Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Hardware Media WMI VC Bus Alerts' = '<LS_APPDATA>\mgtfpltovxhnesa\jdtrhkmiyuqh.exe'
Malicious functions:
Creates and executes the following:
- '<LS_APPDATA>\mgtfpltovxhnesa\qdrxmlhhe.exe' "<LS_APPDATA>\mgtfpltovxhnesa\jdtrhkmiyuqh.exe"
- '<LS_APPDATA>\mgtfpltovxhnesa\jdtrhkmiyuqh.exe'
Modifies file system :
Creates the following files:
- <LS_APPDATA>\mgtfpltovxhnesa\jdtrhkmiyuqh.kr5o8
- <LS_APPDATA>\mgtfpltovxhnesa\qdrxmlhhe.exe
- <LS_APPDATA>\mgtfpltovxhnesa\jdtrhkmiyuqh.exe
Sets the 'hidden' attribute to the following files:
- <LS_APPDATA>\mgtfpltovxhnesa\qdrxmlhhe.exe
- <LS_APPDATA>\mgtfpltovxhnesa\jdtrhkmiyuqh.exe
Network activity:
Connects to:
- 'ne####titops.com':80
- 'lo##and.com':80
- 'jo###ret.com':80
- 'he####pcazers.com':80
- 'bi##rat.com':80
- 'mo##het.com':80
- 'ma####olirst.com':80
- 'ha##end.com':80
- 'ma###dpa.com':80
- 'fe####lopazerns.com':80
- 'va##xer.com':80
- 'mi##af.com':80
- 'kl##tar.com':80
- 'na##ied.com':80
- 'be###ete.com':80
- 'de###dar.com':80
- 'ge####serops.com':80
- 'fo###red.com':80
- 'fi###lox.com':80
- 'da##tan.com':80
- 'ad##ino.com':80
- 'bi##de.com':80
- 'el##rot.com':80
- 'go##tar.com':80
- 'fa###erest.com':80
- 'ba##ro.com':80
- 'pa##dov.com':80
- 'op##red.com':80
- 'ha####pricezat.com':80
- 'pu###inacee.com':80
- 're##lt.com':80
- 'bu###osasrl.com':80
- 'ji####olipop.com':80
- 'el##tow.com':80
- 'ge####iroplop.com':80
- 'ek##dar.com':80
- 'me##xe.com':80
- 'sw####lserits.com':80
- 'ib##an.com':80
- 'gl###mec.com':80
- 'bu###oriso.com':80
- 'va##lt.com':80
- 'po##ric.com':80
TCP:
HTTP GET requests:
- http://ne####titops.com/forum/search.php?em############################
- http://lo##and.com/forum/search.php?em############################
- http://jo###ret.com/forum/search.php?em############################
- http://he####pcazers.com/forum/search.php?em############################
- http://bi##rat.com/forum/search.php?em############################
- http://mo##het.com/forum/search.php?em############################
- http://ma####olirst.com/forum/search.php?em############################
- http://ha##end.com/forum/search.php?em############################
- http://ma###dpa.com/forum/search.php?em############################
- http://fe####lopazerns.com/forum/search.php?em############################
- http://va##xer.com/forum/search.php?em############################
- http://mi##af.com/forum/search.php?em############################
- http://kl##tar.com/forum/search.php?em############################
- http://na##ied.com/forum/search.php?em############################
- http://be###ete.com/forum/search.php?em############################
- http://de###dar.com/forum/search.php?em############################
- http://ge####serops.com/forum/search.php?em############################
- http://fo###red.com/forum/search.php?em############################
- http://fi###lox.com/forum/search.php?em############################
- http://da##tan.com/forum/search.php?em############################
- http://ad##ino.com/forum/search.php?em############################
- http://bi##de.com/forum/search.php?em############################
- http://el##rot.com/forum/search.php?em############################
- http://go##tar.com/forum/search.php?em############################
- http://fa###erest.com/forum/search.php?em############################
- http://ba##ro.com/forum/search.php?em############################
- http://pa##dov.com/forum/search.php?em############################
- http://op##red.com/forum/search.php?em############################
- http://ha####pricezat.com/forum/search.php?em############################
- http://pu###inacee.com/forum/search.php?em############################
- http://re##lt.com/forum/search.php?em############################
- http://bu###osasrl.com/forum/search.php?em############################
- http://ji####olipop.com/forum/search.php?em############################
- http://el##tow.com/forum/search.php?em############################
- http://ge####iroplop.com/forum/search.php?em############################
- http://ek##dar.com/forum/search.php?em############################
- http://me##xe.com/forum/search.php?em############################
- http://sw####lserits.com/forum/search.php?em############################
- http://ib##an.com/forum/search.php?em############################
- http://gl###mec.com/forum/search.php?em############################
- http://bu###oriso.com/forum/search.php?em############################
- http://va##lt.com/forum/search.php?em############################
- http://po##ric.com/forum/search.php?em############################
UDP:
- DNS ASK ne####titops.com
- DNS ASK lo##and.com
- DNS ASK jo###ret.com
- DNS ASK he####pcazers.com
- DNS ASK bi##rat.com
- DNS ASK mo##het.com
- DNS ASK ma####olirst.com
- DNS ASK ha##end.com
- DNS ASK ma###dpa.com
- DNS ASK fe####lopazerns.com
- DNS ASK va##xer.com
- DNS ASK mi##af.com
- DNS ASK kl##tar.com
- DNS ASK na##ied.com
- DNS ASK be###ete.com
- DNS ASK de###dar.com
- DNS ASK ge####serops.com
- DNS ASK fo###red.com
- DNS ASK fi###lox.com
- DNS ASK da##tan.com
- DNS ASK ad##ino.com
- DNS ASK bi##de.com
- DNS ASK el##rot.com
- DNS ASK go##tar.com
- DNS ASK fa###erest.com
- DNS ASK ba##ro.com
- DNS ASK pa##dov.com
- DNS ASK op##red.com
- DNS ASK ha####pricezat.com
- DNS ASK pu###inacee.com
- DNS ASK re##lt.com
- DNS ASK bu###osasrl.com
- DNS ASK ji####olipop.com
- DNS ASK el##tow.com
- DNS ASK ge####iroplop.com
- DNS ASK ek##dar.com
- DNS ASK me##xe.com
- DNS ASK sw####lserits.com
- DNS ASK ib##an.com
- DNS ASK gl###mec.com
- DNS ASK bu###oriso.com
- DNS ASK va##lt.com
- DNS ASK po##ric.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
