Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Media Shadow Smart Bus WinHTTP IP Host SSDP' = 'C:\lwmsvyvj\pupmfjwqael.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\DHCP WWAN Background Font] 'ImagePath' = 'C:\lwmsvyvj\pupmfjwqael.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\DHCP WWAN Background Font] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\lwmsvyvj\gjywtlu.exe' "c:\lwmsvyvj\pupmfjwqael.exe"
- 'C:\lwmsvyvj\pupmfjwqael.exe'
- 'C:\lwmsvyvj\soyyf2nssfhb2xidg.exe'
Modifies file system:
Creates the following files:
- C:\lwmsvyvj\pupmfjwqael.exe
- C:\lwmsvyvj\gjywtlu.exe
- C:\lwmsvyvj\hs97wzd
- %WINDIR%\lwmsvyvj\ya5vloilr
- C:\lwmsvyvj\ya5vloilr
- C:\lwmsvyvj\soyyf2nssfhb2xidg.exe
Sets the 'hidden' attribute to the following files:
- C:\lwmsvyvj\gjywtlu.exe
- C:\lwmsvyvj\pupmfjwqael.exe
Deletes the following files:
- C:\lwmsvyvj\soyyf2nssfhb2xidg.exe
- %WINDIR%\lwmsvyvj\ya5vloilr
Substitutes the following files:
- %WINDIR%\lwmsvyvj\ya5vloilr
Network activity:
Connects to:
- 'ou####estudent.net':80
- 'mo####ntstudent.net':80
- 'ou####eproduce.net':80
- 'bu####ngbetween.net':80
- 'ev####gsucceed.net':80
- 'bu####ngsucceed.net':80
- 'mo####ntproduce.net':80
- 'mo####ntsucceed.net':80
- 'st###share.net':80
- 'st####thshare.net':80
- 'ou####ebetween.net':80
- 'mo####ntbetween.net':80
- 'ou####esucceed.net':80
- 'ev####gbetween.net':80
- 'mi####roduce.net':80
- 'st####roduce.net':80
- 'mi####etween.net':80
- 'do####succeed.net':80
- 'mi####tudent.net':80
- 'st####tudent.net':80
- 'st####etween.net':80
- 'bu####ngstudent.net':80
- 'ev####gproduce.net':80
- 'bu####ngproduce.net':80
- 'mi####ucceed.net':80
- 'st####ucceed.net':80
- 'ev####gstudent.net':80
- 'br###nshake.net':80
- 're####happen.net':80
- 'br####happen.net':80
- 're###tshare.net':80
- 'br###nshare.net':80
- 're###tshake.net':80
- 're####nearly.net':80
- 'do###eshake.net':80
- 'do####happen.net':80
- 'fe####happen.net':80
- 'br####nearly.net':80
- 'do###eshare.net':80
- 'fe###wshare.net':80
- 'pr####enearly.net':80
- 'st####thhappen.net':80
- 'st###nearly.net':80
- 'st####thnearly.net':80
- 'st###shake.net':80
- 'st####thshake.net':80
- 'st###happen.net':80
- 'de###eshare.net':80
- 'de####happen.net':80
- 'pr####ehappen.net':80
- 'de####nearly.net':80
- 'pr####eshare.net':80
- 'de###eshake.net':80
- 'pr####eshake.net':80
TCP:
HTTP GET requests:
- http://ou####estudent.net/index.php?me########
- http://mo####ntstudent.net/index.php?me########
- http://ou####eproduce.net/index.php?me########
- http://bu####ngbetween.net/index.php?me########
- http://ev####gsucceed.net/index.php?me########
- http://bu####ngsucceed.net/index.php?me########
- http://mo####ntproduce.net/index.php?me########
- http://mo####ntsucceed.net/index.php?me########
- http://st###share.net/index.php?me########
- http://st####thshare.net/index.php?me########
- http://ou####ebetween.net/index.php?me########
- http://mo####ntbetween.net/index.php?me########
- http://ou####esucceed.net/index.php?me########
- http://ev####gbetween.net/index.php?me########
- http://mi####roduce.net/index.php?me########
- http://st####roduce.net/index.php?me########
- http://mi####etween.net/index.php?me########
- http://do####succeed.net/index.php?me########
