Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'xeoqux' = '%HOMEPATH%\xeoqux.exe /T'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'beosa' = '%HOMEPATH%\beosa.exe /e'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'ciivaid' = '%HOMEPATH%\ciivaid.exe /y'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'jtxoak' = '%HOMEPATH%\jtxoak.exe /p'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'liocoj' = '%HOMEPATH%\liocoj.exe /T'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'namux' = '%HOMEPATH%\namux.exe /o'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'lefuz' = '%HOMEPATH%\lefuz.exe /e'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'geoqee' = '%HOMEPATH%\geoqee.exe /n'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'qionek' = '%HOMEPATH%\qionek.exe /G'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'queowaf' = '%HOMEPATH%\queowaf.exe /e'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'jeuiq' = '%HOMEPATH%\jeuiq.exe /P'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'foeiriy' = '%HOMEPATH%\foeiriy.exe /l'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'glhiab' = '%HOMEPATH%\glhiab.exe /G'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'jpriij' = '%HOMEPATH%\jpriij.exe /T'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'lqhoav' = '%HOMEPATH%\lqhoav.exe /F'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'nuaisun' = '%HOMEPATH%\nuaisun.exe /K'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'duainu' = '%HOMEPATH%\duainu.exe /I'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'yuaiqop' = '%HOMEPATH%\yuaiqop.exe /M'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'nauaf' = '%HOMEPATH%\nauaf.exe /J'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'teuuf' = '%HOMEPATH%\teuuf.exe /h'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'qiaod' = '%HOMEPATH%\qiaod.exe /R'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'cuuer' = '%HOMEPATH%\cuuer.exe /G'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- %HOMEPATH%\xeoqux.exe
- %HOMEPATH%\qiaod.exe
- %HOMEPATH%\beosa.exe
- %HOMEPATH%\ciivaid.exe
- %HOMEPATH%\jtxoak.exe
- %HOMEPATH%\liocoj.exe
- %HOMEPATH%\namux.exe
- %HOMEPATH%\lefuz.exe
- %HOMEPATH%\geoqee.exe
- %HOMEPATH%\qionek.exe
- %HOMEPATH%\cuuer.exe
- %HOMEPATH%\queowaf.exe
- %HOMEPATH%\foeiriy.exe
- %HOMEPATH%\glhiab.exe
- %HOMEPATH%\jpriij.exe
- %HOMEPATH%\lqhoav.exe
- %HOMEPATH%\nuaisun.exe
- %HOMEPATH%\duainu.exe
- %HOMEPATH%\yuaiqop.exe
- %HOMEPATH%\nauaf.exe
- %HOMEPATH%\teuuf.exe
- %HOMEPATH%\jeuiq.exe
- %HOMEPATH%\seiak.exe
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\xeoqux.exe
- %HOMEPATH%\qiaod.exe
- %HOMEPATH%\beosa.exe
- %HOMEPATH%\ciivaid.exe
- %HOMEPATH%\jtxoak.exe
- %HOMEPATH%\liocoj.exe
- %HOMEPATH%\namux.exe
- %HOMEPATH%\lefuz.exe
- %HOMEPATH%\geoqee.exe
- %HOMEPATH%\qionek.exe
- %HOMEPATH%\cuuer.exe
- %HOMEPATH%\queowaf.exe
- %HOMEPATH%\foeiriy.exe
- %HOMEPATH%\glhiab.exe
- %HOMEPATH%\jpriij.exe
- %HOMEPATH%\lqhoav.exe
- %HOMEPATH%\nuaisun.exe
- %HOMEPATH%\duainu.exe
- %HOMEPATH%\yuaiqop.exe
- %HOMEPATH%\nauaf.exe
- %HOMEPATH%\teuuf.exe
- %HOMEPATH%\jeuiq.exe
- %HOMEPATH%\seiak.exe
Network activity
Connects to
- '255.255.255.255':8000
UDP
- DNS ASK ns#.###nsearcher.net
- DNS ASK ns#.###nsearcher.org
- DNS ASK ns#.##ayer1352.net
- DNS ASK ns#.##ayer1352.org
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\xeoqux.exe'
- '%HOMEPATH%\qiaod.exe'
- '%HOMEPATH%\beosa.exe'
- '%HOMEPATH%\ciivaid.exe'
- '%HOMEPATH%\jtxoak.exe'
- '%HOMEPATH%\liocoj.exe'
- '%HOMEPATH%\namux.exe'
- '%HOMEPATH%\lefuz.exe'
- '%HOMEPATH%\geoqee.exe'
- '%HOMEPATH%\qionek.exe'
- '%HOMEPATH%\cuuer.exe'
- '%HOMEPATH%\queowaf.exe'
- '%HOMEPATH%\foeiriy.exe'
- '%HOMEPATH%\glhiab.exe'
- '%HOMEPATH%\jpriij.exe'
- '%HOMEPATH%\lqhoav.exe'
- '%HOMEPATH%\nuaisun.exe'
- '%HOMEPATH%\duainu.exe'
- '%HOMEPATH%\yuaiqop.exe'
- '%HOMEPATH%\nauaf.exe'
- '%HOMEPATH%\teuuf.exe'
- '%HOMEPATH%\jeuiq.exe'
- '%HOMEPATH%\seiak.exe'
