Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Scheduler Profile Services Interface' = '<SYSTEM32>\aovawtt.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Service Keying Installer] 'ImagePath' = '<SYSTEM32>\aovawtt.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Service Keying Installer] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Executes the following:
- '<SYSTEM32>\uqzvvdhtlewe.exe' "<SYSTEM32>\aovawtt.exe"
- '%WINDIR%\Temp\akqr4fqcz06czs.exe' -r 31837 tcp
- '%TEMP%\akqr4fe4sraezsowep31.exe'
- '<SYSTEM32>\aovawtt.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\gerzynuxzqrqpn\run
- <SYSTEM32>\gerzynuxzqrqpn\rng
- %WINDIR%\Temp\akqr4fqcz06czs.exe
- <SYSTEM32>\gerzynuxzqrqpn\cfg
- %TEMP%\akqr4fe4sraezsowep31.exe
- <SYSTEM32>\gerzynuxzqrqpn\tst
- <SYSTEM32>\uqzvvdhtlewe.exe
- <SYSTEM32>\aovawtt.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\uqzvvdhtlewe.exe
- <SYSTEM32>\aovawtt.exe
Deletes the following files:
- %WINDIR%\Temp\akqr4fqcz06czs.exe
- %TEMP%\akqr4fe4sraezsowep31.exe
Network activity:
Connects to:
- 'wr###feel.net':80
- 'ro###nly.net':80
- 'ro###olor.net':80
- 'ro###igh.net':80
- 'de###nly.net':80
- 'hu###guide.net':80
- 'wr###only.ru':80
- 'wr###high.net':80
- 'ma##feel.ru':80
- 'ma###eel.net':80
- 'wi###bout.net':80
- 're####needle.net':80
- '18#.#06.120.168':80
- '13#.#2.139.16':80
- '17#.#36.150.135':8080
- 'de###olor.ru':80
- 'de###olor.net':80
- 'lo####thepings.ru':80
- 'ri###nstorm.net':80
- 'er#####udesymphony.net':80
TCP:
HTTP GET requests:
- http://wr###feel.net/index.php
- http://ro###nly.net/index.php
- http://de###nly.net/index.php
- http://ro###olor.net/index.php
- http://ma##feel.ru/index.php
- http://hu###guide.net/index.php
- http://wr###only.ru/index.php
- http://ma###eel.net/index.php
- http://wr###high.net/index.php
- http://ro###igh.net/index.php
- http://wi###bout.net/index.php
- http://re####needle.net/index.php
- http://13#.#2.139.16/index.php
- http://18#.#06.120.168/index.php
- http://ri###nstorm.net/index.php
- http://de###olor.ru/index.php
- http://de###olor.net/index.php
- http://er#####udesymphony.net/index.php
- http://lo####thepings.ru/index.php
UDP:
- DNS ASK wi###ady.net
- DNS ASK jo###ady.net
- DNS ASK jo##lady.ru
- DNS ASK de###ing.net
- DNS ASK wi###ish.net
- DNS ASK jo###ish.net
- DNS ASK wi###ast.net
- DNS ASK se####berfish.net
- DNS ASK se####berfish.ru
- DNS ASK se####berlady.net
- DNS ASK jo###ast.net
- DNS ASK wi###ing.net
- DNS ASK jo###ing.net
- DNS ASK ro##wing.ru
- DNS ASK ma###ing.net
- DNS ASK wr###wing.net
- DNS ASK ro###ish.net
- DNS ASK ma###ast.net
- DNS ASK ma##past.ru
- DNS ASK wr###past.net
- DNS ASK de###ish.net
- DNS ASK ro###ast.net
- DNS ASK de###ast.net
- DNS ASK ro###ing.net
- DNS ASK de##fish.ru
- DNS ASK ro###ady.net
- DNS ASK de###ady.net
- DNS ASK sp###past.net
- DNS ASK sp###past.ru
- DNS ASK we###ast.net
- DNS ASK we###ish.net
- DNS ASK sp###lady.net
- DNS ASK we###ady.net
- DNS ASK sp###wing.net
- DNS ASK ya##fish.ru
- DNS ASK mu###lady.net
- DNS ASK ya###ady.net
- DNS ASK we###ing.net
- DNS ASK mu###fish.net
- DNS ASK ya###ish.net
- DNS ASK sp###fish.net
- DNS ASK of###fish.net
- DNS ASK fr###fish.net
- DNS ASK of###lady.net
- DNS ASK se####berpast.net
- DNS ASK ha##past.ru
- DNS ASK se####berwing.net
- DNS ASK of###lady.ru
- DNS ASK of###wing.net
- DNS ASK fr###wing.net
- DNS ASK fr###wing.ru
- DNS ASK fr###lady.net
- DNS ASK of###past.net
- DNS ASK fr###past.net
- DNS ASK gl###ear.net
- DNS ASK ta###grow.net
- DNS ASK ta###grow.ru
- DNS ASK ta###thank.net
- DNS ASK gl###hank.net
- DNS ASK ta###tear.net
- DNS ASK gl###row.net
- DNS ASK sp###hank.net
- DNS ASK sp###hank.ru
- DNS ASK sa###ear.net
