Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Installer Hardware Name Task' = 'C:\lhmzbnybwsdb\ezgczfq.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Policy Network Adapter Secure Fax Center] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\lhmzbnybwsdb\txqlxgxmnue.exe' "c:\lhmzbnybwsdb\ezgczfq.exe"
- 'C:\lhmzbnybwsdb\ezgczfq.exe'
- 'C:\lhmzbnybwsdb\uivz2newj3ziqptu.exe'
Modifies file system :
Creates the following files:
- C:\lhmzbnybwsdb\ezgczfq.exe
- C:\lhmzbnybwsdb\txqlxgxmnue.exe
- C:\lhmzbnybwsdb\lx9xz7xnt
- %WINDIR%\lhmzbnybwsdb\lkxjkqg
- C:\lhmzbnybwsdb\lkxjkqg
- C:\lhmzbnybwsdb\uivz2newj3ziqptu.exe
Sets the 'hidden' attribute to the following files:
- C:\lhmzbnybwsdb\txqlxgxmnue.exe
- C:\lhmzbnybwsdb\ezgczfq.exe
Deletes the following files:
- C:\lhmzbnybwsdb\uivz2newj3ziqptu.exe
- %WINDIR%\lhmzbnybwsdb\lkxjkqg
Network activity:
Connects to:
- 'pr####twomen.net':80
- 'ch###clean.net':80
- 'pr####tcourse.net':80
- 'th###women.net':80
- 'co####epaint.net':80
- 'ch###course.net':80
- 'co####eclean.net':80
- 'ch###paint.net':80
- 'se####different.net':80
- 'th###clean.net':80
- 'se####letter.net':80
- 'qu####ifferent.net':80
- 'pr####tpaint.net':80
- 'th###course.net':80
- 'pr####tclean.net':80
- 'th###paint.net':80
- 'al###women.net':80
- 'mi###eclean.net':80
- 'al###course.net':80
- 'of###women.net':80
- 'tw###epaint.net':80
- 'mi####course.net':80
- 'tw###eclean.net':80
- 'mi###epaint.net':80
- 'co####ewomen.net':80
- 'of###clean.net':80
- 'co####ecourse.net':80
- 'ch###women.net':80
- 'al###paint.net':80
- 'of###course.net':80
- 'al###clean.net':80
- 'of###paint.net':80
- 'qu###letter.net':80
- 'st####different.net':80
- 'tr####ifferent.net':80
- 'st####letter.net':80
- 'tr###letter.net':80
- 'be####beside.net':80
- 'ga####beside.net':80
- 'be####surprise.net':80
- 'ga####surprise.net':80
- 're####different.net':80
- 'el#####cdifferent.net':80
- 're####letter.net':80
- 'el####icletter.net':80
- 'st####beside.net':80
- 'tr###beside.net':80
- 'st####surprise.net':80
- 'tr####urprise.net':80
- 'fl####ifferent.net':80
- 'br####ifferent.net':80
- 'fl###letter.net':80
- 'br###letter.net':80
- 'qu###beside.net':80
- 'se####beside.net':80
- 'qu####urprise.net':80
- 'se####surprise.net':80
- 'be####different.net':80
- 'ga####different.net':80
- 'be####letter.net':80
- 'ga####letter.net':80
- 'fl###beside.net':80
- 'br###beside.net':80
- 'fl####urprise.net':80
- 'br####urprise.net':80
TCP:
HTTP GET requests:
- http://pr####twomen.net/index.php?me########
- http://ch###clean.net/index.php?me########
- http://pr####tcourse.net/index.php?me########
- http://th###women.net/index.php?me########
- http://co####epaint.net/index.php?me########
- http://ch###course.net/index.php?me########
- http://co####eclean.net/index.php?me########
- http://ch###paint.net/index.php?me########
- http://se####different.net/index.php?me########
- http://th###clean.net/index.php?me########
- http://se####letter.net/index.php?me########
- http://qu####ifferent.net/index.php?me########
- http://pr####tpaint.net/index.php?me########
- http://th###course.net/index.php?me########
- http://pr####tclean.net/index.php?me########
- http://th###paint.net/index.php?me########
- http://al###women.net/index.php?me########
- http://mi###eclean.net/index.php?me########
- http://al###course.net/index.php?me########
- http://of###women.net/index.php?me########
- http://tw###epaint.net/index.php?me########
- http://mi####course.net/index.php?me########
- http://tw###eclean.net/index.php?me########
- http://mi###epaint.net/index.php?me########
- http://co####ewomen.net/index.php?me########
- http://of###clean.net/index.php?me########
