Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SNMP Plug Remote Desktop Control' = 'C:\utgkmltxauteuwd\krkbpalxkg.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Port Identity Secure Policy] 'ImagePath' = 'C:\utgkmltxauteuwd\krkbpalxkg.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Port Identity Secure Policy] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\utgkmltxauteuwd\amshwpgmyp.exe' "c:\utgkmltxauteuwd\krkbpalxkg.exe"
- 'C:\utgkmltxauteuwd\krkbpalxkg.exe'
- 'C:\utgkmltxauteuwd\jthj2mbelzuuau47.exe'
Modifies file system:
Creates the following files:
- C:\utgkmltxauteuwd\krkbpalxkg.exe
- C:\utgkmltxauteuwd\amshwpgmyp.exe
- C:\utgkmltxauteuwd\jthj2mbelzuuau47.exe
- %WINDIR%\utgkmltxauteuwd\s2yytdyzp
- C:\utgkmltxauteuwd\s2yytdyzp
Sets the 'hidden' attribute to the following files:
- C:\utgkmltxauteuwd\amshwpgmyp.exe
- C:\utgkmltxauteuwd\krkbpalxkg.exe
Deletes the following files:
- C:\utgkmltxauteuwd\jthj2mbelzuuau47.exe
- %WINDIR%\utgkmltxauteuwd\s2yytdyzp
Network activity:
Connects to:
- 'bu####ngdevice.net':80
- 'ev####glanguage.net':80
- 'ev####gdevice.net':80
- 'ev####gbefore.net':80
- 'bu####ngbefore.net':80
- 'ou####ebefore.net':80
- 'mo####ntbefore.net':80
- 'bu####ngsettle.net':80
- 'bu#####glanguage.net':80
- 'ev####gsettle.net':80
- 'st###settle.net':80
- 'mi###before.net':80
- 'st###before.net':80
- 'do####settle.net':80
- 'do####language.net':80
- 'pr####settle.net':80
- 'st####anguage.net':80
- 'mi###settle.net':80
- 'mi####anguage.net':80
- 'mi###device.net':80
- 'st###device.net':80
- 'ou####edevice.net':80
- 'pr####ebasket.net':80
- 'de####contain.net':80
- 'de####basket.net':80
- 'st####ndustry.net':80
- 'st#####hindustry.net':80
- 'pr####eindustry.net':80
- 're####basket.net':80
- 'pr####ebecame.net':80
- 'pr####econtain.net':80
- 'de####became.net':80
- 'st####thbecame.net':80
- 'ou####esettle.net':80
- 'mo####ntsettle.net':80
- 'mo#####tlanguage.net':80
- 'mo####ntdevice.net':80
- 'ou####elanguage.net':80
- 'st####thcontain.net':80
- 'st###became.net':80
- 'st####ontain.net':80
- 'st###basket.net':80
- 'st####thbasket.net':80
TCP:
HTTP GET requests:
- http://bu####ngdevice.net/index.php
- http://ev####glanguage.net/index.php
- http://ev####gdevice.net/index.php
- http://ev####gbefore.net/index.php
- http://bu####ngbefore.net/index.php
- http://ou####ebefore.net/index.php
- http://mo####ntbefore.net/index.php
- http://bu####ngsettle.net/index.php
- http://bu#####glanguage.net/index.php
- http://ev####gsettle.net/index.php
- http://st###settle.net/index.php
- http://mi###before.net/index.php
- http://st###before.net/index.php
- http://do####settle.net/index.php
- http://do####language.net/index.php
- http://pr####settle.net/index.php
- http://st####anguage.net/index.php
- http://mi###settle.net/index.php
- http://mi####anguage.net/index.php
- http://mi###device.net/index.php
- http://st###device.net/index.php
- http://ou####edevice.net/index.php
- http://pr####ebasket.net/index.php
- http://de####contain.net/index.php
- http://de####basket.net/index.php
- http://st####ndustry.net/index.php
- http://st#####hindustry.net/index.php
- http://pr####eindustry.net/index.php
- http://re####basket.net/index.php
- http://pr####ebecame.net/index.php
- http://pr####econtain.net/index.php
- http://de####became.net/index.php
- http://st####thbecame.net/index.php
- http://ou####esettle.net/index.php
- http://mo####ntsettle.net/index.php
- http://mo#####tlanguage.net/index.php
- http://mo####ntdevice.net/index.php
- http://ou####elanguage.net/index.php
- http://st####thcontain.net/index.php
- http://st###became.net/index.php
- http://st####ontain.net/index.php
- http://st###basket.net/index.php
- http://st####thbasket.net/index.php
UDP:
- DNS ASK ev####gdevice.net
- DNS ASK bu####ngdevice.net
- DNS ASK bu####ngbefore.net
- DNS ASK st###settle.net
- DNS ASK ev####gbefore.net
- DNS ASK ev####glanguage.net
- DNS ASK ou####ebefore.net
- DNS ASK mo####ntbefore.net
- DNS ASK bu####ngsettle.net
- DNS ASK bu#####glanguage.net
- DNS ASK ev####gsettle.net
- DNS ASK do####settle.net
- DNS ASK mi###before.net
- DNS ASK pr####settle.net
- DNS ASK pr####language.net
- DNS ASK do####language.net
- DNS ASK st###before.net
- DNS ASK st####anguage.net
- DNS ASK mi###settle.net
- DNS ASK mi####anguage.net
- DNS ASK mi###device.net
- DNS ASK st###device.net
- DNS ASK ou####edevice.net
- DNS ASK pr####ebasket.net
- DNS ASK de####contain.net
- DNS ASK de####basket.net
- DNS ASK st####ndustry.net
- DNS ASK st#####hindustry.net
- DNS ASK pr####econtain.net
- DNS ASK pr####eindustry.net
- DNS ASK re####basket.net
- DNS ASK de####industry.net
- DNS ASK de####became.net
- DNS ASK pr####ebecame.net
- DNS ASK ou####esettle.net
- DNS ASK mo####ntsettle.net
- DNS ASK mo#####tlanguage.net
- DNS ASK mo####ntdevice.net
- DNS ASK ou####elanguage.net
- DNS ASK st###basket.net
- DNS ASK st###became.net
- DNS ASK st####thbecame.net
- DNS ASK st####thcontain.net
- DNS ASK st####thbasket.net
- DNS ASK st####ontain.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
