Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Block Scheduler Shell Provider DHCP Superfetch' = 'C:\yndkjwcn\erhculo.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Notification Trap Service Receiver Engine] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\yndkjwcn\tdcqazcypx.exe' "c:\yndkjwcn\erhculo.exe"
- 'C:\yndkjwcn\erhculo.exe'
- 'C:\yndkjwcn\zluz2oh3covmnzndoxhrz.exe'
Modifies file system :
Creates the following files:
- C:\yndkjwcn\erhculo.exe
- C:\yndkjwcn\tdcqazcypx.exe
- C:\yndkjwcn\uqbx91xzqnph
- %WINDIR%\yndkjwcn\phto2hn
- C:\yndkjwcn\phto2hn
- C:\yndkjwcn\zluz2oh3covmnzndoxhrz.exe
Sets the 'hidden' attribute to the following files:
- C:\yndkjwcn\tdcqazcypx.exe
- C:\yndkjwcn\erhculo.exe
Deletes the following files:
- C:\yndkjwcn\zluz2oh3covmnzndoxhrz.exe
- %WINDIR%\yndkjwcn\phto2hn
Network activity:
Connects to:
- 'th###carry.net':80
- 'pr####tcarry.net':80
- 'pr####tbuilt.net':80
- 'pr####tapple.net':80
- 'th###built.net':80
- 'co####eapple.net':80
- 'ch###built.net':80
- 'ch###apple.net':80
- 'ch###father.net':80
- 'co####efather.net':80
- 'th###apple.net':80
- 'cl###spent.net':80
- 'th####ogether.net':80
- 'th###spent.net':80
- 'th###matter.net':80
- 'cl###matter.net':80
- 'th###father.net':80
- 'pr####tfather.net':80
- 'cl####ontrol.net':80
- 'cl####ogether.net':80
- 'th####ontrol.net':80
- 'tw###eapple.net':80
- 'mi###ebuilt.net':80
- 'mi###eapple.net':80
- 'mi####father.net':80
- 'tw####father.net':80
- 'ra####father.net':80
- 'mo####gfather.net':80
- 'tw###ecarry.net':80
- 'tw###ebuilt.net':80
- 'mi###ecarry.net':80
- 'al###carry.net':80
- 'of###father.net':80
- 'al###father.net':80
- 'co####ecarry.net':80
- 'co####ebuilt.net':80
- 'ch###carry.net':80
- 'al###built.net':80
- 'of###carry.net':80
- 'of###built.net':80
- 'of###apple.net':80
- 'al###apple.net':80
- 'we####rcontrol.net':80
- 'tw###espent.net':80
- 'mi####together.net':80
- 'mi###espent.net':80
- 'mi####matter.net':80
- 'tw####matter.net':80
- 'ra####matter.net':80
- 'mo####gmatter.net':80
- 'tw####control.net':80
- 'tw####together.net':80
- 'mi####control.net':80
- 'al####ontrol.net':80
- 'of###matter.net':80
- 'al###matter.net':80
- 'co####econtrol.net':80
- 'co####etogether.net':80
- 'ch####ontrol.net':80
- 'al####ogether.net':80
- 'of####ontrol.net':80
- 'of####ogether.net':80
- 'of###spent.net':80
- 'al###spent.net':80
- 'am####matter.net':80
- 'we####rmatter.net':80
- 'hi####ycontrol.net':80
- 'hi####ytogether.net':80
- 'st####econtrol.net':80
- 'we####rtogether.net':80
- 'am####control.net':80
- 'am####together.net':80
- 'am###tspent.net':80
- 'we####rspent.net':80
- 'st####etogether.net':80
- 'mo####gtogether.net':80
- 'ra####control.net':80
- 'ra####together.net':80
- 'ra###rspent.net':80
- 'mo####gspent.net':80
- 'st####espent.net':80
- 'hi####yspent.net':80
- 'hi####ymatter.net':80
- 'mo####gcontrol.net':80
- 'st####ematter.net':80
TCP:
HTTP GET requests:
- http://th###carry.net/index.php?me########
- http://pr####tcarry.net/index.php?me########
- http://pr####tbuilt.net/index.php?me########
- http://pr####tapple.net/index.php?me########
- http://th###built.net/index.php?me########
- http://co####eapple.net/index.php?me########
- http://ch###built.net/index.php?me########
- http://ch###apple.net/index.php?me########
- http://ch###father.net/index.php?me########
- http://co####efather.net/index.php?me########
- http://th###apple.net/index.php?me########
- http://cl###spent.net/index.php?me########
- http://th####ogether.net/index.php?me########
- http://th###spent.net/index.php?me########
- http://th###matter.net/index.php?me########
- http://cl###matter.net/index.php?me########
- http://th###father.net/index.php?me########
- http://pr####tfather.net/index.php?me########
- http://cl####ontrol.net/index.php?me########
- http://cl####ogether.net/index.php?me########
- http://th####ontrol.net/index.php?me########
- http://tw###eapple.net/index.php?me########
- http://mi###ebuilt.net/index.php?me########
- http://mi###eapple.net/index.php?me########
- http://mi####father.net/index.php?me########
- http://tw####father.net/index.php?me########
- http://ra####father.net/index.php?me########
- http://mo####gfather.net/index.php?me########
- http://tw###ecarry.net/index.php?me########
- http://tw###ebuilt.net/index.php?me########
- http://mi###ecarry.net/index.php?me########
- http://al###carry.net/index.php?me########
- http://of###father.net/index.php?me########
- http://al###father.net/index.php?me########
- http://co####ecarry.net/index.php?me########
- http://co####ebuilt.net/index.php?me########
- http://ch###carry.net/index.php?me########
