Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Web Builder IPsec Font Discovery' = '<SYSTEM32>\zptegzqq.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\zptegzqq.exe
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Publication Volume Client Network Studio] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\kvtrdfhliim.exe' "<SYSTEM32>\zptegzqq.exe"
- '%WINDIR%\Temp\lvcsp2ky37yhx4zgz.exe' -r 29962 tcp
- '%TEMP%\lvcsp2ky34x3x4zgp1rwit.exe'
- '<SYSTEM32>\zptegzqq.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\iysjiudlpxvlr\run
- <SYSTEM32>\iysjiudlpxvlr\rng
- <SYSTEM32>\iysjiudlpxvlr\cfg
- <SYSTEM32>\iysjiudlpxvlr\por
- %WINDIR%\Temp\lvcsp2ky37yhx4zgz.exe
- %TEMP%\lvcsp2ky34x3x4zgp1rwit.exe
- <SYSTEM32>\iysjiudlpxvlr\tst
- <SYSTEM32>\iysjiudlpxvlr\etc
- <SYSTEM32>\kvtrdfhliim.exe
- <SYSTEM32>\zptegzqq.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\kvtrdfhliim.exe
- <SYSTEM32>\zptegzqq.exe
Deletes the following files:
- %WINDIR%\Temp\lvcsp2ky37yhx4zgz.exe
- %TEMP%\lvcsp2ky34x3x4zgp1rwit.exe
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'th###boat.net':80
- 'li###oat.net':80
- 'th###press.net':80
- 'fi###open.net':80
- 'so###rest.net':80
- 'fi###rest.net':80
- 'so###open.net':80
- 'li###ress.net':80
- 'fe###oat.net':80
- 'we###oat.net':80
- 'fe###ress.net':80
- 'li###pen.net':80
- 'th###rest.net':80
- 'li###est.net':80
- 'th###open.net':80
- 'mo###uia.com':80
- 'vi###mojo.com':80
- 'fa###june.net':80
- 'mo###itio.com':80
- 'do####club-grup.com':80
- 'el#####arimagine.com':80
- 'ja###uter.com':80
- 'ri###egan.net':80
- 'fi###boat.net':80
- 'so###press.net':80
- 'fi###press.net':80
- 'so###boat.net':80
- 'fa###began.net':80
- 'ri###ind.net':80
- 'fa###kind.net':80
TCP:
HTTP GET requests:
- th###boat.net/forum/search.php?me#########################################
- li###oat.net/forum/search.php?me#########################################
- th###press.net/forum/search.php?me#########################################
- fi###open.net/forum/search.php?me#########################################
- so###rest.net/forum/search.php?me#########################################
- fi###rest.net/forum/search.php?me#########################################
- so###open.net/forum/search.php?me#########################################
- li###ress.net/forum/search.php?me#########################################
- fe###oat.net/forum/search.php?me#########################################
- we###oat.net/forum/search.php?me#########################################
- fe###ress.net/forum/search.php?me#########################################
- li###pen.net/forum/search.php?me#########################################
- th###rest.net/forum/search.php?me#########################################
- li###est.net/forum/search.php?me#########################################
- th###open.net/forum/search.php?me#########################################
- mo###uia.com/forum/search.php?me#########################################
- vi###mojo.com/forum/search.php?me#########################################
- fa###june.net/forum/search.php?me#########################################
- mo###itio.com/forum/search.php?me#########################################
- do####club-grup.com/forum/search.php?me#########################################
- el#####arimagine.com/forum/search.php?me#########################################
- ja###uter.com/forum/search.php?me#########################################
- ri###egan.net/forum/search.php?me#########################################
- fi###boat.net/forum/search.php?me#########################################
- so###press.net/forum/search.php?me#########################################
- fi###press.net/forum/search.php?me#########################################
- so###boat.net/forum/search.php?me#########################################
- fa###began.net/forum/search.php?me#########################################
- ri###ind.net/forum/search.php?me#########################################
- fa###kind.net/forum/search.php?me#########################################
UDP:
- DNS ASK th###press.net
- DNS ASK li###oat.net
- DNS ASK th###rest.net
- DNS ASK li###ress.net
- DNS ASK so###open.net
- DNS ASK fi###rest.net
- DNS ASK th###boat.net
- DNS ASK fi###open.net
- DNS ASK fe###ress.net
- DNS ASK we###oat.net
- DNS ASK fe###est.net
- DNS ASK we###ress.net
- DNS ASK th###open.net
- DNS ASK li###est.net
- DNS ASK fe###oat.net
- DNS ASK li###pen.net
- DNS ASK so###rest.net
- DNS ASK mo###uia.com
- DNS ASK vi###mojo.com
- DNS ASK fa###june.net
- DNS ASK mo###itio.com
- DNS ASK do####club-grup.com
- DNS ASK el#####arimagine.com
- DNS ASK ja###uter.com
- DNS ASK ri###egan.net
- DNS ASK fi###boat.net
- DNS ASK so###press.net
- DNS ASK fi###press.net
- DNS ASK so###boat.net
- DNS ASK fa###began.net
- DNS ASK ri###ind.net
- DNS ASK fa###kind.net
- '23#.#55.255.250':1900
