Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MciGkrwk' = '<LS_APPDATA>\eyqtaont\mcigkrwk.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,<LS_APPDATA>\eyqtaont\mcigkrwk.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mcigkrwk.exe
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Creates and executes the following:
- '%TEMP%\ekdbmtyq.exe' admin
- '%TEMP%\ekdbmtyq.exe' elevate
Executes the following:
- '<SYSTEM32>\svchost.exe'
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtOpenKey, handler: tqgnnosw.sys
- NtCreateKey, handler: tqgnnosw.sys
Modifies file system :
Creates the following files:
- %TEMP%\tqgnnosw.sys
- %WINDIR%\Temp\6decd52f
- %WINDIR%\Temp\7fffffb1
- <LS_APPDATA>\eyqtaont\mcigkrwk.exe
- %TEMP%\ekdbmtyq.exe
- %ALLUSERSPROFILE%\Application Data\bjdwbfvf.log
- <LS_APPDATA>\niuydqre.log
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mcigkrwk.exe
Deletes the following files:
- %TEMP%\tqgnnosw.sys
Network activity:
Connects to:
- 'py####pajlxoeoc.com':443
- 'ox###xtyyr.com':443
- 'xl####tggmabhpp.com':443
- 'oo####wmyxunlr.com':443
- 'gc###bgura.com':443
- 'dp####aikowymh.com':443
- 'wg###cdb.com':443
- 'cy#####pqdllvrxqu.com':443
- 'kb###agf.com':443
- 'yc####htqeenpso.com':443
- 'ip#####knysfvomq.com':443
- 'rb###ssmhcx.com':443
- 'go####gvolnkcpo.com':443
- 'kp###ugumx.com':443
- 'wv####xvdjag.com':443
- 'bg###vwufi.com':443
- 'bg#####pdfqnqppg.com':443
- 'ke####bypwgfqyg.com':443
- 'iw###pbwppg.com':443
- 'da###lbs.com':443
- 'mq####itbbak.com':443
- 'kx#####oqnlfwfvisbb.com':443
- 'br####kmgndn.com':443
- 'ep#####qkbedarpd.com':443
- 'sx#####caaprwyocm.com':443
- 'er###tbw.com':443
- 'kg####ycaynei.com':443
- 'nv#####shkovbheq.com':443
- 'ps###fybl.com':443
- 'sq####wlslkv.com':443
- 'ch#####jcohrghodar.com':443
- 'gn#####dxnwrwqkwpp.com':443
- 'ha#####acvhhmngyg.com':443
- 'dl#####nvmmgtngihh.com':443
- 'rd####tsxxsvkj.com':443
- 'rd###vyaon.com':443
- 'ec###nbib.com':443
- 'oq####mhigjfw.com':443
- 'ge###kyac.com':443
- 'rd###uyxkh.com':443
- 'dv###yqhomu.com':443
- 'mr####oxjgrnqm.com':443
- 'dq####ddwvllihp.com':443
- 'ej###jdfvkh.com':443
- 'ah####mbxjqjon.com':443
- 'xa####olgpym.com':443
- 'ov###fobf.com':443
- 'er###qeq.com':443
- 'ii###gbo.com':443
- 'bj###vngsn.com':443
- 'gx###jxn.com':443
- 'oq####sfugms.com':443
- 'iu####gmqgyf.com':443
- 'qb#####jlbetfrjfh.com':443
- 'lq#####thqejaosnm.com':443
- 'wv#####liuqbakkxry.com':443
- 'vu####bqnuot.com':443
- 'vo#####uxkkmhbmuac.com':443
- 'fo#####ykmdxodav.com':443
- 'qu###xiga.com':443
- '74.##5.232.51':80
- 'ma###rada.com':443
- 'xp###lpguj.com':443
- 'de#####paoywbeccng.com':443
- 'la###jvqc.com':443
- 'su#####rwhjfxdqbt.com':443
- 'po####jnvfauh.com':443
- 'sd####lyavjif.com':443
- 'ot####ndkmwgak.com':443
- 'sv####vugdxo.com':443
- 'hx###cpwyxh.com':443
- 'si####sxureorb.com':443
- 'of###xwx.com':443
