Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Protected iSCSI IP Removal Copy Update' = '%APPDATA%\ottzslqpekh\mcmghpfxfuf.exe'
Malicious functions:
Executes the following:
- '%APPDATA%\ottzslqpekh\utgvcfs.exe' "%APPDATA%\ottzslqpekh\mcmghpfxfuf.exe"
- '%APPDATA%\ottzslqpekh\mcmghpfxfuf.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\ottzslqpekh\mcmghpfxfuf.bf
- %APPDATA%\ottzslqpekh\utgvcfs.exe
- %APPDATA%\ottzslqpekh\mcmghpfxfuf.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\ottzslqpekh\utgvcfs.exe
- %APPDATA%\ottzslqpekh\mcmghpfxfuf.exe
Network activity:
Connects to:
- 'va####sdivide.net':80
- 're####bottle.net':80
- 'va####sbottle.net':80
- 're####divide.net':80
- 'de####another.net':80
- 'fo####dmanner.net':80
- 'de####manner.net':80
- 'ge####divide.net':80
- 'ge####bottle.net':80
- 'he###bottle.net':80
- 'va####sstream.net':80
- 're####nothing.net':80
- 'va####snothing.net':80
- 're####stream.net':80
- 'fo####danother.net':80
- 'gl####usiness.net':80
- 'an####business.net':80
- 'gl####nother.net':80
- 'an####appear.net':80
- 'he###manner.net':80
- 'di####ultmanner.net':80
- 'gl###appear.net':80
- 'de####appear.net':80
- 'fo####dbusiness.net':80
- 'de####business.net':80
- 'fo####dappear.net':80
- 'an####another.net':80
- 'gl###manner.net':80
- 'an####manner.net':80
- 'ge####nothing.net':80
- 'ne####arydivide.net':80
- 'pl####ntdivide.net':80
- 'ne####arybottle.net':80
- 'or###stream.net':80
- 're####enothing.net':80
- 'or####othing.net':80
- 're####estream.net':80
- 'pl####ntstream.net':80
- 'he###divide.net':80
- 'di####ultdivide.net':80
- 'ne####arystream.net':80
- 'pl####ntbottle.net':80
- 'ne#####rynothing.net':80
- 'pl####ntnothing.net':80
- 'or###bottle.net':80
- 'le####divide.net':80
- 'he####bottle.net':80
- 'le####bottle.net':80
- 'he####divide.net':80
- 'he####othing.net':80
- 'ge####stream.net':80
- 'he###stream.net':80
- 're####edivide.net':80
- 'or###divide.net':80
- 're####ebottle.net':80
- 'le####stream.net':80
- 'he####nothing.net':80
- 'le####nothing.net':80
- 'he####stream.net':80
TCP:
HTTP GET requests:
- http://va####sdivide.net/forum/search.php?em##################################
- http://re####bottle.net/forum/search.php?em##################################
- http://va####sbottle.net/forum/search.php?em##################################
- http://re####divide.net/forum/search.php?em##################################
- http://de####another.net/forum/search.php?em##################################
- http://fo####dmanner.net/forum/search.php?em##################################
- http://de####manner.net/forum/search.php?em##################################
- http://ge####divide.net/forum/search.php?em##################################
- http://ge####bottle.net/forum/search.php?em##################################
- http://he###bottle.net/forum/search.php?em##################################
- http://va####sstream.net/forum/search.php?em##################################
- http://re####nothing.net/forum/search.php?em##################################
- http://va####snothing.net/forum/search.php?em##################################
- http://re####stream.net/forum/search.php?em##################################
- http://fo####danother.net/forum/search.php?em##################################
- http://gl####usiness.net/forum/search.php?em##################################
- http://an####business.net/forum/search.php?em##################################
- http://gl####nother.net/forum/search.php?em##################################
- http://an####appear.net/forum/search.php?em##################################
- http://he###manner.net/forum/search.php?em##################################
- http://di####ultmanner.net/forum/search.php?em##################################
- http://gl###appear.net/forum/search.php?em##################################
- http://de####appear.net/forum/search.php?em##################################
- http://fo####dbusiness.net/forum/search.php?em##################################
- http://de####business.net/forum/search.php?em##################################
- http://fo####dappear.net/forum/search.php?em##################################
- http://an####another.net/forum/search.php?em##################################
