Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Access Fax Compatibility Defragmenter' = '<SYSTEM32>\vcgobrpkkzmo.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\vcgobrpkkzmo.exe
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Isolation Human NGEN Source Volume] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- <SYSTEM32>\nqeqrzomcojl.exe "<SYSTEM32>\vcgobrpkkzmo.exe"
- %WINDIR%\Temp\j1uvltrl2uzwre.exe -r 36115 tcp
- %TEMP%\j1uvltrl2stcrljffov.exe
- <SYSTEM32>\vcgobrpkkzmo.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\qdsffgc\run
- <SYSTEM32>\qdsffgc\rng
- %WINDIR%\Temp\j1uvltrl2uzwre.exe
- <SYSTEM32>\qdsffgc\cfg
- <SYSTEM32>\nqeqrzomcojl.exe
- %TEMP%\j1uvltrl2stcrljffov.exe
- <SYSTEM32>\qdsffgc\tst
- <SYSTEM32>\vcgobrpkkzmo.exe
- <SYSTEM32>\qdsffgc\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\nqeqrzomcojl.exe
- <SYSTEM32>\vcgobrpkkzmo.exe
Deletes the following files:
- %WINDIR%\Temp\j1uvltrl2uzwre.exe
- %TEMP%\j1uvltrl2stcrljffov.exe
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'se###rule.net':80
- 'le###rule.net':80
- 'le###hunt.net':80
- 'le###show.net':80
- 'se###hunt.net':80
- 'se###hear.net':80
- 'to###unt.net':80
- 'fa###unt.net':80
- 'fa###how.net':80
- 'le###hear.net':80
- 'to###how.net':80
- 'se###show.net':80
- 'pl###show.net':80
- 'fi###how.net':80
- 'vi###ear.net':80
- 'vi###ule.net':80
- 'lr###hear.net':80
- 'pl###hunt.net':80
- 'pl###hear.net':80
- 'fi###ear.net':80
- 'fi###ule.net':80
- 'fi###unt.net':80
- 'pl###rule.net':80
- 'mu###unt.net':80
- 'pi###rule.net':80
- 'pi###hunt.net':80
- 'pi###show.net':80
- 'mu###how.net':80
- 'mu###ule.net':80
- 'ta###how.net':80
- 'wa###unt.net':80
- 'wa###how.net':80
- 'pi###hear.net':80
- 'mu###ear.net':80
- 've###ear.net':80
- 'fa###ear.net':80
- 'we###how.net':80
- 'to###ear.net':80
- 'to###ule.net':80
- 'fa###ule.net':80
- 've###how.net':80
- 've###ule.net':80
- 'we###ear.net':80
- 'we###ule.net':80
- 'we###unt.net':80
- 've###unt.net':80
- 'lr###rule.net':80
- 've###oon.net':80
- 'we###uter.net':80
- 'we###oon.net':80
- 'we###ctober.net':80
- 've###ctober.net':80
- 've###uter.net':80
- 'mu###ctober.net':80
- 'pi###moon.net':80
- 'pi####ctober.net':80
- 'pi###shoe.net':80
- 'mu###hoe.net':80
- 've###hoe.net':80
- 'mo###itio.com':80
- 'mo###uia.com':80
- 'ja###uter.com':80
- 'do####club-grup.com':80
- 'el#####arimagine.com':80
- 'vi###mojo.com':80
- 'fa###uter.net':80
- 'we###hoe.net':80
- 'to###uter.net':80
- 'am###stol.com':80
- 'fa###oon.net':80
- 'tr###rule.net':80
- 'yo###ule.net':80
- 'yo###unt.net':80
- 'yo###how.net':80
- 'tr###hunt.net':80
- 'tr###hear.net':80
- 'lr###hunt.net':80
- 'vi###unt.net':80
- 'vi###how.net':80
- 'yo###ear.net':80
- 'lr###show.net':80
- 'tr###show.net':80
- 'wa###hoe.net':80
- 'ta###hoe.net':80
- 'mu###uter.net':80
- 'mu###oon.net':80
- 'pi###outer.net':80
- 'wa###ctober.net':80
- 'wa###uter.net':80
- 'ta###uter.net':80
- 'ta###oon.net':80
- 'ta###ctober.net':80
- 'wa###oon.net':80
TCP:
HTTP GET requests:
- se###rule.net/forum/search.php?me#########################################
- le###rule.net/forum/search.php?me#########################################
- le###hunt.net/forum/search.php?me#########################################
- le###show.net/forum/search.php?me#########################################
- se###hunt.net/forum/search.php?me#########################################
- se###hear.net/forum/search.php?me#########################################
- to###unt.net/forum/search.php?me#########################################
- fa###unt.net/forum/search.php?me#########################################
- fa###how.net/forum/search.php?me#########################################
- le###hear.net/forum/search.php?me#########################################
- to###how.net/forum/search.php?me#########################################
- se###show.net/forum/search.php?me#########################################
- pl###show.net/forum/search.php?me#########################################
- fi###how.net/forum/search.php?me#########################################
- vi###ear.net/forum/search.php?me#########################################
