Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Search Modules Office Mapper Power' = '<SYSTEM32>\fwrcfgmkm.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\fwrcfgmkm.exe
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Center Block Disk Color Font] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- <SYSTEM32>\ximbnormig.exe "<SYSTEM32>\fwrcfgmkm.exe"
- %WINDIR%\Temp\gfivdpa27tpvorm.exe -r 23473 tcp
- %TEMP%\gfivdpa25ajvorvljsve.exe
- <SYSTEM32>\fwrcfgmkm.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\wouukkn\run
- <SYSTEM32>\wouukkn\rng
- %WINDIR%\Temp\gfivdpa27tpvorm.exe
- <SYSTEM32>\wouukkn\cfg
- <SYSTEM32>\ximbnormig.exe
- %TEMP%\gfivdpa25ajvorvljsve.exe
- <SYSTEM32>\wouukkn\tst
- <SYSTEM32>\fwrcfgmkm.exe
- <SYSTEM32>\wouukkn\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\ximbnormig.exe
- <SYSTEM32>\fwrcfgmkm.exe
Deletes the following files:
- %WINDIR%\Temp\gfivdpa27tpvorm.exe
- %TEMP%\gfivdpa25ajvorvljsve.exe
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 've###how.net':80
- 'we###unt.net':80
- 'we###how.net':80
- 'to###ear.net':80
- 'fa###ear.net':80
- 've###unt.net':80
- 've###ear.net':80
- 'pi###show.net':80
- 'we###ear.net':80
- 'we###ule.net':80
- 've###ule.net':80
- 'se###hear.net':80
- 'le###hear.net':80
- 'le###rule.net':80
- 'le###hunt.net':80
- 'se###rule.net':80
- 'to###how.net':80
- 'to###ule.net':80
- 'fa###ule.net':80
- 'fa###unt.net':80
- 'fa###how.net':80
- 'to###unt.net':80
- 'ta###ear.net':80
- 'tr###under.net':80
- 'wa###ear.net':80
- 'wa###ule.net':80
- 'ta###ule.net':80
- 'yo###nder.net':80
- 'yo###eed.net':80
- 'tr###lend.net':80
- 'tr###feed.net':80
- 'tr###monday.net':80
- 'yo###onday.net':80
- 'pi###rule.net':80
- 'mu###ule.net':80
- 'mu###unt.net':80
- 'mu###how.net':80
- 'pi###hunt.net':80
- 'pi###hear.net':80
- 'wa###unt.net':80
- 'ta###unt.net':80
- 'ta###how.net':80
- 'mu###ear.net':80
- 'wa###how.net':80
- 'se###hunt.net':80
- 'wa###oon.net':80
- 'ta###oon.net':80
- 'ta###ctober.net':80
- 'ta###hoe.net':80
- 'wa###ctober.net':80
- 'wa###uter.net':80
- 'tr###hunt.net':80
- 'yo###unt.net':80
- 'yo###how.net':80
- 'ta###uter.net':80
- 'tr###show.net':80
- 'go#####everytime.com':80
- 'pi####ctober.net':80
- 'ja###uter.com':80
- 'do####club-grup.com':80
- 'el#####arimagine.com':80
- 'mu###ctober.net':80
- 'mu###uter.net':80
- 'wa###hoe.net':80
- 'pi###outer.net':80
- 'pi###moon.net':80
- 'mu###oon.net':80
- 'pl###hunt.net':80
- 'fi###unt.net':80
- 'fi###how.net':80
- 'vi###ear.net':80
- 'pl###show.net':80
- 'pl###rule.net':80
- 'se###show.net':80
- 'le###show.net':80
- 'fi###ear.net':80
- 'fi###ule.net':80
- 'pl###hear.net':80
- 'yo###ear.net':80
- 'lr###show.net':80
- 'tr###hear.net':80
- 'tr###rule.net':80
- 'yo###ule.net':80
- 'vi###how.net':80
- 'vi###ule.net':80
- 'lr###hear.net':80
- 'lr###rule.net':80
- 'lr###hunt.net':80
- 'vi###unt.net':80
TCP:
HTTP GET requests:
- ve###how.net/forum/search.php?me#########################################
- we###unt.net/forum/search.php?me#########################################
- we###how.net/forum/search.php?me#########################################
- to###ear.net/forum/search.php?me#########################################
- fa###ear.net/forum/search.php?me#########################################
- ve###unt.net/forum/search.php?me#########################################
- ve###ear.net/forum/search.php?me#########################################
- pi###show.net/forum/search.php?me#########################################
- we###ear.net/forum/search.php?me#########################################
- we###ule.net/forum/search.php?me#########################################
- ve###ule.net/forum/search.php?me#########################################
- se###hear.net/forum/search.php?me#########################################
- le###hear.net/forum/search.php?me#########################################
- le###rule.net/forum/search.php?me#########################################
