Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PnP-X Microsoft Bus Wired Framework Reports' = 'C:\y1wzxyxcky\elxhbne.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Installer Protected Smart Procedure] 'ImagePath' = 'C:\y1wzxyxcky\elxhbne.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Installer Protected Smart Procedure] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\y1wzxyxcky\dsafuotjg.exe' "c:\y1wzxyxcky\elxhbne.exe"
- 'C:\y1wzxyxcky\elxhbne.exe'
- 'C:\y1wzxyxcky\nzqgdk7y2unqbhr7bcyd.exe'
Modifies file system:
Creates the following files:
- C:\y1wzxyxcky\elxhbne.exe
- C:\y1wzxyxcky\dsafuotjg.exe
- C:\y1wzxyxcky\vnzdfoyp
- %WINDIR%\y1wzxyxcky\hdsr16sdm
- C:\y1wzxyxcky\hdsr16sdm
- C:\y1wzxyxcky\nzqgdk7y2unqbhr7bcyd.exe
Sets the 'hidden' attribute to the following files:
- C:\y1wzxyxcky\dsafuotjg.exe
- C:\y1wzxyxcky\elxhbne.exe
Deletes the following files:
- C:\y1wzxyxcky\nzqgdk7y2unqbhr7bcyd.exe
- %WINDIR%\y1wzxyxcky\hdsr16sdm
Substitutes the following files:
- %WINDIR%\y1wzxyxcky\hdsr16sdm
Network activity:
Connects to:
- 'gw#####ynanderson.net':80
- 'je#####tebernadine.net':80
- 'ki#####eybernadine.net':80
- 'ha#####teanastacia.net':80
- 'gw#####ynanastacia.net':80
- 'ha#####teanderson.net':80
- 'je#####techarisma.net':80
- 'je#####teanderson.net':80
- 'ki#####eyanderson.net':80
- 'ma#####nebernadine.net':80
- 'ki#####eycharisma.net':80
- 'je#####teanastacia.net':80
- 'ki#####eyanastacia.net':80
- 'ka#####nacharisma.net':80
- 'br#####nncharisma.net':80
- 'ka#####naanastacia.net':80
- 'sy#####eranderson.net':80
- 'ka#####nabernadine.net':80
- 'br#####nnbernadine.net':80
- 'br#####nnanastacia.net':80
- 'gw#####ynbernadine.net':80
- 'ha#####techarisma.net':80
- 'gw#####yncharisma.net':80
- 'ka#####naanderson.net':80
- 'br#####nnanderson.net':80
- 'ha#####tebernadine.net':80
TCP:
HTTP GET requests:
- http://gw#####ynanderson.net/index.php
- http://je#####tebernadine.net/index.php
- http://ki#####eybernadine.net/index.php
- http://ha#####teanastacia.net/index.php
- http://gw#####ynanastacia.net/index.php
- http://ha#####teanderson.net/index.php
- http://je#####techarisma.net/index.php
- http://je#####teanderson.net/index.php
- http://ki#####eyanderson.net/index.php
- http://ma#####nebernadine.net/index.php
- http://ki#####eycharisma.net/index.php
- http://je#####teanastacia.net/index.php
- http://ki#####eyanastacia.net/index.php
- http://ka#####nacharisma.net/index.php
- http://br#####nncharisma.net/index.php
- http://ka#####naanastacia.net/index.php
- http://sy#####eranderson.net/index.php
- http://ka#####nabernadine.net/index.php
- http://br#####nnbernadine.net/index.php
- http://br#####nnanastacia.net/index.php
- http://gw#####ynbernadine.net/index.php
- http://ha#####techarisma.net/index.php
- http://gw#####yncharisma.net/index.php
- http://ka#####naanderson.net/index.php
- http://br#####nnanderson.net/index.php
- http://ha#####tebernadine.net/index.php
UDP:
- DNS ASK je#####tebernadine.net
- DNS ASK ki#####eybernadine.net
- DNS ASK je#####techarisma.net
- DNS ASK gw#####ynanastacia.net
- DNS ASK ha#####teanderson.net
- DNS ASK gw#####ynanderson.net
- DNS ASK ki#####eycharisma.net
- DNS ASK ki#####eyanderson.net
- DNS ASK ma#####nebernadine.net
- DNS ASK gr#####lebernadine.net
- DNS ASK je#####teanastacia.net
- DNS ASK ki#####eyanastacia.net
- DNS ASK je#####teanderson.net
- DNS ASK ha#####teanastacia.net
- DNS ASK ka#####nacharisma.net
- DNS ASK br#####nncharisma.net
- DNS ASK ka#####naanastacia.net
- DNS ASK sy#####eranderson.net
- DNS ASK ka#####nabernadine.net
- DNS ASK br#####nnbernadine.net
- DNS ASK br#####nnanastacia.net
- DNS ASK gw#####ynbernadine.net
- DNS ASK ha#####techarisma.net
- DNS ASK gw#####yncharisma.net
- DNS ASK ka#####naanderson.net
- DNS ASK br#####nnanderson.net
- DNS ASK ha#####tebernadine.net
