.net
- DNS ASK hu####dangry.net
- DNS ASK hu####dfifteen.net
- DNS ASK hu####ddried.net
- DNS ASK jo####yfifteen.net
- DNS ASK th####rticle.net
- DNS ASK wi###ndried.net
- DNS ASK ch####rticle.net
- DNS ASK ch###angry.net
- DNS ASK th###angry.net
- DNS ASK wi###nangry.net
- DNS ASK su###rangry.net
- DNS ASK su####fifteen.net
- DNS ASK su###rdried.net
- DNS ASK wi####fifteen.net
- DNS ASK th####ifteen.net
- DNS ASK ri###nangry.net
- DNS ASK be###gangry.net
- DNS ASK be####fifteen.net
- DNS ASK be###gdried.net
- DNS ASK ri####fifteen.net
- DNS ASK th###dried.net
- DNS ASK ch####ifteen.net
- DNS ASK ch###dried.net
- DNS ASK ri####article.net
- DNS ASK be####article.net
- DNS ASK wi#####nderstand.net
- DNS ASK su#####nderstand.net
- DNS ASK th###butter.net
- DNS ASK th###behind.net
- DNS ASK ch###butter.net
- DNS ASK su####behind.net
- DNS ASK wi####butter.net
- DNS ASK wi####behind.net
- DNS ASK wi###nbroad.net
- DNS ASK su###rbroad.net
- DNS ASK ch###behind.net
- DNS ASK be####behind.net
- DNS ASK ri####butter.net
- DNS ASK ri####behind.net
- DNS ASK ri###nbroad.net
- DNS ASK be###gbroad.net
- DNS ASK ch###broad.net
- DNS ASK th###broad.net
- DNS ASK th####nderstand.net
- DNS ASK be####butter.net
- DNS ASK ch####nderstand.net
- DNS ASK in####sebehind.net
- DNS ASK fo####butter.net
- DNS ASK fo####behind.net
- DNS ASK fo###tbroad.net
- DNS ASK in####sebroad.net
- DNS ASK wo###broad.net
- DNS ASK re####erbroad.net
- DNS ASK re#####runderstand.net
- DNS ASK in####sebutter.net
- DNS ASK wo####nderstand.net
- DNS ASK in#####eunderstand.net
- DNS ASK ef###tbroad.net
- DNS ASK th####hbroad.net
- DNS ASK th#####understand.net
- DNS ASK su####butter.net
- DNS ASK ef#####nderstand.net
- DNS ASK th####hbutter.net
- DNS ASK fo#####nderstand.net
- DNS ASK ef####butter.net
- DNS ASK ef####behind.net
- DNS ASK th####hbehind.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