- http://gl###manner.net/forum/search.php?em##################################
- http://an####manner.net/forum/search.php?em##################################
- http://ge####nothing.net/forum/search.php?em##################################
- http://ne####arydivide.net/forum/search.php?em##################################
- http://pl####ntdivide.net/forum/search.php?em##################################
- http://ne####arybottle.net/forum/search.php?em##################################
- http://or###stream.net/forum/search.php?em##################################
- http://re####enothing.net/forum/search.php?em##################################
- http://or####othing.net/forum/search.php?em##################################
- http://re####estream.net/forum/search.php?em##################################
- http://pl####ntstream.net/forum/search.php?em##################################
- http://he###divide.net/forum/search.php?em##################################
- http://di####ultdivide.net/forum/search.php?em##################################
- http://ne####arystream.net/forum/search.php?em##################################
- http://pl####ntbottle.net/forum/search.php?em##################################
- http://ne#####rynothing.net/forum/search.php?em##################################
- http://pl####ntnothing.net/forum/search.php?em##################################
- http://or###bottle.net/forum/search.php?em##################################
- http://le####divide.net/forum/search.php?em##################################
- http://he####bottle.net/forum/search.php?em##################################
- http://le####bottle.net/forum/search.php?em##################################
- http://he####divide.net/forum/search.php?em##################################
- http://he####othing.net/forum/search.php?em##################################
- http://ge####stream.net/forum/search.php?em##################################
- http://he###stream.net/forum/search.php?em##################################
- http://re####edivide.net/forum/search.php?em##################################
- http://or###divide.net/forum/search.php?em##################################
- http://re####ebottle.net/forum/search.php?em##################################
- http://le####stream.net/forum/search.php?em##################################
- http://he####nothing.net/forum/search.php?em##################################
- http://le####nothing.net/forum/search.php?em##################################
- http://he####stream.net/forum/search.php?em##################################
UDP:
- DNS ASK va####sdivide.net
- DNS ASK re####bottle.net
- DNS ASK va####sbottle.net
- DNS ASK re####divide.net
- DNS ASK de####another.net
- DNS ASK fo####dmanner.net
- DNS ASK de####manner.net
- DNS ASK ge####divide.net
- DNS ASK ge####bottle.net
- DNS ASK he###bottle.net
- DNS ASK va####sstream.net
- DNS ASK re####nothing.net
- DNS ASK va####snothing.net
- DNS ASK re####stream.net
- DNS ASK fo####danother.net
- DNS ASK gl####usiness.net
- DNS ASK an####business.net
- DNS ASK gl####nother.net
- DNS ASK an####appear.net
- DNS ASK he###manner.net
- DNS ASK di####ultmanner.net
- DNS ASK gl###appear.net
- DNS ASK de####appear.net
- DNS ASK fo####dbusiness.net
- DNS ASK de####business.net
- DNS ASK fo####dappear.net
- DNS ASK an####another.net
- DNS ASK gl###manner.net
- DNS ASK an####manner.net
- DNS ASK ge####nothing.net
- DNS ASK ne####arydivide.net
- DNS ASK pl####ntdivide.net
- DNS ASK ne####arybottle.net
- DNS ASK or###stream.net
- DNS ASK re####enothing.net
- DNS ASK or####othing.net
- DNS ASK re####estream.net
- DNS ASK pl####ntstream.net
- DNS ASK he###divide.net
- DNS ASK di####ultdivide.net
- DNS ASK ne####arystream.net
- DNS ASK pl####ntbottle.net
- DNS ASK ne#####rynothing.net
- DNS ASK pl####ntnothing.net
- DNS ASK or###bottle.net
- DNS ASK le####divide.net
- DNS ASK he####bottle.net
- DNS ASK le####bottle.net
- DNS ASK he####divide.net
- DNS ASK he####othing.net
- DNS ASK ge####stream.net
- DNS ASK he###stream.net
- DNS ASK re####edivide.net
- DNS ASK or###divide.net
- DNS ASK re####ebottle.net
- DNS ASK le####stream.net
- DNS ASK he####nothing.net
- DNS ASK le####nothing.net
- DNS ASK he####stream.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
