Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Protocol Web Certificate Port' = 'C:\nssynajjht\vchgnbionv.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Audio Engine Biometric Shadow Collector] 'ImagePath' = 'C:\nssynajjht\vchgnbionv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Audio Engine Biometric Shadow Collector] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\nssynajjht\zvbyhvozidjj.exe' "c:\nssynajjht\vchgnbionv.exe"
- 'C:\nssynajjht\vchgnbionv.exe'
- 'C:\nssynajjht\qwzg2dzhugptypjxuj.exe'
Modifies file system:
Creates the following files:
- C:\nssynajjht\vchgnbionv.exe
- C:\nssynajjht\zvbyhvozidjj.exe
- C:\nssynajjht\qwzg2dzhugptypjxuj.exe
- %WINDIR%\nssynajjht\zbrzlnfyt8c
- C:\nssynajjht\zbrzlnfyt8c
Sets the 'hidden' attribute to the following files:
- C:\nssynajjht\zvbyhvozidjj.exe
- C:\nssynajjht\vchgnbionv.exe
Deletes the following files:
- C:\nssynajjht\qwzg2dzhugptypjxuj.exe
- %WINDIR%\nssynajjht\zbrzlnfyt8c
Network activity:
Connects to:
- 'ei####complete.net':80
- 'en####hcomplete.net':80
- 'en####hproud.net':80
- 'en####haround.net':80
- 'ei###rproud.net':80
- 'be####eneedle.net':80
- 'ex####enough.net':80
- 'ex####needle.net':80
- 'ex####nature.net':80
- 'be####enature.net':80
- 'ei####around.net':80
- 'fa####around.net':80
- 'ch####enproud.net':80
- 'ch####enaround.net':80
- 'ch####enwelcome.net':80
- 'fa####welcome.net':80
- 'ei####welcome.net':80
- 'en####hwelcome.net':80
- 'fa####complete.net':80
- 'fa###yproud.net':80
- 'ch#####ncomplete.net':80
- 'fo####nneedle.net':80
- 'su####enough.net':80
- 'su####needle.net':80
- 'su####nature.net':80
- 'fo####nnature.net':80
- 'wh####rnature.net':80
- 'ri###nature.net':80
- 'fo####ngovern.net':80
- 'fo####nenough.net':80
- 'su####govern.net':80
- 'ma####egovern.net':80
- 'pe####nature.net':80
- 'ma####enature.net':80
- 'be####egovern.net':80
- 'be####eenough.net':80
- 'ex####govern.net':80
- 'ma####eenough.net':80
- 'pe####govern.net':80
- 'pe####enough.net':80
- 'pe####needle.net':80
- 'ma####eneedle.net':80
- 'ci#####tecomplete.net':80
- 'fo####naround.net':80
- 'su###nproud.net':80
- 'su####around.net':80
- 'su####welcome.net':80
- 'fo####nwelcome.net':80
- 'wh####rwelcome.net':80
- 'ri####elcome.net':80
- 'fo####ncomplete.net':80
- 'fo####nproud.net':80
- 'su####complete.net':80
- 'ma####ecomplete.net':80
- 'pe####welcome.net':80
- 'ma####ewelcome.net':80
- 'be####ecomplete.net':80
- 'be####eproud.net':80
- 'ex####complete.net':80
- 'ma####eproud.net':80
- 'pe####complete.net':80
- 'pe###nproud.net':80
- 'pe####around.net':80
- 'ma####earound.net':80
- 'pi####ewelcome.net':80
- 'ci#####tewelcome.net':80
- 'th####complete.net':80
- 'th###hproud.net':80
- 'fi####complete.net':80
- 'ci####tteproud.net':80
- 'pi####ecomplete.net':80
- 'pi####eproud.net':80
- 'pi####earound.net':80
- 'ci####ttearound.net':80
- 'fi###eproud.net':80
- 'ri###proud.net':80
- 'wh####rcomplete.net':80
- 'wh####rproud.net':80
- 'wh####raround.net':80
- 'ri###around.net':80
- 'fi####around.net':80
- 'th####around.net':80
- 'th####welcome.net':80
- 'ri####omplete.net':80
- 'fi####welcome.net':80
TCP:
HTTP GET requests:
- http://ei####complete.net/index.php
- http://en####hcomplete.net/index.php
- http://en####hproud.net/index.php
- http://en####haround.net/index.php
- http://ei###rproud.net/index.php
- http://be####eneedle.net/index.php
- http://ex####enough.net/index.php
- http://ex####needle.net/index.php
- http://ex####nature.net/index.php
- http://be####enature.net/index.php
- http://ei####around.net/index.php
- http://fa####around.net/index.php
- http://ch####enproud.net/index.php
- http://ch####enaround.net/index.php
- http://ch####enwelcome.net/index.php
- http://fa####welcome.net/index.php
- http://ei####welcome.net/index.php
- http://en####hwelcome.net/index.php
- http://fa####complete.net/index.php
- http://fa###yproud.net/index.php
- http://ch#####ncomplete.net/index.php
- http://fo####nneedle.net/index.php
- http://su####enough.net/index.php
- http://su####needle.net/index.php
- http://su####nature.net/index.php
- http://fo####nnature.net/index.php
- http://wh####rnature.net/index.php
- http://ri###nature.net/index.php
- http://fo####ngovern.net/index.php
- http://fo####nenough.net/index.php
- http://su####govern.net/index.php
- http://ma####egovern.net/index.php
- http://pe####nature.net/index.php
