Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Peer AutoConfig CNG Program' = 'C:\tjryhacreembi\fcnyfrgtwx.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Redirector Support Tools] 'ImagePath' = 'C:\tjryhacreembi\fcnyfrgtwx.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Redirector Support Tools] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\tjryhacreembi\iriepsdpe.exe' "c:\tjryhacreembi\fcnyfrgtwx.exe"
- 'C:\tjryhacreembi\fcnyfrgtwx.exe'
- 'C:\tjryhacreembi\sgi330ympcdr1icheou.exe'
Modifies file system:
Creates the following files:
- C:\tjryhacreembi\fcnyfrgtwx.exe
- C:\tjryhacreembi\iriepsdpe.exe
- C:\tjryhacreembi\sgi330ympcdr1icheou.exe
- %WINDIR%\tjryhacreembi\blcq1da
- C:\tjryhacreembi\blcq1da
Sets the 'hidden' attribute to the following files:
- C:\tjryhacreembi\iriepsdpe.exe
- C:\tjryhacreembi\fcnyfrgtwx.exe
Deletes the following files:
- C:\tjryhacreembi\sgi330ympcdr1icheou.exe
- %WINDIR%\tjryhacreembi\blcq1da
Network activity:
Connects to:
- 'co####edollar.net':80
- 'ch####ealize.net':80
- 'co####erealize.net':80
- 'ch####ritten.net':80
- 'co####ewritten.net':80
- 'ch###dollar.net':80
- 'al####ritten.net':80
- 'of###dollar.net':80
- 'al###dollar.net':80
- 'of###shore.net':80
- 'al###shore.net':80
- 'of####ritten.net':80
- 'co####eshore.net':80
- 'th###shore.net':80
- 'pr####tshore.net':80
- 'th####ritten.net':80
- 'se####shoulder.net':80
- 'qu###finger.net':80
- 'se####finger.net':80
- 'th####ealize.net':80
- 'pr####trealize.net':80
- 'ch###shore.net':80
- 'pr####twritten.net':80
- 'th###dollar.net':80
- 'pr####tdollar.net':80
TCP:
HTTP GET requests:
- http://co####edollar.net/index.php
- http://ch####ealize.net/index.php
- http://co####erealize.net/index.php
- http://ch####ritten.net/index.php
- http://co####ewritten.net/index.php
- http://ch###dollar.net/index.php
- http://al####ritten.net/index.php
- http://of###dollar.net/index.php
- http://al###dollar.net/index.php
- http://of###shore.net/index.php
- http://al###shore.net/index.php
- http://of####ritten.net/index.php
- http://co####eshore.net/index.php
- http://th###shore.net/index.php
- http://pr####tshore.net/index.php
- http://th####ritten.net/index.php
- http://se####shoulder.net/index.php
- http://qu###finger.net/index.php
- http://se####finger.net/index.php
- http://th####ealize.net/index.php
- http://pr####trealize.net/index.php
- http://ch###shore.net/index.php
- http://pr####twritten.net/index.php
- http://th###dollar.net/index.php
- http://pr####tdollar.net/index.php
UDP:
- DNS ASK co####edollar.net
- DNS ASK ch####ealize.net
- DNS ASK co####erealize.net
- DNS ASK ch####ritten.net
- DNS ASK co####ewritten.net
- DNS ASK ch###dollar.net
- DNS ASK of###shore.net
- DNS ASK of###dollar.net
- DNS ASK al###dollar.net
- DNS ASK of####ealize.net
- DNS ASK al###shore.net
- DNS ASK of####ritten.net
- DNS ASK al####ritten.net
- DNS ASK th###shore.net
- DNS ASK pr####tshore.net
- DNS ASK th####ritten.net
- DNS ASK se####shoulder.net
- DNS ASK qu###finger.net
- DNS ASK se####finger.net
- DNS ASK pr####twritten.net
- DNS ASK pr####trealize.net
- DNS ASK ch###shore.net
- DNS ASK co####eshore.net
- DNS ASK th###dollar.net
- DNS ASK pr####tdollar.net
- DNS ASK th####ealize.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
