Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Offline File Block AutoConfig Publication' = '<SYSTEM32>\wtwdrthfnu.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Font Net.Tcp Thread Instrumentation Window] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\mjdbqsgssayo.exe' "<SYSTEM32>\wtwdrthfnu.exe"
- '%WINDIR%\Temp\fzkhuu3gflu9d.exe' -r 39302 tcp
- '%TEMP%\fzkhuu38rku9dhvxoycz.exe'
- '<SYSTEM32>\wtwdrthfnu.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\jfcfsjtpdpsu\run
- <SYSTEM32>\jfcfsjtpdpsu\rng
- %WINDIR%\Temp\fzkhuu3gflu9d.exe
- <SYSTEM32>\jfcfsjtpdpsu\cfg
- <SYSTEM32>\mjdbqsgssayo.exe
- %TEMP%\fzkhuu38rku9dhvxoycz.exe
- <SYSTEM32>\jfcfsjtpdpsu\tst
- <SYSTEM32>\wtwdrthfnu.exe
- <SYSTEM32>\jfcfsjtpdpsu\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\mjdbqsgssayo.exe
- <SYSTEM32>\wtwdrthfnu.exe
Deletes the following files:
- %WINDIR%\Temp\fzkhuu3gflu9d.exe
- <DRIVERS>\etc\hosts
- %TEMP%\fzkhuu38rku9dhvxoycz.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'ro###orn.net':80
- 'si###orn.net':80
- 'si###ugust.net':80
- 'si###aid.net':80
- 'ro###ugust.net':80
- 'ju###aid.net':80
- 'mo###ugust.net':80
- 'mo###aid.net':80
- 'mo###loth.net':80
- 'ju###loth.net':80
- 'pi###ugust.net':80
- 'so###ugust.net':80
- 'so###aid.net':80
- 'so###loth.net':80
- 'pi###aid.net':80
- 'si###loth.net':80
- 'ro###aid.net':80
- 'ro###loth.net':80
- 'pi###orn.net':80
- 'so###orn.net':80
- 'ju###ugust.net':80
- 'lo###aid.net':80
- 'fe###ugust.net':80
- 'fe###aid.net':80
- 'fe###loth.net':80
- 'lo###loth.net':80
- 'th###cloth.net':80
- 'th###paid.net':80
- 'lo###orn.net':80
- 'lo###ugust.net':80
- 'fe###orn.net':80
- 'wh###loth.net':80
- 'hi###aid.net':80
- 'hi###loth.net':80
- 'mo###orn.net':80
- 'ju###orn.net':80
- 'hi###orn.net':80
- 'wh###orn.net':80
- 'wh###ugust.net':80
- 'wh###aid.net':80
- 'hi###ugust.net':80
- 'pi###loth.net':80
- 'su###ylady.net':80
- 'mo###ady.net':80
- 'mo###ast.net':80
- 'mo###ing.net':80
- 'su###ypast.net':80
- 'si###ing.net':80
- 'me###ast.net':80
- 'me###ing.net':80
- 'su###yfish.net':80
- 'mo###ish.net':80
- 'de###lxc.com':80
- 'th###ast.net':80
- 'be##lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'th###ish.net':80
- 'su###ywing.net':80
- 'qu###fish.net':80
- 'qu###lady.net':80
- 'th###ady.net':80
- 'si###ast.net':80
- 'ab###loth.net':80
- 'kn###aid.net':80
- 'kn###loth.net':80
- 'cl###fish.net':80
- 'da###ish.net':80
- 'kn###orn.net':80
- 'ab###orn.net':80
- 'ab###ugust.net':80
- 'ab###aid.net':80
- 'kn###ugust.net':80
- 'si###ish.net':80
- 'cl###wing.net':80
- 'me###ish.net':80
- 'me###ady.net':80
- 'si###ady.net':80
- 'cl###lady.net':80
- 'da###ady.net':80
- 'da###ast.net':80
- 'da###ing.net':80
- 'cl###past.net':80
TCP:
HTTP GET requests:
- http://ro###orn.net/index.php
- http://si###orn.net/index.php
- http://si###ugust.net/index.php
- http://si###aid.net/index.php
- http://ro###ugust.net/index.php
- http://ju###aid.net/index.php
- http://mo###ugust.net/index.php
- http://mo###aid.net/index.php
- http://mo###loth.net/index.php
- http://ju###loth.net/index.php
- http://pi###ugust.net/index.php
- http://so###ugust.net/index.php
- http://so###aid.net/index.php
- http://so###loth.net/index.php
- http://pi###aid.net/index.php
- http://si###loth.net/index.php
- http://ro###aid.net/index.php
- http://ro###loth.net/index.php
- http://pi###orn.net/index.php
- http://so###orn.net/index.php
- http://ju###ugust.net/index.php
- http://lo###aid.net/index.php
- http://fe###ugust.net/index.php
- http://fe###aid.net/index.php
- http://fe###loth.net/index.php
- http://lo###loth.net/index.php
- http://th###cloth.net/index.php
- http://th###paid.net/index.php
- http://lo###orn.net/index.php
