Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Peer Superfetch Now Policy' = 'C:\ehtczgialnhopq\jaubthhtgwmy.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Quality HomeGroup Debugger Diagnostic] 'ImagePath' = 'C:\ehtczgialnhopq\jaubthhtgwmy.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Quality HomeGroup Debugger Diagnostic] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\ehtczgialnhopq\mqafwphbpurh.exe' "c:\ehtczgialnhopq\jaubthhtgwmy.exe"
- 'C:\ehtczgialnhopq\jaubthhtgwmy.exe'
- 'C:\ehtczgialnhopq\i2a2okkenfwkslawmp.exe'
Modifies file system:
Creates the following files:
- C:\ehtczgialnhopq\jaubthhtgwmy.exe
- C:\ehtczgialnhopq\mqafwphbpurh.exe
- C:\ehtczgialnhopq\suetjgjc6ft0
- %WINDIR%\ehtczgialnhopq\hlttg0
- C:\ehtczgialnhopq\hlttg0
- C:\ehtczgialnhopq\i2a2okkenfwkslawmp.exe
Sets the 'hidden' attribute to the following files:
- C:\ehtczgialnhopq\mqafwphbpurh.exe
- C:\ehtczgialnhopq\jaubthhtgwmy.exe
Deletes the following files:
- C:\ehtczgialnhopq\i2a2okkenfwkslawmp.exe
- %WINDIR%\ehtczgialnhopq\hlttg0
Network activity:
Connects to:
- 'su####language.net':80
- 'fo####nlanguage.net':80
- 'su####settle.net':80
- 'fo####nsettle.net':80
- 'su####device.net':80
- 'fo####nbefore.net':80
- 'wh####rsettle.net':80
- 'fo####ndevice.net':80
- 'su####before.net':80
- 'ma####ebefore.net':80
- 'pe####settle.net':80
- 'ma####esettle.net':80
- 'ex####before.net':80
- 'be####ebefore.net':80
- 'pe####language.net':80
- 'ma####edevice.net':80
- 'pe####before.net':80
- 'ma####elanguage.net':80
- 'pe####device.net':80
- 'th####device.net':80
- 'fi####before.net':80
- 'th####language.net':80
- 'fi####device.net':80
- 'th####before.net':80
- 'pi####elanguage.net':80
- 'ci#####telanguage.net':80
- 'pi####esettle.net':80
- 'ci####ttesettle.net':80
- 'fi####language.net':80
- 'ri####anguage.net':80
- 'wh####rdevice.net':80
- 'ri###settle.net':80
- 'wh####rlanguage.net':80
- 'ri###device.net':80
- 'fi####settle.net':80
- 'th####settle.net':80
- 'wh####rbefore.net':80
- 'ri###before.net':80
- 'be####edevice.net':80
- 'ci####ttebecame.net':80
- 'pi####econtain.net':80
- 'ci#####teindustry.net':80
- 'pi####ebecame.net':80
- 'ci#####tecontain.net':80
- 'ch#####nindustry.net':80
- 'fa####industry.net':80
- 'pi####ebasket.net':80
- 'ci####ttebasket.net':80
- 'pi####eindustry.net':80
- 'th####industry.net':80
- 'fi####became.net':80
- 'ri###basket.net':80
- 'fi####industry.net':80
- 'th####became.net':80
- 'fi####basket.net':80
- 'th####basket.net':80
- 'fi####contain.net':80
- 'th####contain.net':80
- 'ei####basket.net':80
- 'en####hbasket.net':80
- 'ei####contain.net':80
- 'en####hcontain.net':80
- 'ex####settle.net':80
- 'be####elanguage.net':80
- 'ex####device.net':80
- 'be####esettle.net':80
- 'ex####language.net':80
- 'en####hbecame.net':80
- 'ch####encontain.net':80
- 'fa####contain.net':80
- 'ch####enbecame.net':80
- 'fa####became.net':80
- 'ch####enbasket.net':80
- 'en####hindustry.net':80
- 'ei####became.net':80
- 'fa####basket.net':80
- 'ei####industry.net':80
TCP:
HTTP GET requests:
- http://su####language.net/index.php
- http://fo####nlanguage.net/index.php
- http://su####settle.net/index.php
- http://fo####nsettle.net/index.php
- http://su####device.net/index.php
- http://fo####nbefore.net/index.php
- http://wh####rsettle.net/index.php
- http://fo####ndevice.net/index.php
- http://su####before.net/index.php
- http://ma####ebefore.net/index.php
- http://pe####settle.net/index.php
- http://ma####esettle.net/index.php
- http://ex####before.net/index.php
- http://be####ebefore.net/index.php
- http://pe####language.net/index.php
- http://ma####edevice.net/index.php
- http://pe####before.net/index.php
- http://ma####elanguage.net/index.php
- http://pe####device.net/index.php
- http://th####device.net/index.php
- http://fi####before.net/index.php
- http://th####language.net/index.php
- http://fi####device.net/index.php
- http://th####before.net/index.php
- http://pi####elanguage.net/index.php
- http://ci#####telanguage.net/index.php
- http://pi####esettle.net/index.php
- http://ci####ttesettle.net/index.php