- 'vd####rwmhpvtw.com':443
- 'ib#####odpyxmfhyk.com':443
- 'pq#####thkuhlyoycp.com':443
- 'il#####vfabsxnodio.com':443
- 'vk####pjiqwejsv.com':443
- 'fy#####lnlaedmnew.com':443
- 'ri###mncox.com':443
- 'fm####ycqcllrql.com':443
- 'aj###vwcsnp.com':443
- 'fb####kvhcgp.com':443
- 'gm#####jcwvaidubfha.com':443
- 'wf###jxywb.com':443
- 'aa####jyvxlosy.com':443
- 'mr###wva.com':443
- 'we####bsrjjf.com':443
- 'pe####kmewcix.com':443
- 'tu####asasucgkv.com':443
- 'yy####ghkfwqpyq.com':443
UDP:
- DNS ASK cq####ajfpumhco.com
- DNS ASK ys####ufhioygn.com
- DNS ASK uf###werdk.com
- DNS ASK er###nya.com
- DNS ASK oq####udrctwy.com
- DNS ASK cw####vnopquj.com
- DNS ASK ek#####rwtnmkrgo.com
- DNS ASK eq####khtelypr.com
- DNS ASK cq####etbxkk.com
- DNS ASK gl###fkwxhe.com
- DNS ASK la###ffr.com
- DNS ASK cx#####phvqlduqqj.com
- DNS ASK pj#####olyjcktcrt.com
- DNS ASK tn#####xenaqbdtavwq.com
- DNS ASK je#####otxdmsdii.com
- DNS ASK ji#####jbrmwcvux.com
- DNS ASK vk####rosfly.com
- DNS ASK bj###dybgv.com
- DNS ASK sl#####uwfxnfweg.com
- DNS ASK ta####oqnuhxe.com
- DNS ASK rn#####hmhcuewwvm.com
- DNS ASK ic###lgk.com
- DNS ASK ku####lhpqfxv.com
- DNS ASK fp####oxhcajs.com
- DNS ASK lu#####xfwyjlpnpig.com
- DNS ASK cs#####weytrimmb.com
- DNS ASK nd####elkoxl.com
- DNS ASK ku###cqp.com
- DNS ASK jm#####pmvbliuoqw.com
- DNS ASK bw#####maylcusgj.com
- DNS ASK wd####rgmluxb.com
- DNS ASK be###ootil.com
- DNS ASK yj###uva.com
- DNS ASK el#####qujjsojmx.com
- DNS ASK nd###gecu.com
- DNS ASK gd###inrnck.com
- DNS ASK ai####uwohodb.com
- DNS ASK xd###topx.com
- DNS ASK mw###cio.com
- DNS ASK kg#####ntvypekpui.com
- DNS ASK yw####ahywcmub.com
- DNS ASK jd###bvkleb.com
- DNS ASK qw###ygxhjr.com
- DNS ASK eq###gxi.com
- DNS ASK sc###oelqc.com
- DNS ASK ea#####dokkgarfmuj.com
- DNS ASK ey#####lecqsgdghv.com
- DNS ASK vj###tboyk.com
- DNS ASK qx####lqgbohed.com
- DNS ASK lj#####bgcmlqqcq.com
- DNS ASK xm###sfii.com
- DNS ASK pg###ybbh.com
- DNS ASK ay###algrtc.com
- DNS ASK np###duxgw.com
- DNS ASK pg####awntkl.com
- DNS ASK cy#####tjacflvfc.com
- DNS ASK ya##o.com
- DNS ASK sa###yntu.com
- DNS ASK vt#####nxnmfekcrnwr.com
- DNS ASK jn####tgfbvyau.com
- DNS ASK uu#####gktqwlknjopq.com
- DNS ASK lv####jsoqwht.com
- DNS ASK fr####yrrpmddw.com
- DNS ASK xh####kuhtgxutw.com
- DNS ASK vh####yfqdumdgp.com
- DNS ASK en####xewvfarre.com
- DNS ASK en####ajylwox.com
- DNS ASK vg###xeg.com
- DNS ASK qq###xnu.com
- DNS ASK ux####arcnhlus.com
- DNS ASK nj#####ejmvkacla.com
- DNS ASK io###quoujd.com
- DNS ASK rc#####ppjmvcsiiqc.com
- DNS ASK bing.com
- DNS ASK vi###wqkq.com
- DNS ASK eq####nvcyjwf.com
- DNS ASK uw#####ixgltepqsfv.com
- DNS ASK sd###kbhsk.com
- DNS ASK th###fxfgq.com
- DNS ASK ii#####fsmoxsdepvo.com
- DNS ASK ku####glgmou.com
- DNS ASK vu#####tkqunkgkw.com
- DNS ASK ms#####crhgwpkhvf.com
- DNS ASK il####fajfic.com
- DNS ASK ue####whtvakwu.com
