Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Browser Mapper Function Store Layer Debugger' = '%APPDATA%\kyqqpcqgoek\qzlshle.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\kyqqpcqgoek\kmuhsadddwp.exe' "%APPDATA%\kyqqpcqgoek\qzlshle.exe"
- '%APPDATA%\kyqqpcqgoek\qzlshle.exe'
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Modifies file system :
Creates the following files:
- %APPDATA%\kyqqpcqgoek\qzlshle.ajfd
- %APPDATA%\kyqqpcqgoek\kmuhsadddwp.exe
- %APPDATA%\kyqqpcqgoek\qzlshle.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\kyqqpcqgoek\qzlshle.exe
Network activity:
Connects to:
- 'br####period.net':80
- 're####period.net':80
- 'br####however.net':80
- 're####although.net':80
- 'br####choose.net':80
- 're####choose.net':80
- 'br####although.net':80
- 're####however.net':80
- 'pr####eperiod.net':80
- 'de####period.net':80
- 'pr####ehowever.net':80
- 'de####although.net':80
- 'pr####echoose.net':80
- 'de####choose.net':80
- 'pr####ealthough.net':80
- 'fe####however.net':80
- 'do####choose.net':80
- 'pr####choose.net':80
- 'do####although.net':80
- 'mi####owever.net':80
- 'st###period.net':80
- 'mi###period.net':80
- 'st####owever.net':80
- 'pr####although.net':80
- 'fe####choose.net':80
- 'fe####although.net':80
- 'fe####period.net':80
- 'pr####however.net':80
- 'do####period.net':80
- 'pr####period.net':80
- 'do####however.net':80
TCP:
HTTP GET requests:
- br####period.net/index.php?em#########################################
- re####period.net/index.php?em#########################################
- br####however.net/index.php?em#########################################
- re####although.net/index.php?em#########################################
- br####choose.net/index.php?em#########################################
- re####choose.net/index.php?em#########################################
- br####although.net/index.php?em#########################################
- re####however.net/index.php?em#########################################
- pr####eperiod.net/index.php?em#########################################
- de####period.net/index.php?em#########################################
- pr####ehowever.net/index.php?em#########################################
- de####although.net/index.php?em#########################################
- pr####echoose.net/index.php?em#########################################
- de####choose.net/index.php?em#########################################
- pr####ealthough.net/index.php?em#########################################
- fe####however.net/index.php?em#########################################
- do####choose.net/index.php?em#########################################
- pr####choose.net/index.php?em#########################################
- do####although.net/index.php?em#########################################
- mi####owever.net/index.php?em#########################################
- st###period.net/index.php?em#########################################
- mi###period.net/index.php?em#########################################
- st####owever.net/index.php?em#########################################
- pr####although.net/index.php?em#########################################
- fe####choose.net/index.php?em#########################################
- fe####although.net/index.php?em#########################################
- fe####period.net/index.php?em#########################################
- pr####however.net/index.php?em#########################################
- do####period.net/index.php?em#########################################
- pr####period.net/index.php?em#########################################
- do####however.net/index.php?em#########################################
UDP:
- DNS ASK re####period.net
- DNS ASK br####period.net
- DNS ASK re####however.net
- DNS ASK br####however.net
- DNS ASK re####choose.net
- DNS ASK br####choose.net
- DNS ASK re####although.net
- DNS ASK br####although.net
- DNS ASK de####period.net
- DNS ASK pr####eperiod.net
- DNS ASK de####however.net
- DNS ASK pr####ehowever.net
- DNS ASK de####choose.net
- DNS ASK pr####echoose.net
- DNS ASK de####although.net
- DNS ASK pr####ealthough.net
- DNS ASK pr####choose.net
- DNS ASK do####choose.net
- DNS ASK pr####although.net
- DNS ASK do####although.net
- DNS ASK mi###period.net
- DNS ASK st###period.net
- DNS ASK mi####owever.net
- DNS ASK st####owever.net
- DNS ASK fe####although.net
- DNS ASK fe####choose.net
- DNS ASK fe####however.net
- DNS ASK fe####period.net
- DNS ASK pr####period.net
- DNS ASK do####period.net
- DNS ASK pr####however.net
- DNS ASK do####however.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