- http://mi####tudent.net/index.php?me########
- http://st####tudent.net/index.php?me########
- http://st####etween.net/index.php?me########
- http://bu####ngstudent.net/index.php?me########
- http://ev####gproduce.net/index.php?me########
- http://bu####ngproduce.net/index.php?me########
- http://mi####ucceed.net/index.php?me########
- http://st####ucceed.net/index.php?me########
- http://ev####gstudent.net/index.php?me########
- http://br###nshake.net/index.php?me########
- http://re####happen.net/index.php?me########
- http://br####happen.net/index.php?me########
- http://re###tshare.net/index.php?me########
- http://br###nshare.net/index.php?me########
- http://re###tshake.net/index.php?me########
- http://re####nearly.net/index.php?me########
- http://do###eshake.net/index.php?me########
- http://do####happen.net/index.php?me########
- http://fe####happen.net/index.php?me########
- http://br####nearly.net/index.php?me########
- http://do###eshare.net/index.php?me########
- http://fe###wshare.net/index.php?me########
- http://pr####enearly.net/index.php?me########
- http://st####thhappen.net/index.php?me########
- http://st###nearly.net/index.php?me########
- http://st####thnearly.net/index.php?me########
- http://st###shake.net/index.php?me########
- http://st####thshake.net/index.php?me########
- http://st###happen.net/index.php?me########
- http://de###eshare.net/index.php?me########
- http://de####happen.net/index.php?me########
- http://pr####ehappen.net/index.php?me########
- http://de####nearly.net/index.php?me########
- http://pr####eshare.net/index.php?me########
- http://de###eshake.net/index.php?me########
- http://pr####eshake.net/index.php?me########
UDP:
- DNS ASK ou####estudent.net
- DNS ASK mo####ntstudent.net
- DNS ASK ou####eproduce.net
- DNS ASK bu####ngsucceed.net
- DNS ASK ev####gbetween.net
- DNS ASK bu####ngbetween.net
- DNS ASK ev####gsucceed.net
- DNS ASK mo####ntsucceed.net
- DNS ASK st###share.net
- DNS ASK st####thshare.net
- DNS ASK ou####esucceed.net
- DNS ASK mo####ntproduce.net
- DNS ASK ou####ebetween.net
- DNS ASK mo####ntbetween.net
- DNS ASK mi####roduce.net
- DNS ASK st####roduce.net
- DNS ASK mi####etween.net
- DNS ASK st####tudent.net
- DNS ASK pr####succeed.net
- DNS ASK do####succeed.net
- DNS ASK mi####tudent.net
- DNS ASK bu####ngstudent.net
- DNS ASK ev####gproduce.net
- DNS ASK bu####ngproduce.net
- DNS ASK ev####gstudent.net
- DNS ASK st####etween.net
- DNS ASK mi####ucceed.net
- DNS ASK st####ucceed.net
- DNS ASK re####happen.net
- DNS ASK br####happen.net
- DNS ASK re####nearly.net
- DNS ASK br###nshake.net
- DNS ASK re###tshare.net
- DNS ASK br###nshare.net
- DNS ASK re###tshake.net
- DNS ASK fe###wshake.net
- DNS ASK do####happen.net
- DNS ASK fe####happen.net
- DNS ASK do###eshake.net
- DNS ASK br####nearly.net
- DNS ASK do###eshare.net
- DNS ASK fe###wshare.net
- DNS ASK st###nearly.net
- DNS ASK st####thnearly.net
- DNS ASK de###eshare.net
- DNS ASK st####thhappen.net
- DNS ASK st###shake.net
- DNS ASK st####thshake.net
- DNS ASK st###happen.net
- DNS ASK pr####ehappen.net
- DNS ASK de####nearly.net
- DNS ASK pr####enearly.net
- DNS ASK de####happen.net
- DNS ASK pr####eshare.net
- DNS ASK de###eshake.net
- DNS ASK pr####eshake.net