- http://fi####language.net/index.php
- http://ri####anguage.net/index.php
- http://wh####rdevice.net/index.php
- http://ri###settle.net/index.php
- http://wh####rlanguage.net/index.php
- http://ri###device.net/index.php
- http://fi####settle.net/index.php
- http://th####settle.net/index.php
- http://wh####rbefore.net/index.php
- http://ri###before.net/index.php
- http://be####edevice.net/index.php
- http://ci####ttebecame.net/index.php
- http://pi####econtain.net/index.php
- http://ci#####teindustry.net/index.php
- http://pi####ebecame.net/index.php
- http://ci#####tecontain.net/index.php
- http://ch#####nindustry.net/index.php
- http://fa####industry.net/index.php
- http://pi####ebasket.net/index.php
- http://ci####ttebasket.net/index.php
- http://pi####eindustry.net/index.php
- http://th####industry.net/index.php
- http://fi####became.net/index.php
- http://ri###basket.net/index.php
- http://fi####industry.net/index.php
- http://th####became.net/index.php
- http://fi####basket.net/index.php
- http://th####basket.net/index.php
- http://fi####contain.net/index.php
- http://th####contain.net/index.php
- http://ei####basket.net/index.php
- http://en####hbasket.net/index.php
- http://ei####contain.net/index.php
- http://en####hcontain.net/index.php
- http://ex####settle.net/index.php
- http://be####elanguage.net/index.php
- http://ex####device.net/index.php
- http://be####esettle.net/index.php
- http://ex####language.net/index.php
- http://en####hbecame.net/index.php
- http://ch####encontain.net/index.php
- http://fa####contain.net/index.php
- http://ch####enbecame.net/index.php
- http://fa####became.net/index.php
- http://ch####enbasket.net/index.php
- http://en####hindustry.net/index.php
- http://ei####became.net/index.php
- http://fa####basket.net/index.php
- http://ei####industry.net/index.php
UDP:
- DNS ASK su####language.net
- DNS ASK fo####nlanguage.net
- DNS ASK su####settle.net
- DNS ASK fo####nsettle.net
- DNS ASK su####device.net
- DNS ASK fo####nbefore.net
- DNS ASK wh####rsettle.net
- DNS ASK fo####ndevice.net
- DNS ASK su####before.net
- DNS ASK ma####ebefore.net
- DNS ASK pe####settle.net
- DNS ASK ma####esettle.net
- DNS ASK ex####before.net
- DNS ASK be####ebefore.net
- DNS ASK pe####language.net
- DNS ASK ma####edevice.net
- DNS ASK pe####before.net
- DNS ASK ma####elanguage.net
- DNS ASK pe####device.net
- DNS ASK ri###settle.net
- DNS ASK fi####before.net
- DNS ASK th####before.net
- DNS ASK fi####device.net
- DNS ASK th####device.net
- DNS ASK pi####esettle.net
- DNS ASK ci#####telanguage.net
- DNS ASK pi####edevice.net
- DNS ASK ci####ttesettle.net
- DNS ASK pi####elanguage.net
- DNS ASK th####language.net
- DNS ASK wh####rdevice.net
- DNS ASK ri###device.net
- DNS ASK wh####rlanguage.net
- DNS ASK ri####anguage.net
- DNS ASK wh####rbefore.net
- DNS ASK th####settle.net
- DNS ASK fi####language.net
- DNS ASK ri###before.net
- DNS ASK fi####settle.net
- DNS ASK ci####ttebecame.net
- DNS ASK pi####econtain.net
- DNS ASK ci#####teindustry.net
- DNS ASK pi####ebecame.net
- DNS ASK ci#####tecontain.net
- DNS ASK ch#####nindustry.net
- DNS ASK fa####industry.net
- DNS ASK pi####ebasket.net
- DNS ASK ci####ttebasket.net
- DNS ASK pi####eindustry.net
- DNS ASK th####industry.net
- DNS ASK fi####became.net
- DNS ASK ri###basket.net
- DNS ASK fi####industry.net
- DNS ASK th####became.net
- DNS ASK fi####basket.net
- DNS ASK th####basket.net
- DNS ASK fi####contain.net
- DNS ASK th####contain.net
- DNS ASK ch####enbecame.net
- DNS ASK en####hbasket.net
- DNS ASK ex####settle.net
- DNS ASK en####hcontain.net
- DNS ASK ei####basket.net
- DNS ASK be####esettle.net
- DNS ASK ex####device.net
- DNS ASK be####edevice.net
- DNS ASK ex####language.net
- DNS ASK be####elanguage.net
- DNS ASK ei####contain.net
- DNS ASK fa####contain.net
- DNS ASK ch####enbasket.net
- DNS ASK fa####became.net
- DNS ASK ch####encontain.net
- DNS ASK fa####basket.net
- DNS ASK ei####became.net
- DNS ASK en####hbecame.net
- DNS ASK ei####industry.net
- DNS ASK en####hindustry.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