- http://lo###ugust.net/index.php
- http://fe###orn.net/index.php
- http://wh###loth.net/index.php
- http://hi###aid.net/index.php
- http://hi###loth.net/index.php
- http://mo###orn.net/index.php
- http://ju###orn.net/index.php
- http://hi###orn.net/index.php
- http://wh###orn.net/index.php
- http://wh###ugust.net/index.php
- http://wh###aid.net/index.php
- http://hi###ugust.net/index.php
- http://pi###loth.net/index.php
- http://su###ylady.net/index.php
- http://mo###ady.net/index.php
- http://mo###ast.net/index.php
- http://mo###ing.net/index.php
- http://su###ypast.net/index.php
- http://si###ing.net/index.php
- http://me###ast.net/index.php
- http://me###ing.net/index.php
- http://su###yfish.net/index.php
- http://mo###ish.net/index.php
- http://de###lxc.com/index.php
- http://th###ast.net/index.php
- http://be##lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://th###ish.net/index.php
- http://su###ywing.net/index.php
- http://qu###fish.net/index.php
- http://qu###lady.net/index.php
- http://th###ady.net/index.php
- http://si###ast.net/index.php
- http://ab###loth.net/index.php
- http://kn###aid.net/index.php
- http://kn###loth.net/index.php
- http://cl###fish.net/index.php
- http://da###ish.net/index.php
- http://kn###orn.net/index.php
- http://ab###orn.net/index.php
- http://ab###ugust.net/index.php
- http://ab###aid.net/index.php
- http://kn###ugust.net/index.php
- http://si###ish.net/index.php
- http://cl###wing.net/index.php
- http://me###ish.net/index.php
- http://me###ady.net/index.php
- http://si###ady.net/index.php
- http://cl###lady.net/index.php
- http://da###ady.net/index.php
- http://da###ast.net/index.php
- http://da###ing.net/index.php
- http://cl###past.net/index.php
UDP:
- DNS ASK ro###orn.net
- DNS ASK si###orn.net
- DNS ASK si###ugust.net
- DNS ASK si###aid.net
- DNS ASK ro###ugust.net
- DNS ASK ju###aid.net
- DNS ASK mo###ugust.net
- DNS ASK mo###aid.net
- DNS ASK mo###loth.net
- DNS ASK ju###loth.net
- DNS ASK ro###aid.net
- DNS ASK so###aid.net
- DNS ASK pi###ugust.net
- DNS ASK pi###aid.net
- DNS ASK pi###loth.net
- DNS ASK so###loth.net
- DNS ASK ro###loth.net
- DNS ASK si###loth.net
- DNS ASK so###orn.net
- DNS ASK so###ugust.net
- DNS ASK pi###orn.net
- DNS ASK lo###aid.net
- DNS ASK fe###ugust.net
- DNS ASK fe###aid.net
- DNS ASK fe###loth.net
- DNS ASK lo###loth.net
- DNS ASK th###cloth.net
- DNS ASK th###paid.net
- DNS ASK lo###orn.net
- DNS ASK lo###ugust.net
- DNS ASK fe###orn.net
- DNS ASK wh###orn.net
- DNS ASK hi###loth.net
- DNS ASK wh###loth.net
- DNS ASK ju###orn.net
- DNS ASK ju###ugust.net
- DNS ASK mo###orn.net
- DNS ASK wh###ugust.net
- DNS ASK hi###orn.net
- DNS ASK hi###ugust.net
- DNS ASK hi###aid.net
- DNS ASK wh###aid.net
- DNS ASK su###ylady.net
- DNS ASK mo###ady.net
- DNS ASK mo###ast.net
- DNS ASK mo###ing.net
- DNS ASK su###ypast.net
- DNS ASK si###ing.net
- DNS ASK me###ast.net
- DNS ASK me###ing.net
- DNS ASK su###yfish.net
- DNS ASK mo###ish.net
- DNS ASK de###lxc.com
- DNS ASK th###ast.net
- DNS ASK be##lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK th###ish.net
- DNS ASK su###ywing.net
- DNS ASK qu###fish.net
- DNS ASK qu###lady.net
- DNS ASK th###ady.net
- DNS ASK si###ast.net
- DNS ASK ab###loth.net
- DNS ASK kn###aid.net
- DNS ASK kn###loth.net
- DNS ASK cl###fish.net
- DNS ASK da###ish.net
- DNS ASK kn###orn.net
- DNS ASK ab###orn.net
- DNS ASK ab###ugust.net
- DNS ASK ab###aid.net
- DNS ASK kn###ugust.net
- DNS ASK si###ish.net
- DNS ASK cl###wing.net
- DNS ASK me###ish.net
- DNS ASK me###ady.net
- DNS ASK si###ady.net
- DNS ASK cl###lady.net
- DNS ASK da###ady.net
- DNS ASK da###ast.net
- DNS ASK da###ing.net
- DNS ASK cl###past.net
- '23#.#55.255.250':1900
