Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Fax Gateway Notification Coordinator List' = 'C:\mh3gpjz8f\entbxwsagn.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Interactive Device Diagnostic] 'ImagePath' = 'C:\mh3gpjz8f\entbxwsagn.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Interactive Device Diagnostic] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\mh3gpjz8f\rumv7rjqdafp.exe' "c:\mh3gpjz8f\entbxwsagn.exe"
- 'C:\mh3gpjz8f\entbxwsagn.exe'
- 'C:\mh3gpjz8f\vxcmfa2xwxmkfpwxizi.exe'
Modifies file system:
Creates the following files:
- C:\mh3gpjz8f\entbxwsagn.exe
- C:\mh3gpjz8f\rumv7rjqdafp.exe
- C:\mh3gpjz8f\cqknvm6l
- %WINDIR%\mh3gpjz8f\aq7ioted
- C:\mh3gpjz8f\aq7ioted
- C:\mh3gpjz8f\vxcmfa2xwxmkfpwxizi.exe
Sets the 'hidden' attribute to the following files:
- C:\mh3gpjz8f\rumv7rjqdafp.exe
- C:\mh3gpjz8f\entbxwsagn.exe
Deletes the following files:
- C:\mh3gpjz8f\vxcmfa2xwxmkfpwxizi.exe
- %WINDIR%\mh3gpjz8f\aq7ioted
Network activity:
Connects to:
- 'ch######nneharoldson.net':80
- 'ma#####ttaharoldson.net':80
- 'ma#####ttadonaldson.net':80
- 'ma#####ttaconstable.net':80
- 'ch######nnedonaldson.net':80
- 'te#####nceconstable.net':80
- 'ch######herdonaldson.net':80
- 'ch######herconstable.net':80
- 'ch######herstrudwick.net':80
- 'te#####ncestrudwick.net':80
- 'ch######nneconstable.net':80
- 'ja#####ineconstable.net':80
- 'ge#####nnadonaldson.net':80
- 'ge#####nnaconstable.net':80
- 're#####nnedonaldson.net':80
- 'ch#####belharoldson.net':80
- 'ch######nnestrudwick.net':80
- 'ma#####ttastrudwick.net':80
- 'ja#####ineharoldson.net':80
- 'ja#####inedonaldson.net':80
- 'ge#####nnaharoldson.net':80
TCP:
HTTP GET requests:
- http://ch######nneharoldson.net/index.php
- http://ma#####ttaharoldson.net/index.php
- http://ma#####ttadonaldson.net/index.php
- http://ma#####ttaconstable.net/index.php
- http://ch######nnedonaldson.net/index.php
- http://te#####nceconstable.net/index.php
- http://ch######herdonaldson.net/index.php
- http://ch######herconstable.net/index.php
- http://ch######herstrudwick.net/index.php
- http://te#####ncestrudwick.net/index.php
- http://ch######nneconstable.net/index.php
- http://ja#####ineconstable.net/index.php
- http://ge#####nnadonaldson.net/index.php
- http://ge#####nnaconstable.net/index.php
- http://re#####nnedonaldson.net/index.php
- http://ch#####belharoldson.net/index.php
- http://ch######nnestrudwick.net/index.php
- http://ma#####ttastrudwick.net/index.php
- http://ja#####ineharoldson.net/index.php
- http://ja#####inedonaldson.net/index.php
- http://ge#####nnaharoldson.net/index.php
UDP:
- DNS ASK ma#####ttadonaldson.net
- DNS ASK ch######nneharoldson.net
- DNS ASK ma#####ttaharoldson.net
- DNS ASK ch######nneconstable.net
- DNS ASK ma#####ttaconstable.net
- DNS ASK ch######nnedonaldson.net
- DNS ASK te#####nceconstable.net
- DNS ASK ch######herdonaldson.net
- DNS ASK te#####ncedonaldson.net
- DNS ASK ch######herstrudwick.net
- DNS ASK te#####ncestrudwick.net
- DNS ASK ch######herconstable.net
- DNS ASK ma#####ttastrudwick.net
- DNS ASK ge#####nnastrudwick.net
- DNS ASK ja#####inestrudwick.net
- DNS ASK ge#####nnaconstable.net
- DNS ASK re#####nnedonaldson.net
- DNS ASK ch#####belharoldson.net
- DNS ASK re#####nneharoldson.net
- DNS ASK ge#####nnaharoldson.net
- DNS ASK ja#####ineharoldson.net
- DNS ASK ch######nnestrudwick.net
- DNS ASK ja#####ineconstable.net
- DNS ASK ge#####nnadonaldson.net
- DNS ASK ja#####inedonaldson.net
