Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Client Auto Procedure Software Now DHCP Shell' = 'C:\u2lmymfozfgvw\f7ylkngvked.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\File COM Instrumentation Protected] 'ImagePath' = 'C:\u2lmymfozfgvw\f7ylkngvked.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\File COM Instrumentation Protected] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\u2lmymfozfgvw\siqbiariyox.exe' "c:\u2lmymfozfgvw\f7ylkngvked.exe"
- 'C:\u2lmymfozfgvw\f7ylkngvked.exe'
- 'C:\u2lmymfozfgvw\ov2xsjx2rgadhkr9klvyk.exe'
Modifies file system:
Creates the following files:
- C:\u2lmymfozfgvw\f7ylkngvked.exe
- C:\u2lmymfozfgvw\siqbiariyox.exe
- C:\u2lmymfozfgvw\oanqiitf8q
- %WINDIR%\u2lmymfozfgvw\vzgurziijj4f
- C:\u2lmymfozfgvw\vzgurziijj4f
- C:\u2lmymfozfgvw\ov2xsjx2rgadhkr9klvyk.exe
Sets the 'hidden' attribute to the following files:
- C:\u2lmymfozfgvw\siqbiariyox.exe
- C:\u2lmymfozfgvw\f7ylkngvked.exe
Deletes the following files:
- C:\u2lmymfozfgvw\ov2xsjx2rgadhkr9klvyk.exe
- %WINDIR%\u2lmymfozfgvw\vzgurziijj4f
Network activity:
Connects to:
- 'ki######ighfrederica.net':80
- 'be#####ttefrederica.net':80
- 'ki######ighpleasance.net':80
- 'be#####ttepleasance.net':80
- 'ki#####eighbertrand.net':80
- 'be#####ttebertrand.net':80
- 'ki######ighphilander.net':80
- 'be#####ttephilander.net':80
- 'al#####riabertrand.net':80
- 'al#####riapleasance.net':80
- 'ch######ellefrederica.net':80
- 'la#####iarowbottom.net':80
- 'ch######ellepleasance.net':80
- 'al#####riaphilander.net':80
- 'ch######ellebertrand.net':80
- 'al#####riafrederica.net':80
- 'ch######ellephilander.net':80
- 'ja#####inefrederica.net':80
- 'ge#####nnaphilander.net':80
- 'ja#####inepleasance.net':80
- 'ge#####nnafrederica.net':80
- 'ja#####inebertrand.net':80
- 'ch######nnepleasance.net':80
- 'ja#####inephilander.net':80
- 'ge#####nnabertrand.net':80
- 'ge#####nnapleasance.net':80
- 'ch#####belfrederica.net':80
- 're#####nnefrederica.net':80
- 'ch#####belpleasance.net':80
- 're#####nnepleasance.net':80
- 'ch#####belbertrand.net':80
- 're#####nnebertrand.net':80
- 'ch#####belphilander.net':80
- 're#####nnephilander.net':80
- 'de#####strowbottom.net':80
- 'co#####cerowbottom.net':80
- 'ch#####tagranville.net':80
- 'co#####cecarpenter.net':80
- 'ha#####tarowbottom.net':80
- 'ka#####rarupertson.net':80
- 'ch#####tacarpenter.net':80
- 'ka#####ragranville.net':80
- 'ch#####tarupertson.net':80
- 'ha#####tacarpenter.net':80
- 'ro#####nerowbottom.net':80
- 'ja#####tarowbottom.net':80
- 'ro#####necarpenter.net':80
- 'ja#####tacarpenter.net':80
- 'ha#####tarupertson.net':80
- 'co#####cerupertson.net':80
- 'ha#####tagranville.net':80
- 'co#####cegranville.net':80
- 'de#####stgranville.net':80
- 'la#####iagranville.net':80
- 'ma#####anrowbottom.net':80
- 'pr#####larowbottom.net':80
- 'de#####stcarpenter.net':80
- 'la#####iacarpenter.net':80
- 'de#####strupertson.net':80
- 'la#####iarupertson.net':80
- 'pr#####lacarpenter.net':80
- 'ka#####rarowbottom.net':80
- 'ma#####angranville.net':80
- 'ka#####racarpenter.net':80
- 'ch#####tarowbottom.net':80
- 'pr#####larupertson.net':80
- 'ma#####ancarpenter.net':80
- 'pr#####lagranville.net':80
- 'ma#####anrupertson.net':80
TCP:
HTTP GET requests:
- http://ki######ighfrederica.net/index.php
- http://be#####ttefrederica.net/index.php
- http://ki######ighpleasance.net/index.php
- http://be#####ttepleasance.net/index.php
- http://ki#####eighbertrand.net/index.php
- http://be#####ttebertrand.net/index.php
- http://ki######ighphilander.net/index.php
- http://be#####ttephilander.net/index.php
- http://al#####riabertrand.net/index.php
- http://al#####riapleasance.net/index.php
- http://ch######ellefrederica.net/index.php
- http://la#####iarowbottom.net/index.php
- http://ch######ellepleasance.net/index.php
- http://al#####riaphilander.net/index.php
- http://ch######ellebertrand.net/index.php
- http://al#####riafrederica.net/index.php
- http://ch######ellephilander.net/index.php
- http://ja#####inefrederica.net/index.php
- http://ge#####nnaphilander.net/index.php
- http://ja#####inepleasance.net/index.php
- http://ge#####nnafrederica.net/index.php
- http://ja#####inebertrand.net/index.php
- http://ch######nnepleasance.net/index.php
- http://ja#####inephilander.net/index.php