- le###hunt.net/forum/search.php?me#########################################
- se###rule.net/forum/search.php?me#########################################
- to###how.net/forum/search.php?me#########################################
- to###ule.net/forum/search.php?me#########################################
- fa###ule.net/forum/search.php?me#########################################
- fa###unt.net/forum/search.php?me#########################################
- fa###how.net/forum/search.php?me#########################################
- to###unt.net/forum/search.php?me#########################################
- ta###ear.net/forum/search.php?me#########################################
- tr###under.net/forum/search.php?me#########################################
- wa###ear.net/forum/search.php?me#########################################
- wa###ule.net/forum/search.php?me#########################################
- ta###ule.net/forum/search.php?me#########################################
- yo###nder.net/forum/search.php?me#########################################
- yo###eed.net/forum/search.php?me#########################################
- tr###lend.net/forum/search.php?me#########################################
- tr###feed.net/forum/search.php?me#########################################
- tr###monday.net/forum/search.php?me#########################################
- yo###onday.net/forum/search.php?me#########################################
- pi###rule.net/forum/search.php?me#########################################
- mu###ule.net/forum/search.php?me#########################################
- mu###unt.net/forum/search.php?me#########################################
- mu###how.net/forum/search.php?me#########################################
- pi###hunt.net/forum/search.php?me#########################################
- pi###hear.net/forum/search.php?me#########################################
- wa###unt.net/forum/search.php?me#########################################
- ta###unt.net/forum/search.php?me#########################################
- ta###how.net/forum/search.php?me#########################################
- mu###ear.net/forum/search.php?me#########################################
- wa###how.net/forum/search.php?me#########################################
- se###hunt.net/forum/search.php?me#########################################
- wa###oon.net/forum/search.php?me#########################################
- ta###oon.net/forum/search.php?me#########################################
- ta###ctober.net/forum/search.php?me#########################################
- ta###hoe.net/forum/search.php?me#########################################
- wa###ctober.net/forum/search.php?me#########################################
- wa###uter.net/forum/search.php?me#########################################
- tr###hunt.net/forum/search.php?me#########################################
- yo###unt.net/forum/search.php?me#########################################
- yo###how.net/forum/search.php?me#########################################
- ta###uter.net/forum/search.php?me#########################################
- tr###show.net/forum/search.php?me#########################################
- go#####everytime.com/forum/search.php?me#########################################
- pi####ctober.net/forum/search.php?me#########################################
- ja###uter.com/forum/search.php?me#########################################
- do####club-grup.com/forum/search.php?me#########################################
- el#####arimagine.com/forum/search.php?me#########################################
- mu###ctober.net/forum/search.php?me#########################################
- mu###uter.net/forum/search.php?me#########################################
- wa###hoe.net/forum/search.php?me#########################################
- pi###outer.net/forum/search.php?me#########################################
