Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Taskman' = '%HOMEPATH%\aegvvp.exe'
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
- %HOMEPATH%\aegvvp.exe
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\aegvvp.exe
Network activity:
UDP:
- DNS ASK mu###.###tal-protection.net.ru
- DNS ASK sl###.##fehousenumber.com
- 'mu###.###tal-protection.net.ru':27001
- 'sl###.##fehousenumber.com':27001
Miscellaneous:
Searches for the following windows:
- ClassName: 'Llbadrs. Qdfy, Gdce' WindowName: 'Oofn, Scgpffm, Ak'
- ClassName: 'Gdce' WindowName: 'Oofn, Scgpffm, Ak, Llbadrs. Qdfy'
- ClassName: 'Xiqska. Jx' WindowName: 'Kyidct Ukjuvp Jrpb, Pyvy'
- ClassName: 'Hx' WindowName: 'Gbqasderjy Poyev, Gkuiwoo Uqasnn'
- ClassName: 'Pyvy, Xiqska. Jx' WindowName: 'Kyidct Ukjuvp Jrpb'
- ClassName: 'Ergj Gou Fpkq Lijm' WindowName: 'Phogl. Wspbv Ul'
- ClassName: 'Dxmm, Urxeebscy Rw' WindowName: 'Qobvx Lwdxpyt Mt'
- ClassName: 'Urxeebscy Rw' WindowName: 'Qobvx Lwdxpyt Mt, Dxmm'
- ClassName: 'Uesuh. Gsyug Tx' WindowName: 'Uugoco Hioobhmn'
- ClassName: 'Ivwd, Yckd. Yylm' WindowName: 'Nrvdkab Yxenrcy Lf'
- ClassName: 'Yckd. Yylm' WindowName: 'Nrvdkab Yxenrcy Lf, Ivwd'
- ClassName: 'Gkuiwoo Uqasnn, Hx' WindowName: 'Gbqasderjy Poyev'
- ClassName: 'Asjx Cskt Urp, L' WindowName: 'Dmnbqwm Tlhn, Ui'
- ClassName: 'L' WindowName: 'Dmnbqwm Tlhn, Ui, Asjx Cskt Urp'
- ClassName: 'Q' WindowName: 'Jgkre Olc. Fpktjh, Xgtit Qnh, Qguy'
- ClassName: 'Fkguuwpo Ajxsjoewk' WindowName: 'Rfyy, Rtfja, Ggxf'
- ClassName: 'Xgtit Qnh, Qguy, Q' WindowName: 'Jgkre Olc. Fpktjh'
- ClassName: 'Ioof, Jlo, Yrofa' WindowName: 'Mpopya. Rt. Ymccug'
- ClassName: 'Ttshf, Cksi Lhdvgiy' WindowName: 'Kunjqv Rwmh Wep'
- ClassName: 'Cksi Lhdvgiy' WindowName: 'Kunjqv Rwmh Wep, Ttshf'
- ClassName: 'Cfkuxp' WindowName: 'Dqjraeavw Usecstt E, Opchnimk'
- ClassName: 'Yrofa' WindowName: 'Mpopya. Rt. Ymccug, Ioof, Jlo'
- ClassName: 'Opchnimk, Cfkuxp' WindowName: 'Dqjraeavw Usecstt E'
