Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '*EvtMgr32' = '%WINDIR%\{01044D45-6B75-1FE8-7744-CA3E1F40881D}.exe'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\{01044D45-6B75-1FE8-7744-CA3E1F40881D}.exe' /rm "<Full path to virus>"
Modifies file system :
Creates the following files:
- %WINDIR%\{01044D45-6B75-1FE8-7744-CA3E1F40881D}.exe
Sets the 'hidden' attribute to the following files:
- %WINDIR%\{01044D45-6B75-1FE8-7744-CA3E1F40881D}.exe
Deletes itself.
Network activity:
Connects to:
- 'bj####yvpdwnmw.com':80
- 'je####rrfuxsjx.net':80
- 'at####upewuxnd.info':80
- 'yc####iastmleo.org':80
- 'ar#####geaobmv.co.uk':80
- 'nt#####fhytmnk.co.uk':80
- 'bx####yaeqncen.info':80
- 'yd####tiljohcm.org':80
- 'wi####hmcmriat.biz':80
- 'ly####enorurcd.ru':80
- 'iw####ffjheumf.org':80
- 'vk#####tjyenvl.co.uk':80
- 'us####yexvvbmi.ru':80
- 'ru####tghuitkd.net':80
- 'fy####ahsgqnbc.biz':80
- 've####dccsyeno.biz':80
- 'wt####hinybtmb.ru':80
- 'vc####uscvshts.net':80
- 'jo####ruukmhmr.info':80
- 'um####qmqpqrls.com':80
- 'ko####olrdokna.info':80
- 'xc####sidtpqyd.com':80
- 'wk#####kgrgqwb.co.uk':80
- 'vs####dhwcpnnl.ru':80
- 'jw####jiinxhnb.org':80
- 'ac####mdragxqr.org':80
- 'br#####jdginyr.co.uk':80
- 'mx####emxuonra.ru':80
- 'lg####yjofxkya.net':80
- 'yt####xlmjgtbt.biz':80
- 'od####ocwfqsir.ru':80
- 'pi####nujpwxcc.org':80
- 'nn####byasayjl.biz':80
- 'po####vbqvqlno.com':80
- 'ds####lvnnkbnf.net':80
- 'tx####filtsrct.net':80
- 'un####sligjlkx.biz':80
- 'ss####gpyjmmbr.com':80
- 'qx#####xgcnrky.co.uk':80
- 'rd####smcwvsce.info':80
- 'wk####dwdkydvi.biz':80
- 'oy####ubjtppry.ru':80
- 'ji####wkqbfsfu.net':80
- 'im####rhnsjxds.info':80
- 'vo####xtacdidt.com':80
- 'qi####xdviyrdr.com':80
- 'rv####cxihuxlg.net':80
- 'qi####eyybhqat.info':80
- 'pm####yvvslvau.org':80
- 'pu#####emclkbo.co.uk':80
- 'yd####iwqvdvjd.info':80
- 'ao####herickkm.com':80
- 'xp#####indslki.co.uk':80
- '17#.#38.171.62':80
- 'wm####trmraahd.org':80
- 'hy####tiemvqmu.org':80
- 'ub#####uqvpbdp.co.uk':80
- 'tf####urnntgdc.ru':80
- 'bc####usubmusu.net':80
- 'gd####ofbeavdt.biz':80
- 'cc####gfxhsfbw.net':80
- 'by####qdgirgem.biz':80
- 'bo####squoiush.com':80
- 'yp#####bttiesw.co.uk':80
- 'ad####bpwmsory.info':80
- 'qd####hqvrahis.info':80
- 'eh####nrhdibii.com':80
- 'el#####hkvchfm.co.uk':80
- 'cm####erjbcqdh.ru':80
- 'dx####vshdrwwe.org':80
- 'ev#####aohmurt.co.uk':80
- 'ss####mgmyhfbb.info':80
- 'qt####hqlehobf.org':80
- 're####dgyqumfi.biz':80