- DNS ASK sa###ity.net
- DNS ASK sp###ity.net
- DNS ASK sa###hank.net
- DNS ASK gl##city.ru
- DNS ASK eq###city.net
- DNS ASK gr###thank.net
- DNS ASK eq###thank.net
- DNS ASK sp###grow.net
- DNS ASK sp###grow.ru
- DNS ASK gr###city.net
- DNS ASK gr###tear.net
- DNS ASK eq###grow.net
- DNS ASK ta###city.net
- DNS ASK gl###ity.net
- DNS ASK gr###tear.ru
- DNS ASK eq###tear.net
- DNS ASK gr###grow.net
- DNS ASK ar###thank.net
- DNS ASK so###tear.net
- DNS ASK ar###tear.net
- DNS ASK so###thank.net
- DNS ASK ar###city.net
- DNS ASK so###thank.ru
- DNS ASK so###grow.net
- DNS ASK wr###fish.net
- DNS ASK ma###ady.net
- DNS ASK wr###lady.net
- DNS ASK ar###grow.net
- DNS ASK ar###grow.ru
- DNS ASK ma###ish.net
- DNS ASK so###city.net
- DNS ASK wh###city.net
- DNS ASK wh###city.ru
- DNS ASK up###ity.net
- DNS ASK sp###ear.net
- DNS ASK sa###row.net
- DNS ASK sp###row.net
- DNS ASK wh###thank.net
- DNS ASK up##tear.ru
- DNS ASK wh###grow.net
- DNS ASK up###row.net
- DNS ASK up###hank.net
- DNS ASK wh###tear.net
- DNS ASK up###ear.net
- DNS ASK vi###grow.net
- DNS ASK mu###guide.net
- DNS ASK ma###olor.net
- DNS ASK ya###uide.net
- DNS ASK mu###half.net
- DNS ASK ya###ate.net
- DNS ASK we###ame.net
- DNS ASK ma###nly.net
- DNS ASK ya###alf.net
- DNS ASK ya##half.ru
- DNS ASK ha###uide.net
- DNS ASK wr###only.net
- DNS ASK ma###igh.net
- DNS ASK mu###name.net
- DNS ASK sp###name.net
- DNS ASK sp###late.net
- DNS ASK sp###late.ru
- DNS ASK we###ate.net
- DNS ASK fr###name.net
- DNS ASK of###half.net
- DNS ASK fr###half.net
- DNS ASK sp###guide.net
- DNS ASK mu###guide.ru
- DNS ASK mu###late.net
- DNS ASK we###alf.net
- DNS ASK we###uide.net
- DNS ASK we##name.ru
- DNS ASK sp###half.net
- DNS ASK de###nly.net
- DNS ASK ro###igh.net
- DNS ASK de###olor.net
- DNS ASK ro###nly.net
- DNS ASK wr###feel.net
- DNS ASK ro###olor.net
- DNS ASK de###olor.ru
- DNS ASK re####needle.net
- DNS ASK wi###bout.net
- DNS ASK mu###past.net
- DNS ASK lo####thepings.ru
- DNS ASK er#####udesymphony.net
- DNS ASK ri###nstorm.net
- DNS ASK ma##feel.ru
- DNS ASK hu###late.net
- DNS ASK wr###color.net
- DNS ASK hu###name.net
- DNS ASK ha###ame.net
- DNS ASK ha##name.ru
- DNS ASK ya###ame.net
- DNS ASK ha###alf.net
- DNS ASK hu###guide.net
- DNS ASK wr###high.net
- DNS ASK ma###eel.net
- DNS ASK hu###half.net
- DNS ASK ha###ate.net
- DNS ASK wr###only.ru
- DNS ASK wr###guide.net
- DNS ASK ma###ame.net
- DNS ASK wr###name.net
- DNS ASK ma##late.ru
- DNS ASK wr###late.net
- DNS ASK ma###uide.net
- DNS ASK wr###name.ru
- DNS ASK de###ate.net
- DNS ASK ro###uide.net
- DNS ASK de###uide.net
- DNS ASK ma###alf.net
- DNS ASK wr###half.net
- DNS ASK ro###ate.net
- DNS ASK ma###ate.net
- DNS ASK ya###ing.net
- DNS ASK ha###ish.net
- DNS ASK hu###fish.net
- DNS ASK ya###ast.net
- DNS ASK mu###wing.net
- DNS ASK mu###wing.ru
- DNS ASK ha###ady.net
- DNS ASK hu###past.net
- DNS ASK ha###ing.net
- DNS ASK hu###wing.net
- DNS ASK hu###lady.net
- DNS ASK hu###lady.ru
- DNS ASK ha###ast.net
- DNS ASK se####berguide.net
- DNS ASK se####bername.net
- DNS ASK se####berhalf.net
- DNS ASK jo###alf.net
- DNS ASK se####berlate.net
- DNS ASK ha##late.ru
- DNS ASK se####berhalf.ru
- DNS ASK fr###guide.net
- DNS ASK fr###guide.ru
- DNS ASK of###name.net
- DNS ASK of###late.net
- DNS ASK fr###late.net
- DNS ASK of###guide.net
- DNS ASK wi###alf.net
- DNS ASK ro###alf.net
- DNS ASK de###alf.net
- DNS ASK de##half.ru
- DNS ASK ro###uide.ru
- DNS ASK ro###ame.net
- DNS ASK de###ame.net
- DNS ASK wi###ate.net
- DNS ASK jo###uide.net
- DNS ASK wi##name.ru
- DNS ASK jo###ame.net
- DNS ASK jo###ate.net
- DNS ASK wi###uide.net
- DNS ASK wi###ame.net
- '23#.#55.255.250':1900