- http://al###built.net/index.php?me########
- http://of###carry.net/index.php?me########
- http://of###built.net/index.php?me########
- http://of###apple.net/index.php?me########
- http://al###apple.net/index.php?me########
- http://we####rcontrol.net/index.php?me########
- http://tw###espent.net/index.php?me########
- http://mi####together.net/index.php?me########
- http://mi###espent.net/index.php?me########
- http://mi####matter.net/index.php?me########
- http://tw####matter.net/index.php?me########
- http://ra####matter.net/index.php?me########
- http://mo####gmatter.net/index.php?me########
- http://tw####control.net/index.php?me########
- http://tw####together.net/index.php?me########
- http://mi####control.net/index.php?me########
- http://al####ontrol.net/index.php?me########
- http://of###matter.net/index.php?me########
- http://al###matter.net/index.php?me########
- http://co####econtrol.net/index.php?me########
- http://co####etogether.net/index.php?me########
- http://ch####ontrol.net/index.php?me########
- http://al####ogether.net/index.php?me########
- http://of####ontrol.net/index.php?me########
- http://of####ogether.net/index.php?me########
- http://of###spent.net/index.php?me########
- http://al###spent.net/index.php?me########
- http://am####matter.net/index.php?me########
- http://we####rmatter.net/index.php?me########
- http://hi####ycontrol.net/index.php?me########
- http://hi####ytogether.net/index.php?me########
- http://st####econtrol.net/index.php?me########
- http://we####rtogether.net/index.php?me########
- http://am####control.net/index.php?me########
- http://am####together.net/index.php?me########
- http://am###tspent.net/index.php?me########
- http://we####rspent.net/index.php?me########
- http://st####etogether.net/index.php?me########
- http://mo####gtogether.net/index.php?me########
- http://ra####control.net/index.php?me########
- http://ra####together.net/index.php?me########
- http://ra###rspent.net/index.php?me########
- http://mo####gspent.net/index.php?me########
- http://st####espent.net/index.php?me########
- http://hi####yspent.net/index.php?me########
- http://hi####ymatter.net/index.php?me########
- http://mo####gcontrol.net/index.php?me########
- http://st####ematter.net/index.php?me########
UDP:
- DNS ASK th###carry.net
- DNS ASK pr####tcarry.net
- DNS ASK pr####tbuilt.net
- DNS ASK pr####tapple.net
- DNS ASK th###built.net
- DNS ASK co####eapple.net
- DNS ASK ch###built.net
- DNS ASK ch###apple.net
- DNS ASK ch###father.net
- DNS ASK co####efather.net
- DNS ASK th###apple.net
- DNS ASK cl###spent.net
- DNS ASK th####ogether.net
- DNS ASK th###spent.net
- DNS ASK th###matter.net
- DNS ASK cl###matter.net
- DNS ASK th###father.net
- DNS ASK pr####tfather.net
- DNS ASK cl####ontrol.net
- DNS ASK cl####ogether.net
- DNS ASK th####ontrol.net
- DNS ASK tw###eapple.net
- DNS ASK mi###ebuilt.net
- DNS ASK mi###eapple.net
- DNS ASK mi####father.net
- DNS ASK tw####father.net
- DNS ASK ra####father.net
- DNS ASK mo####gfather.net
- DNS ASK tw###ecarry.net
- DNS ASK tw###ebuilt.net
- DNS ASK mi###ecarry.net
- DNS ASK al###carry.net
- DNS ASK of###father.net
- DNS ASK al###father.net
- DNS ASK co####ecarry.net
- DNS ASK co####ebuilt.net
- DNS ASK ch###carry.net
- DNS ASK al###built.net
- DNS ASK of###carry.net
- DNS ASK of###built.net
- DNS ASK of###apple.net
- DNS ASK al###apple.net
- DNS ASK we####rcontrol.net
- DNS ASK tw###espent.net
- DNS ASK mi####together.net
- DNS ASK mi###espent.net
- DNS ASK mi####matter.net
- DNS ASK tw####matter.net
- DNS ASK ra####matter.net
- DNS ASK mo####gmatter.net
- DNS ASK tw####control.net
- DNS ASK tw####together.net
- DNS ASK mi####control.net
- DNS ASK al####ontrol.net
- DNS ASK of###matter.net
- DNS ASK al###matter.net
- DNS ASK co####econtrol.net
- DNS ASK co####etogether.net
- DNS ASK ch####ontrol.net
- DNS ASK al####ogether.net
- DNS ASK of####ontrol.net
- DNS ASK of####ogether.net
- DNS ASK of###spent.net
- DNS ASK al###spent.net
- DNS ASK am####matter.net
- DNS ASK we####rmatter.net
- DNS ASK hi####ycontrol.net
- DNS ASK hi####ytogether.net
- DNS ASK st####econtrol.net
- DNS ASK we####rtogether.net
- DNS ASK am####control.net
- DNS ASK am####together.net
- DNS ASK am###tspent.net
- DNS ASK we####rspent.net
- DNS ASK st####etogether.net
- DNS ASK mo####gtogether.net
- DNS ASK ra####control.net
- DNS ASK ra####together.net
- DNS ASK ra###rspent.net
- DNS ASK mo####gspent.net
- DNS ASK st####espent.net
- DNS ASK hi####yspent.net
- DNS ASK hi####ymatter.net
- DNS ASK mo####gcontrol.net
- DNS ASK st####ematter.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
