Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinHTTP Audio Tablet Initiator Networking' = 'C:\guxwynjpuabiqhf\zqduvqays.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Authentication Isolation Link WMI Server Key] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Authentication Isolation Link WMI Server Key] 'ImagePath' = 'C:\guxwynjpuabiqhf\zqduvqays.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\guxwynjpuabiqhf\e2ys0f
- C:\guxwynjpuabiqhf\e2ys0f
- C:\guxwynjpuabiqhf\jtb54idjnhj3uzcgf.exe
- C:\guxwynjpuabiqhf\zqduvqays.exe
- C:\guxwynjpuabiqhf\tokosuuc.exe
Sets the 'hidden' attribute to the following files:
- C:\guxwynjpuabiqhf\zqduvqays.exe
- C:\guxwynjpuabiqhf\tokosuuc.exe
Deletes the following files:
- %WINDIR%\guxwynjpuabiqhf\e2ys0f
- C:\guxwynjpuabiqhf\jtb54idjnhj3uzcgf.exe
Substitutes the following files:
- %WINDIR%\guxwynjpuabiqhf\e2ys0f
Network activity:
Connects to:
- 'mi####before.net':80
- 'ra####settle.net':80
- 'mo####gsettle.net':80
- 'ra####language.net':80
- 'mo####glanguage.net':80
- 'ra####device.net':80
- 'mo####gdevice.net':80
- 'ra####before.net':80
- 'mo####gbefore.net':80
- 'st####esettle.net':80
- 'hi####ysettle.net':80
- 'st####elanguage.net':80
- 'hi####ylanguage.net':80
TCP:
HTTP GET requests:
- http://mi####before.net/index.php
- http://ra####settle.net/index.php
- http://mo####gsettle.net/index.php
- http://ra####language.net/index.php
- http://mo####glanguage.net/index.php
- http://ra####device.net/index.php
- http://mo####gdevice.net/index.php
- http://ra####before.net/index.php
- http://mo####gbefore.net/index.php
- http://st####esettle.net/index.php
- http://hi####ysettle.net/index.php
- http://st####elanguage.net/index.php
- http://hi####ylanguage.net/index.php
UDP:
- DNS ASK mi####before.net
- DNS ASK tw####before.net
- DNS ASK ra####settle.net
- DNS ASK mo####gsettle.net
- DNS ASK ra####language.net
- DNS ASK mo####glanguage.net
- DNS ASK ra####device.net
- DNS ASK mo####gdevice.net
- DNS ASK ra####before.net
- DNS ASK mo####gbefore.net
- DNS ASK st####esettle.net
- DNS ASK hi####ysettle.net
- DNS ASK st####elanguage.net
- DNS ASK hi####ylanguage.net
Miscellaneous:
Creates and executes the following:
- 'C:\guxwynjpuabiqhf\jtb54idjnhj3uzcgf.exe'
- 'C:\guxwynjpuabiqhf\zqduvqays.exe'
- 'C:\guxwynjpuabiqhf\tokosuuc.exe' "c:\guxwynjpuabiqhf\zqduvqays.exe"