- http://co####ecourse.net/index.php?me########
- http://ch###women.net/index.php?me########
- http://al###paint.net/index.php?me########
- http://of###course.net/index.php?me########
- http://al###clean.net/index.php?me########
- http://of###paint.net/index.php?me########
- http://qu###letter.net/index.php?me########
- http://st####different.net/index.php?me########
- http://tr####ifferent.net/index.php?me########
- http://st####letter.net/index.php?me########
- http://tr###letter.net/index.php?me########
- http://be####beside.net/index.php?me########
- http://ga####beside.net/index.php?me########
- http://be####surprise.net/index.php?me########
- http://ga####surprise.net/index.php?me########
- http://re####different.net/index.php?me########
- http://el#####cdifferent.net/index.php?me########
- http://re####letter.net/index.php?me########
- http://el####icletter.net/index.php?me########
- http://st####beside.net/index.php?me########
- http://tr###beside.net/index.php?me########
- http://st####surprise.net/index.php?me########
- http://tr####urprise.net/index.php?me########
- http://fl####ifferent.net/index.php?me########
- http://br####ifferent.net/index.php?me########
- http://fl###letter.net/index.php?me########
- http://br###letter.net/index.php?me########
- http://qu###beside.net/index.php?me########
- http://se####beside.net/index.php?me########
- http://qu####urprise.net/index.php?me########
- http://se####surprise.net/index.php?me########
- http://be####different.net/index.php?me########
- http://ga####different.net/index.php?me########
- http://be####letter.net/index.php?me########
- http://ga####letter.net/index.php?me########
- http://fl###beside.net/index.php?me########
- http://br###beside.net/index.php?me########
- http://fl####urprise.net/index.php?me########
- http://br####urprise.net/index.php?me########
UDP:
- DNS ASK pr####twomen.net
- DNS ASK ch###clean.net
- DNS ASK pr####tcourse.net
- DNS ASK th###women.net
- DNS ASK co####epaint.net
- DNS ASK ch###course.net
- DNS ASK co####eclean.net
- DNS ASK ch###paint.net
- DNS ASK se####different.net
- DNS ASK th###clean.net
- DNS ASK se####letter.net
- DNS ASK qu####ifferent.net
- DNS ASK pr####tpaint.net
- DNS ASK th###course.net
- DNS ASK pr####tclean.net
- DNS ASK th###paint.net
- DNS ASK co####ecourse.net
- DNS ASK mi###eclean.net
- DNS ASK tw###eclean.net
- DNS ASK of###women.net
- DNS ASK al###women.net
- DNS ASK mi####course.net
- DNS ASK tw####course.net
- DNS ASK mi###epaint.net
- DNS ASK tw###epaint.net
- DNS ASK of###clean.net
- DNS ASK al###clean.net
- DNS ASK ch###women.net
- DNS ASK co####ewomen.net
- DNS ASK of###course.net
- DNS ASK al###course.net
- DNS ASK of###paint.net
- DNS ASK al###paint.net
- DNS ASK st####different.net
- DNS ASK tr####ifferent.net
- DNS ASK st####letter.net
- DNS ASK tr###letter.net
- DNS ASK be####beside.net
- DNS ASK ga####beside.net
- DNS ASK be####surprise.net
- DNS ASK ga####surprise.net
- DNS ASK re####different.net
- DNS ASK el#####cdifferent.net
- DNS ASK re####letter.net
- DNS ASK el####icletter.net
- DNS ASK st####beside.net
- DNS ASK tr###beside.net
- DNS ASK st####surprise.net
- DNS ASK tr####urprise.net
- DNS ASK be####letter.net
- DNS ASK br####ifferent.net
- DNS ASK qu####urprise.net
- DNS ASK br###letter.net
- DNS ASK fl####ifferent.net
- DNS ASK se####beside.net
- DNS ASK qu###letter.net
- DNS ASK se####surprise.net
- DNS ASK qu###beside.net
- DNS ASK ga####different.net
- DNS ASK fl####urprise.net
- DNS ASK ga####letter.net
- DNS ASK be####different.net
- DNS ASK br###beside.net
- DNS ASK fl###letter.net
- DNS ASK br####urprise.net
- DNS ASK fl###beside.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