- 'sr####hblpqseg.ru':80
- 'uc####piynqhte.ru':80
- 'ie####frcqvntc.org':80
- 'gf####acbvvwri.biz':80
- 'gu####cppcmlbg.com':80
- 'sd####ksxsqqbb.net':80
UDP:
- DNS ASK bj####yvpdwnmw.com
- DNS ASK je####rrfuxsjx.net
- DNS ASK ar#####geaobmv.co.uk
- DNS ASK at####upewuxnd.info
- DNS ASK wi####hmcmriat.biz
- DNS ASK nt#####fhytmnk.co.uk
- DNS ASK bx####yaeqncen.info
- DNS ASK ly####enorurcd.ru
- DNS ASK yd####tiljohcm.org
- DNS ASK yc####iastmleo.org
- DNS ASK iw####ffjheumf.org
- DNS ASK vk#####tjyenvl.co.uk
- DNS ASK fy####ahsgqnbc.biz
- DNS ASK us####yexvvbmi.ru
- DNS ASK jo####ruukmhmr.info
- DNS ASK ve####dccsyeno.biz
- DNS ASK wt####hinybtmb.ru
- DNS ASK um####qmqpqrls.com
- DNS ASK vc####uscvshts.net
- DNS ASK po####vbqvqlno.com
- DNS ASK ko####olrdokna.info
- DNS ASK xc####sidtpqyd.com
- DNS ASK jw####jiinxhnb.org
- DNS ASK wk#####kgrgqwb.co.uk
- DNS ASK lg####yjofxkya.net
- DNS ASK ac####mdragxqr.org
- DNS ASK br#####jdginyr.co.uk
- DNS ASK yt####xlmjgtbt.biz
- DNS ASK mx####emxuonra.ru
- DNS ASK vs####dhwcpnnl.ru
- DNS ASK od####ocwfqsir.ru
- DNS ASK pi####nujpwxcc.org
- DNS ASK ds####lvnnkbnf.net
- DNS ASK nn####byasayjl.biz
- DNS ASK qx#####xgcnrky.co.uk
- DNS ASK tx####filtsrct.net
- DNS ASK un####sligjlkx.biz
- DNS ASK rd####smcwvsce.info
- DNS ASK ss####gpyjmmbr.com
- DNS ASK ru####tghuitkd.net
- DNS ASK wk####dwdkydvi.biz
- DNS ASK oy####ubjtppry.ru
- DNS ASK vo####xtacdidt.com
- DNS ASK ji####wkqbfsfu.net
- DNS ASK pm####yvvslvau.org
- DNS ASK qi####xdviyrdr.com
- DNS ASK rv####cxihuxlg.net
- DNS ASK pu#####emclkbo.co.uk
- DNS ASK qi####eyybhqat.info
- DNS ASK im####rhnsjxds.info
- DNS ASK yd####iwqvdvjd.info
- DNS ASK ao####herickkm.com
- DNS ASK wm####trmraahd.org
- DNS ASK xp#####indslki.co.uk
- DNS ASK bc####usubmusu.net
- DNS ASK hy####tiemvqmu.org
- DNS ASK ub#####uqvpbdp.co.uk
- DNS ASK gd####ofbeavdt.biz
- DNS ASK tf####urnntgdc.ru
- DNS ASK re####dgyqumfi.biz
- DNS ASK cc####gfxhsfbw.net
- DNS ASK by####qdgirgem.biz
- DNS ASK ad####bpwmsory.info
- DNS ASK bo####squoiush.com
- DNS ASK cm####erjbcqdh.ru
- DNS ASK qd####hqvrahis.info
- DNS ASK eh####nrhdibii.com
- DNS ASK dx####vshdrwwe.org
- DNS ASK el#####hkvchfm.co.uk
- DNS ASK yp#####bttiesw.co.uk
- DNS ASK ev#####aohmurt.co.uk
- DNS ASK ss####mgmyhfbb.info
- DNS ASK sr####hblpqseg.ru
- DNS ASK qt####hqlehobf.org
- DNS ASK gu####cppcmlbg.com
- DNS ASK uc####piynqhte.ru
- DNS ASK ie####frcqvntc.org
- DNS ASK sd####ksxsqqbb.net
- DNS ASK gf####acbvvwri.biz