- DNS ASK nx####gsgyen.com
- DNS ASK wc####cymbuias.com
- DNS ASK jj###cnoicy.com
- DNS ASK ev###ixdu.com
- DNS ASK dc#####ybjwxqqbwmfx.com
- DNS ASK wi####fmbvjs.com
- DNS ASK av####ecjgcl.com
- DNS ASK tt####rmscppu.com
- DNS ASK yy####ghkfwqpyq.com
- DNS ASK tu####asasucgkv.com
- DNS ASK pe####kmewcix.com
- DNS ASK we####bsrjjf.com
- DNS ASK mr###wva.com
- DNS ASK aa####jyvxlosy.com
- DNS ASK wf###jxywb.com
- DNS ASK gm#####jcwvaidubfha.com
- DNS ASK fb####kvhcgp.com
- DNS ASK aj###vwcsnp.com
- DNS ASK fm####ycqcllrql.com
- DNS ASK of###xwx.com
- DNS ASK vk####pjiqwejsv.com
- DNS ASK ri###mncox.com
- DNS ASK pq#####thkuhlyoycp.com
- DNS ASK xa####olgpym.com
- DNS ASK il#####vfabsxnodio.com
- DNS ASK fy#####lnlaedmnew.com
- DNS ASK si####sxureorb.com
- DNS ASK vd####rwmhpvtw.com
- DNS ASK sv####vugdxo.com
- DNS ASK ib#####odpyxmfhyk.com
- DNS ASK hx###cpwyxh.com
- DNS ASK sd####lyavjif.com
- DNS ASK xp###lpguj.com
- DNS ASK su#####rwhjfxdqbt.com
- DNS ASK la###jvqc.com
- DNS ASK de#####paoywbeccng.com
- DNS ASK po####jnvfauh.com
- DNS ASK ma###rada.com
- DNS ASK google.com
- DNS ASK qu###xiga.com
- DNS ASK fo#####ykmdxodav.com
- DNS ASK vo#####uxkkmhbmuac.com
- DNS ASK bj###vngsn.com
- DNS ASK lq#####thqejaosnm.com
- DNS ASK vu####bqnuot.com
- DNS ASK iu####gmqgyf.com
- DNS ASK ot####ndkmwgak.com
- DNS ASK qb#####jlbetfrjfh.com
- DNS ASK wv#####liuqbakkxry.com
- DNS ASK ii###gbo.com
- DNS ASK gx###jxn.com
- DNS ASK ov###fobf.com
- DNS ASK oq####sfugms.com
- DNS ASK er###qeq.com
- DNS ASK wv####xvdjag.com
- DNS ASK dq####ddwvllihp.com
- DNS ASK ah####mbxjqjon.com
- DNS ASK dv###yqhomu.com
- DNS ASK kg####ycaynei.com
- DNS ASK mr####oxjgrnqm.com
- DNS ASK ej###jdfvkh.com
- DNS ASK ec###nbib.com
- DNS ASK ge###kyac.com
- DNS ASK rd####tsxxsvkj.com
- DNS ASK rd###uyxkh.com
- DNS ASK rd###vyaon.com
- DNS ASK nv#####shkovbheq.com
- DNS ASK sq####wlslkv.com
- DNS ASK gn#####dxnwrwqkwpp.com
- DNS ASK ch#####jcohrghodar.com
- DNS ASK qv###knv.com
- DNS ASK qp###xefbxv.com
- DNS ASK dl#####nvmmgtngihh.com
- DNS ASK ep#####qkbedarpd.com
- DNS ASK er###tbw.com
- DNS ASK sx#####caaprwyocm.com
- DNS ASK ha#####acvhhmngyg.com
- DNS ASK ps###fybl.com
- DNS ASK da###lbs.com
- DNS ASK kx#####oqnlfwfvisbb.com
- DNS ASK ke####bypwgfqyg.com
- DNS ASK oo####wmyxunlr.com
- DNS ASK iw###pbwppg.com
- DNS ASK mq####itbbak.com
- DNS ASK kp###ugumx.com
- DNS ASK bg###vwufi.com
- DNS ASK rb###ssmhcx.com
- DNS ASK bg#####pdfqnqppg.com
- DNS ASK go####gvolnkcpo.com
- DNS ASK gc###bgura.com
- DNS ASK wg###cdb.com
- DNS ASK kb###agf.com
- DNS ASK cy#####pqdllvrxqu.com
- DNS ASK oq####mhigjfw.com
- DNS ASK br####kmgndn.com
- DNS ASK ip#####knysfvomq.com
- DNS ASK py####pajlxoeoc.com
- DNS ASK xl####tggmabhpp.com
- DNS ASK ox###xtyyr.com
- DNS ASK yc####htqeenpso.com
- DNS ASK dp####aikowymh.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