- pi###moon.net/forum/search.php?me#########################################
- mu###oon.net/forum/search.php?me#########################################
- pl###hunt.net/forum/search.php?me#########################################
- fi###unt.net/forum/search.php?me#########################################
- fi###how.net/forum/search.php?me#########################################
- vi###ear.net/forum/search.php?me#########################################
- pl###show.net/forum/search.php?me#########################################
- pl###rule.net/forum/search.php?me#########################################
- se###show.net/forum/search.php?me#########################################
- le###show.net/forum/search.php?me#########################################
- fi###ear.net/forum/search.php?me#########################################
- fi###ule.net/forum/search.php?me#########################################
- pl###hear.net/forum/search.php?me#########################################
- yo###ear.net/forum/search.php?me#########################################
- lr###show.net/forum/search.php?me#########################################
- tr###hear.net/forum/search.php?me#########################################
- tr###rule.net/forum/search.php?me#########################################
- yo###ule.net/forum/search.php?me#########################################
- vi###how.net/forum/search.php?me#########################################
- vi###ule.net/forum/search.php?me#########################################
- lr###hear.net/forum/search.php?me#########################################
- lr###rule.net/forum/search.php?me#########################################
- lr###hunt.net/forum/search.php?me#########################################
- vi###unt.net/forum/search.php?me#########################################
UDP:
- DNS ASK we###how.net
- DNS ASK ve###how.net
- DNS ASK fa###ear.net
- DNS ASK fa###ule.net
- DNS ASK to###ear.net
- DNS ASK we###unt.net
- DNS ASK we###ear.net
- DNS ASK ve###ear.net
- DNS ASK ve###ule.net
- DNS ASK ve###unt.net
- DNS ASK we###ule.net
- DNS ASK le###rule.net
- DNS ASK se###hear.net
- DNS ASK se###rule.net
- DNS ASK se###hunt.net
- DNS ASK le###hunt.net
- DNS ASK le###hear.net
- DNS ASK fa###unt.net
- DNS ASK to###ule.net
- DNS ASK to###unt.net
- DNS ASK to###how.net
- DNS ASK fa###how.net
- DNS ASK pi###show.net
- DNS ASK ta###ear.net
- DNS ASK tr###under.net
- DNS ASK wa###ear.net
- DNS ASK wa###ule.net
- DNS ASK ta###ule.net
- DNS ASK yo###nder.net
- DNS ASK yo###eed.net
- DNS ASK tr###lend.net
- DNS ASK tr###feed.net
- DNS ASK tr###monday.net
- DNS ASK yo###onday.net
- DNS ASK pi###rule.net
- DNS ASK mu###ule.net
- DNS ASK mu###unt.net
- DNS ASK mu###how.net
- DNS ASK pi###hunt.net
- DNS ASK pi###hear.net
- DNS ASK wa###unt.net
- DNS ASK ta###unt.net
- DNS ASK ta###how.net
- DNS ASK mu###ear.net
- DNS ASK wa###how.net
- DNS ASK wa###oon.net
- DNS ASK ta###oon.net
- DNS ASK ta###ctober.net
- DNS ASK ta###hoe.net
- DNS ASK wa###ctober.net
- DNS ASK wa###uter.net
- DNS ASK tr###hunt.net
- DNS ASK yo###unt.net
- DNS ASK yo###how.net
- DNS ASK ta###uter.net
- DNS ASK tr###show.net
- DNS ASK go#####everytime.com
- DNS ASK pi####ctober.net
- DNS ASK ja###uter.com
- DNS ASK do####club-grup.com
- DNS ASK el#####arimagine.com
- DNS ASK mu###ctober.net
- DNS ASK mu###uter.net
- DNS ASK wa###hoe.net
- DNS ASK pi###outer.net
- DNS ASK pi###moon.net
- DNS ASK mu###oon.net
- DNS ASK pl###hunt.net
- DNS ASK fi###unt.net
- DNS ASK fi###how.net
- DNS ASK vi###ear.net
- DNS ASK pl###show.net
- DNS ASK pl###rule.net
- DNS ASK se###show.net
- DNS ASK le###show.net
- DNS ASK fi###ear.net
- DNS ASK fi###ule.net
- DNS ASK pl###hear.net
- DNS ASK yo###ear.net
- DNS ASK lr###show.net
- DNS ASK tr###hear.net
- DNS ASK tr###rule.net
- DNS ASK yo###ule.net
- DNS ASK vi###how.net
- DNS ASK vi###ule.net
- DNS ASK lr###hear.net
- DNS ASK lr###rule.net
- DNS ASK lr###hunt.net
- DNS ASK vi###unt.net
- '23#.#55.255.250':1900
