Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Connectivity Call Cache Keying AutoConfig' = '%APPDATA%\ljejnveo\uhfshifkzwe.exe'
Malicious functions:
Executes the following:
- '%APPDATA%\ljejnveo\szjvroq.exe' "%APPDATA%\ljejnveo\uhfshifkzwe.exe"
- '%APPDATA%\ljejnveo\uhfshifkzwe.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\ljejnveo\uhfshifkzwe.saw
- %APPDATA%\ljejnveo\szjvroq.exe
- %APPDATA%\ljejnveo\uhfshifkzwe.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\ljejnveo\szjvroq.exe
- %APPDATA%\ljejnveo\uhfshifkzwe.exe
Network activity:
Connects to:
- 'ne#####rymillion.net':80
- 'pl####ntmillion.net':80
- 'pl####ntwhite.net':80
- 'or###toward.net':80
- 'ne####arywhite.net':80
- 'ne#####rypleasure.net':80
- 'he###white.net':80
- 'di####ultwhite.net':80
- 'pl####nttoward.net':80
- 'pl#####tpleasure.net':80
- 'ne####arytoward.net':80
- 'le####toward.net':80
- 're####ewhite.net':80
- 'he####toward.net':80
- 'he####pleasure.net':80
- 'le####pleasure.net':80
- 'or###white.net':80
- 'or####leasure.net':80
- 're####etoward.net':80
- 're####epleasure.net':80
- 're####emillion.net':80
- 'or####illion.net':80
- 'fo####dwhite.net':80
- 'de###ewhite.net':80
- 'an####toward.net':80
- 'an####pleasure.net':80
- 'gl###toward.net':80
- 'fo####dmillion.net':80
- 'fo####dtoward.net':80
- 'de####toward.net':80
- 'de####pleasure.net':80
- 'de####million.net':80
- 'fo####dpleasure.net':80
- 'di#####ltpleasure.net':80
- 'he###toward.net':80
- 'he####leasure.net':80
- 'he####illion.net':80
- 'di#####ltmillion.net':80
- 'di####ulttoward.net':80
- 'an####million.net':80
- 'gl####leasure.net':80
- 'gl####illion.net':80
- 'gl###white.net':80
- 'an###rwhite.net':80
TCP:
HTTP GET requests:
- http://ne#####rymillion.net/forum/search.php?em####################################
- http://pl####ntmillion.net/forum/search.php?em####################################
- http://pl####ntwhite.net/forum/search.php?em####################################
- http://or###toward.net/forum/search.php?em####################################
- http://ne####arywhite.net/forum/search.php?em####################################
- http://ne#####rypleasure.net/forum/search.php?em####################################
- http://he###white.net/forum/search.php?em####################################
- http://di####ultwhite.net/forum/search.php?em####################################
- http://pl####nttoward.net/forum/search.php?em####################################
- http://pl#####tpleasure.net/forum/search.php?em####################################
- http://ne####arytoward.net/forum/search.php?em####################################
- http://le####toward.net/forum/search.php?em####################################
- http://re####ewhite.net/forum/search.php?em####################################
- http://he####toward.net/forum/search.php?em####################################
- http://he####pleasure.net/forum/search.php?em####################################
- http://le####pleasure.net/forum/search.php?em####################################
- http://or###white.net/forum/search.php?em####################################
- http://or####leasure.net/forum/search.php?em####################################
- http://re####etoward.net/forum/search.php?em####################################
- http://re####epleasure.net/forum/search.php?em####################################
- http://re####emillion.net/forum/search.php?em####################################
- http://or####illion.net/forum/search.php?em####################################
- http://fo####dwhite.net/forum/search.php?em####################################
- http://de###ewhite.net/forum/search.php?em####################################
- http://an####toward.net/forum/search.php?em####################################
- http://an####pleasure.net/forum/search.php?em####################################
- http://gl###toward.net/forum/search.php?em####################################
- http://fo####dmillion.net/forum/search.php?em####################################
- http://fo####dtoward.net/forum/search.php?em####################################
- http://de####toward.net/forum/search.php?em####################################
- http://de####pleasure.net/forum/search.php?em####################################
- http://de####million.net/forum/search.php?em####################################
- http://fo####dpleasure.net/forum/search.php?em####################################
- http://di#####ltpleasure.net/forum/search.php?em####################################
- http://he###toward.net/forum/search.php?em####################################
- http://he####leasure.net/forum/search.php?em####################################
- http://he####illion.net/forum/search.php?em####################################
- http://di#####ltmillion.net/forum/search.php?em####################################
- http://di####ulttoward.net/forum/search.php?em####################################
- http://an####million.net/forum/search.php?em####################################
- http://gl####leasure.net/forum/search.php?em####################################
- http://gl####illion.net/forum/search.php?em####################################
- http://gl###white.net/forum/search.php?em####################################
- http://an###rwhite.net/forum/search.php?em####################################
UDP:
- DNS ASK ne#####rymillion.net
- DNS ASK pl####ntmillion.net
- DNS ASK pl####ntwhite.net
- DNS ASK or###toward.net
- DNS ASK ne####arywhite.net
- DNS ASK ne#####rypleasure.net
- DNS ASK he###white.net
- DNS ASK di####ultwhite.net
- DNS ASK pl####nttoward.net
- DNS ASK pl#####tpleasure.net
- DNS ASK ne####arytoward.net
- DNS ASK le####toward.net
- DNS ASK re####ewhite.net
- DNS ASK he####toward.net
- DNS ASK he####pleasure.net
- DNS ASK le####pleasure.net
- DNS ASK or###white.net
- DNS ASK or####leasure.net
- DNS ASK re####etoward.net
- DNS ASK re####epleasure.net
- DNS ASK re####emillion.net
- DNS ASK or####illion.net
- DNS ASK fo####dwhite.net
- DNS ASK de###ewhite.net
- DNS ASK an####toward.net
- DNS ASK an####pleasure.net
- DNS ASK gl###toward.net
- DNS ASK fo####dmillion.net
- DNS ASK fo####dtoward.net
- DNS ASK de####toward.net
- DNS ASK de####pleasure.net
- DNS ASK de####million.net
- DNS ASK fo####dpleasure.net
- DNS ASK di#####ltpleasure.net
- DNS ASK he###toward.net
- DNS ASK he####leasure.net
- DNS ASK he####illion.net
- DNS ASK di#####ltmillion.net
- DNS ASK di####ulttoward.net
- DNS ASK an####million.net
- DNS ASK gl####leasure.net
- DNS ASK gl####illion.net
- DNS ASK gl###white.net
- DNS ASK an###rwhite.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
