Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Group Management Compatibility VC Helper' = '<SYSTEM32>\ftmfvdaqfaff.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\DLL Health Files Distributed Themes Spooler] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\timaurbw.exe' "<SYSTEM32>\ftmfvdaqfaff.exe"
- '%WINDIR%\Temp\uyoc8r3o0lceng.exe' -r 36950 tcp
- '%TEMP%\uyoc8r3fgvcenghtt3khar.exe'
- '<SYSTEM32>\ftmfvdaqfaff.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\fkdppdmbasvm\run
- <SYSTEM32>\fkdppdmbasvm\rng
- %WINDIR%\Temp\uyoc8r3o0lceng.exe
- <SYSTEM32>\fkdppdmbasvm\cfg
- <SYSTEM32>\timaurbw.exe
- %TEMP%\uyoc8r3fgvcenghtt3khar.exe
- <SYSTEM32>\fkdppdmbasvm\tst
- <SYSTEM32>\ftmfvdaqfaff.exe
- <SYSTEM32>\fkdppdmbasvm\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\timaurbw.exe
- <SYSTEM32>\ftmfvdaqfaff.exe
Deletes the following files:
- %WINDIR%\Temp\uyoc8r3o0lceng.exe
- <DRIVERS>\etc\hosts
- %TEMP%\uyoc8r3fgvcenghtt3khar.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'se####berleft.net':80
- 'ha####irteen.net':80
- 'se#####erthirteen.net':80
- 'ha###eft.net':80
- 'of###hurry.net':80
- 'ha###ope.net':80
- 'se####berhope.net':80
- 'ha###urry.net':80
- 'wi###eft.net':80
- 'jo####irteen.net':80
- 'wi####irteen.net':80
- 'jo###eft.net':80
- 'se####berhurry.net':80
- 'jo###ope.net':80
- 'wi###ope.net':80
- 'fr###hurry.net':80
- 'sp###left.net':80
- 'we####irteen.net':80
- 'sp####hirteen.net':80
- 'de###lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'be##lxc.com':80
- 'we###urry.net':80
- 'of###left.net':80
- 'fr####hirteen.net':80
- 'of####hirteen.net':80
- 'fr###left.net':80
- 'sp###hurry.net':80
- 'fr###hope.net':80
- 'of###hope.net':80
TCP:
HTTP GET requests:
- http://se####berleft.net/index.php
- http://ha####irteen.net/index.php
- http://se#####erthirteen.net/index.php
- http://ha###eft.net/index.php
- http://of###hurry.net/index.php
- http://ha###ope.net/index.php
- http://se####berhope.net/index.php
- http://ha###urry.net/index.php
- http://wi###eft.net/index.php
- http://jo####irteen.net/index.php
- http://wi####irteen.net/index.php
- http://jo###eft.net/index.php
- http://se####berhurry.net/index.php
- http://jo###ope.net/index.php
- http://wi###ope.net/index.php
- http://fr###hurry.net/index.php
- http://sp###left.net/index.php
- http://we####irteen.net/index.php
- http://sp####hirteen.net/index.php
- http://de###lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://be##lxc.com/index.php
- http://we###urry.net/index.php
- http://of###left.net/index.php
- http://fr####hirteen.net/index.php
- http://of####hirteen.net/index.php
- http://fr###left.net/index.php
- http://sp###hurry.net/index.php
- http://fr###hope.net/index.php
- http://of###hope.net/index.php
UDP:
- DNS ASK ha####irteen.net
- DNS ASK se####berleft.net
- DNS ASK ha###urry.net
- DNS ASK se#####erthirteen.net
- DNS ASK ha###ope.net
- DNS ASK of###hurry.net
- DNS ASK ha###eft.net
- DNS ASK se####berhope.net
- DNS ASK jo####irteen.net
- DNS ASK wi###eft.net
- DNS ASK jo###urry.net
- DNS ASK wi####irteen.net
- DNS ASK jo###ope.net
- DNS ASK se####berhurry.net
- DNS ASK jo###eft.net
- DNS ASK wi###ope.net
- DNS ASK fr###hurry.net
- DNS ASK sp###left.net
- DNS ASK we####irteen.net
- DNS ASK sp####hirteen.net
- DNS ASK de###lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK be##lxc.com
- DNS ASK we###urry.net
- DNS ASK of###left.net
- DNS ASK fr####hirteen.net
- DNS ASK of####hirteen.net
- DNS ASK fr###left.net
- DNS ASK sp###hurry.net
- DNS ASK fr###hope.net
- DNS ASK of###hope.net
- '23#.#55.255.250':1900