- http://ge#####nnabertrand.net/index.php
- http://ge#####nnapleasance.net/index.php
- http://ch#####belfrederica.net/index.php
- http://re#####nnefrederica.net/index.php
- http://ch#####belpleasance.net/index.php
- http://re#####nnepleasance.net/index.php
- http://ch#####belbertrand.net/index.php
- http://re#####nnebertrand.net/index.php
- http://ch#####belphilander.net/index.php
- http://re#####nnephilander.net/index.php
- http://de#####strowbottom.net/index.php
- http://co#####cerowbottom.net/index.php
- http://ch#####tagranville.net/index.php
- http://co#####cecarpenter.net/index.php
- http://ha#####tarowbottom.net/index.php
- http://ka#####rarupertson.net/index.php
- http://ch#####tacarpenter.net/index.php
- http://ka#####ragranville.net/index.php
- http://ch#####tarupertson.net/index.php
- http://ha#####tacarpenter.net/index.php
- http://ro#####nerowbottom.net/index.php
- http://ja#####tarowbottom.net/index.php
- http://ro#####necarpenter.net/index.php
- http://ja#####tacarpenter.net/index.php
- http://ha#####tarupertson.net/index.php
- http://co#####cerupertson.net/index.php
- http://ha#####tagranville.net/index.php
- http://co#####cegranville.net/index.php
- http://de#####stgranville.net/index.php
- http://la#####iagranville.net/index.php
- http://ma#####anrowbottom.net/index.php
- http://pr#####larowbottom.net/index.php
- http://de#####stcarpenter.net/index.php
- http://la#####iacarpenter.net/index.php
- http://de#####strupertson.net/index.php
- http://la#####iarupertson.net/index.php
- http://pr#####lacarpenter.net/index.php
- http://ka#####rarowbottom.net/index.php
- http://ma#####angranville.net/index.php
- http://ka#####racarpenter.net/index.php
- http://ch#####tarowbottom.net/index.php
- http://pr#####larupertson.net/index.php
- http://ma#####ancarpenter.net/index.php
- http://pr#####lagranville.net/index.php
- http://ma#####anrupertson.net/index.php
UDP:
- DNS ASK ki######ighfrederica.net
- DNS ASK be#####ttefrederica.net
- DNS ASK ki######ighpleasance.net
- DNS ASK be#####ttepleasance.net
- DNS ASK ki#####eighbertrand.net
- DNS ASK be#####ttebertrand.net
- DNS ASK ki######ighphilander.net
- DNS ASK be#####ttephilander.net
- DNS ASK al#####riabertrand.net
- DNS ASK al#####riapleasance.net
- DNS ASK ch######ellefrederica.net
- DNS ASK la#####iarowbottom.net
- DNS ASK ch######ellepleasance.net
- DNS ASK al#####riaphilander.net
- DNS ASK ch######ellebertrand.net
- DNS ASK al#####riafrederica.net
- DNS ASK ch######ellephilander.net
- DNS ASK ch#####belpleasance.net
- DNS ASK ge#####nnaphilander.net
- DNS ASK ja#####inephilander.net
- DNS ASK ge#####nnafrederica.net
- DNS ASK ja#####inefrederica.net
- DNS ASK ch######nnepleasance.net
- DNS ASK ma#####ttapleasance.net
- DNS ASK ge#####nnabertrand.net
- DNS ASK ja#####inebertrand.net
- DNS ASK ja#####inepleasance.net
- DNS ASK re#####nnefrederica.net
- DNS ASK ch#####belphilander.net
- DNS ASK re#####nnepleasance.net
- DNS ASK ch#####belfrederica.net
- DNS ASK re#####nnebertrand.net
- DNS ASK ge#####nnapleasance.net
- DNS ASK re#####nnephilander.net
- DNS ASK ch#####belbertrand.net
- DNS ASK co#####cerowbottom.net
- DNS ASK ch#####tagranville.net
- DNS ASK co#####cecarpenter.net
- DNS ASK ha#####tarowbottom.net
- DNS ASK ka#####rarupertson.net
- DNS ASK ch#####tacarpenter.net
- DNS ASK ka#####ragranville.net
- DNS ASK ch#####tarupertson.net
- DNS ASK ha#####tacarpenter.net
- DNS ASK ro#####nerowbottom.net
- DNS ASK ja#####tarowbottom.net
- DNS ASK ro#####necarpenter.net
- DNS ASK ja#####tacarpenter.net
- DNS ASK ha#####tarupertson.net
- DNS ASK co#####cerupertson.net
- DNS ASK ha#####tagranville.net
- DNS ASK co#####cegranville.net
- DNS ASK ka#####racarpenter.net
- DNS ASK la#####iagranville.net
- DNS ASK de#####strupertson.net
- DNS ASK pr#####larowbottom.net
- DNS ASK de#####stgranville.net
- DNS ASK la#####iacarpenter.net
- DNS ASK de#####strowbottom.net
- DNS ASK la#####iarupertson.net
- DNS ASK de#####stcarpenter.net
- DNS ASK ma#####anrowbottom.net
- DNS ASK ma#####angranville.net
- DNS ASK pr#####lagranville.net
- DNS ASK ch#####tarowbottom.net
- DNS ASK ka#####rarowbottom.net
- DNS ASK ma#####ancarpenter.net
- DNS ASK pr#####lacarpenter.net
- DNS ASK ma#####anrupertson.net
- DNS ASK pr#####larupertson.net