- vi###ule.net/forum/search.php?me#########################################
- lr###hear.net/forum/search.php?me#########################################
- pl###hunt.net/forum/search.php?me#########################################
- pl###hear.net/forum/search.php?me#########################################
- fi###ear.net/forum/search.php?me#########################################
- fi###ule.net/forum/search.php?me#########################################
- fi###unt.net/forum/search.php?me#########################################
- pl###rule.net/forum/search.php?me#########################################
- mu###unt.net/forum/search.php?me#########################################
- pi###rule.net/forum/search.php?me#########################################
- pi###hunt.net/forum/search.php?me#########################################
- pi###show.net/forum/search.php?me#########################################
- mu###how.net/forum/search.php?me#########################################
- mu###ule.net/forum/search.php?me#########################################
- ta###how.net/forum/search.php?me#########################################
- wa###unt.net/forum/search.php?me#########################################
- wa###how.net/forum/search.php?me#########################################
- pi###hear.net/forum/search.php?me#########################################
- mu###ear.net/forum/search.php?me#########################################
- ve###ear.net/forum/search.php?me#########################################
- fa###ear.net/forum/search.php?me#########################################
- we###how.net/forum/search.php?me#########################################
- to###ear.net/forum/search.php?me#########################################
- to###ule.net/forum/search.php?me#########################################
- fa###ule.net/forum/search.php?me#########################################
- ve###how.net/forum/search.php?me#########################################
- ve###ule.net/forum/search.php?me#########################################
- we###ear.net/forum/search.php?me#########################################
- we###ule.net/forum/search.php?me#########################################
- we###unt.net/forum/search.php?me#########################################
- ve###unt.net/forum/search.php?me#########################################
- lr###rule.net/forum/search.php?me#########################################
- ve###oon.net/forum/search.php?me#########################################
- we###uter.net/forum/search.php?me#########################################
- we###oon.net/forum/search.php?me#########################################
- we###ctober.net/forum/search.php?me#########################################
- ve###ctober.net/forum/search.php?me#########################################
- ve###uter.net/forum/search.php?me#########################################
- mu###ctober.net/forum/search.php?me#########################################
- pi###moon.net/forum/search.php?me#########################################
- pi####ctober.net/forum/search.php?me#########################################
- pi###shoe.net/forum/search.php?me#########################################
- mu###hoe.net/forum/search.php?me#########################################
- ve###hoe.net/forum/search.php?me#########################################
- mo###itio.com/forum/search.php?me#########################################
- mo###uia.com/forum/search.php?me#########################################
- ja###uter.com/forum/search.php?me#########################################
- do####club-grup.com/forum/search.php?me#########################################
- el#####arimagine.com/forum/search.php?me#########################################
- vi###mojo.com/forum/search.php?me#########################################
- fa###uter.net/forum/search.php?me#########################################
- we###hoe.net/forum/search.php?me#########################################
- to###uter.net/forum/search.php?me#########################################