- http://ma####enature.net/index.php
- http://be####egovern.net/index.php
- http://be####eenough.net/index.php
- http://ex####govern.net/index.php
- http://ma####eenough.net/index.php
- http://pe####govern.net/index.php
- http://pe####enough.net/index.php
- http://pe####needle.net/index.php
- http://ma####eneedle.net/index.php
- http://ci#####tecomplete.net/index.php
- http://fo####naround.net/index.php
- http://su###nproud.net/index.php
- http://su####around.net/index.php
- http://su####welcome.net/index.php
- http://fo####nwelcome.net/index.php
- http://wh####rwelcome.net/index.php
- http://ri####elcome.net/index.php
- http://fo####ncomplete.net/index.php
- http://fo####nproud.net/index.php
- http://su####complete.net/index.php
- http://ma####ecomplete.net/index.php
- http://pe####welcome.net/index.php
- http://ma####ewelcome.net/index.php
- http://be####ecomplete.net/index.php
- http://be####eproud.net/index.php
- http://ex####complete.net/index.php
- http://ma####eproud.net/index.php
- http://pe####complete.net/index.php
- http://pe###nproud.net/index.php
- http://pe####around.net/index.php
- http://ma####earound.net/index.php
- http://pi####ewelcome.net/index.php
- http://ci#####tewelcome.net/index.php
- http://th####complete.net/index.php
- http://th###hproud.net/index.php
- http://fi####complete.net/index.php
- http://ci####tteproud.net/index.php
- http://pi####ecomplete.net/index.php
- http://pi####eproud.net/index.php
- http://pi####earound.net/index.php
- http://ci####ttearound.net/index.php
- http://fi###eproud.net/index.php
- http://ri###proud.net/index.php
- http://wh####rcomplete.net/index.php
- http://wh####rproud.net/index.php
- http://wh####raround.net/index.php
- http://ri###around.net/index.php
- http://fi####around.net/index.php
- http://th####around.net/index.php
- http://th####welcome.net/index.php
- http://ri####omplete.net/index.php
- http://fi####welcome.net/index.php
UDP:
- DNS ASK ei####complete.net
- DNS ASK en####hcomplete.net
- DNS ASK en####hproud.net
- DNS ASK en####haround.net
- DNS ASK ei###rproud.net
- DNS ASK be####eneedle.net
- DNS ASK ex####enough.net
- DNS ASK ex####needle.net
- DNS ASK ex####nature.net
- DNS ASK be####enature.net
- DNS ASK ei####around.net
- DNS ASK fa####around.net
- DNS ASK ch####enproud.net
- DNS ASK ch####enaround.net
- DNS ASK ch####enwelcome.net
- DNS ASK fa####welcome.net
- DNS ASK ei####welcome.net
- DNS ASK en####hwelcome.net
- DNS ASK fa####complete.net
- DNS ASK fa###yproud.net
- DNS ASK ch#####ncomplete.net
- DNS ASK be####eenough.net
- DNS ASK su####enough.net
- DNS ASK fo####nenough.net
- DNS ASK fo####nneedle.net
- DNS ASK fo####nnature.net
- DNS ASK su####needle.net
- DNS ASK ri###nature.net
- DNS ASK wh####rneedle.net
- DNS ASK wh####rnature.net
- DNS ASK su####govern.net
- DNS ASK fo####ngovern.net
- DNS ASK su####nature.net
- DNS ASK ma####enature.net
- DNS ASK pe####needle.net
- DNS ASK pe####nature.net
- DNS ASK ex####govern.net
- DNS ASK be####egovern.net
- DNS ASK pe####govern.net
- DNS ASK ma####egovern.net
- DNS ASK ma####eenough.net
- DNS ASK ma####eneedle.net
- DNS ASK pe####enough.net
- DNS ASK fo####naround.net
- DNS ASK su###nproud.net
- DNS ASK su####around.net
- DNS ASK su####welcome.net
- DNS ASK fo####nwelcome.net
- DNS ASK wh####rwelcome.net
- DNS ASK ri####elcome.net
- DNS ASK fo####ncomplete.net
- DNS ASK fo####nproud.net
- DNS ASK su####complete.net
- DNS ASK ma####ecomplete.net
- DNS ASK pe####welcome.net
- DNS ASK ma####ewelcome.net
- DNS ASK be####ecomplete.net
- DNS ASK be####eproud.net
- DNS ASK ex####complete.net
- DNS ASK ma####eproud.net
- DNS ASK pe####complete.net
- DNS ASK pe###nproud.net
- DNS ASK pe####around.net
- DNS ASK ma####earound.net
- DNS ASK wh####raround.net
- DNS ASK ci#####tewelcome.net
- DNS ASK pi####earound.net
- DNS ASK pi####ewelcome.net
- DNS ASK fi####complete.net
- DNS ASK th####complete.net
- DNS ASK pi####ecomplete.net
- DNS ASK ci#####tecomplete.net
- DNS ASK ci####tteproud.net
- DNS ASK ci####ttearound.net
- DNS ASK pi####eproud.net
- DNS ASK th###hproud.net
- DNS ASK wh####rcomplete.net
- DNS ASK ri####omplete.net
- DNS ASK ri###proud.net
- DNS ASK ri###around.net
- DNS ASK wh####rproud.net
- DNS ASK th####around.net
- DNS ASK fi###eproud.net
- DNS ASK fi####around.net
- DNS ASK fi####welcome.net
- DNS ASK th####welcome.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