- am###stol.com/forum/search.php?me#########################################
- fa###oon.net/forum/search.php?me#########################################
- tr###rule.net/forum/search.php?me#########################################
- yo###ule.net/forum/search.php?me#########################################
- yo###unt.net/forum/search.php?me#########################################
- yo###how.net/forum/search.php?me#########################################
- tr###hunt.net/forum/search.php?me#########################################
- tr###hear.net/forum/search.php?me#########################################
- lr###hunt.net/forum/search.php?me#########################################
- vi###unt.net/forum/search.php?me#########################################
- vi###how.net/forum/search.php?me#########################################
- yo###ear.net/forum/search.php?me#########################################
- lr###show.net/forum/search.php?me#########################################
- tr###show.net/forum/search.php?me#########################################
- wa###hoe.net/forum/search.php?me#########################################
- ta###hoe.net/forum/search.php?me#########################################
- mu###uter.net/forum/search.php?me#########################################
- mu###oon.net/forum/search.php?me#########################################
- pi###outer.net/forum/search.php?me#########################################
- wa###ctober.net/forum/search.php?me#########################################
- wa###uter.net/forum/search.php?me#########################################
- ta###uter.net/forum/search.php?me#########################################
- ta###oon.net/forum/search.php?me#########################################
- ta###ctober.net/forum/search.php?me#########################################
- wa###oon.net/forum/search.php?me#########################################
UDP:
- DNS ASK le###hunt.net
- DNS ASK se###rule.net
- DNS ASK se###hunt.net
- DNS ASK se###show.net
- DNS ASK le###show.net
- DNS ASK le###rule.net
- DNS ASK fa###how.net
- DNS ASK to###unt.net
- DNS ASK to###how.net
- DNS ASK se###hear.net
- DNS ASK le###hear.net
- DNS ASK fi###ear.net
- DNS ASK vi###ear.net
- DNS ASK pl###show.net
- DNS ASK lr###hear.net
- DNS ASK lr###rule.net
- DNS ASK vi###ule.net
- DNS ASK fi###how.net
- DNS ASK fi###ule.net
- DNS ASK pl###hear.net
- DNS ASK pl###rule.net
- DNS ASK pl###hunt.net
- DNS ASK fi###unt.net
- DNS ASK fa###unt.net
- DNS ASK mu###unt.net
- DNS ASK pi###rule.net
- DNS ASK pi###hunt.net
- DNS ASK pi###show.net
- DNS ASK mu###how.net
- DNS ASK mu###ule.net
- DNS ASK ta###how.net
- DNS ASK wa###unt.net
- DNS ASK wa###how.net
- DNS ASK pi###hear.net
- DNS ASK mu###ear.net
- DNS ASK ve###ear.net
- DNS ASK fa###ear.net
- DNS ASK we###how.net
- DNS ASK to###ear.net
- DNS ASK to###ule.net
- DNS ASK fa###ule.net
- DNS ASK ve###how.net
- DNS ASK ve###ule.net
- DNS ASK we###ear.net
- DNS ASK we###ule.net
- DNS ASK we###unt.net
- DNS ASK ve###unt.net
- DNS ASK ve###oon.net
- DNS ASK we###uter.net
- DNS ASK we###oon.net
- DNS ASK we###ctober.net
- DNS ASK ve###ctober.net
- DNS ASK ve###uter.net
- DNS ASK mu###ctober.net
- DNS ASK pi###moon.net
- DNS ASK pi####ctober.net
- DNS ASK pi###shoe.net
- DNS ASK mu###hoe.net
- DNS ASK ve###hoe.net
- DNS ASK mo###itio.com
- DNS ASK mo###uia.com
- DNS ASK ja###uter.com
- DNS ASK do####club-grup.com
- DNS ASK el#####arimagine.com
- DNS ASK vi###mojo.com
- DNS ASK fa###uter.net
- DNS ASK we###hoe.net
- DNS ASK to###uter.net
- DNS ASK am###stol.com
- DNS ASK fa###oon.net
- DNS ASK tr###rule.net
- DNS ASK yo###ule.net
- DNS ASK yo###unt.net
- DNS ASK yo###how.net
- DNS ASK tr###hunt.net
- DNS ASK tr###hear.net
- DNS ASK lr###hunt.net
- DNS ASK vi###unt.net
- DNS ASK vi###how.net
- DNS ASK yo###ear.net
- DNS ASK lr###show.net
- DNS ASK tr###show.net
- DNS ASK wa###hoe.net
- DNS ASK ta###hoe.net
- DNS ASK mu###uter.net
- DNS ASK mu###oon.net
- DNS ASK pi###outer.net
- DNS ASK wa###ctober.net
- DNS ASK wa###uter.net
- DNS ASK ta###uter.net
- DNS ASK ta###oon.net
- DNS ASK ta###ctober.net
- DNS ASK wa###oon.net
- '23#.#55.255.250':1900
