Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,<LS_APPDATA>\jwaroevi\rarexsdb.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'RarExsdb' = '<LS_APPDATA>\jwaroevi\rarexsdb.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\rarexsdb.exe
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Security Center
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\ybfcuwpc.log
- <LS_APPDATA>\lawhwilb.log
- <LS_APPDATA>\jwaroevi\rarexsdb.exe
- %TEMP%\byjjjqlf.exe
- %TEMP%\ifqydaby.exe
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\rarexsdb.exe
Network activity:
Connects to:
- 'uw####uxharsm.com':443
- 'ch#####mftwldiucf.com':443
- 'gj###lwgk.com':443
- 'sx####frwwrq.com':443
- 'fp####cbmcdcyeu.com':443
- 'to#####txvnjtsaqdp.com':443
- 'us####ueaneumqx.com':443
- 'hs#####sussiiwuwyw.com':443
- '74.##5.232.51':80
- 'gh#####gujyymhvvg.com':443
- 'sw#####pvdbxsjos.com':443
- 'ri####qoyjjpb.com':443
UDP:
- DNS ASK qb####qcwnjkmr.com
- DNS ASK ic####cgagttje.com
- DNS ASK hu#####onchpgdijl.com
- DNS ASK ws###jeyiq.com
- DNS ASK bm####wgdvgmkrc.com
- DNS ASK yj####asoofsa.com
- DNS ASK cv####ivbgbqq.com
- DNS ASK mw###jrmdgk.com
- DNS ASK js#####vdexsonqm.com
- DNS ASK fc####yduoidnf.com
- DNS ASK ff#####yqgbvbmgonow.com
- DNS ASK du####tmcetwb.com
- DNS ASK wc#####qdaxduwyb.com
- DNS ASK kf#####uihnxkkjgcdw.com
- DNS ASK ja###hsgpv.com
- DNS ASK pm####ffhwtw.com
- DNS ASK bing.com
- DNS ASK rg####xarhehait.com
- DNS ASK mo###avh.com
- DNS ASK ce####jtvrqyoe.com
- DNS ASK fs###linhh.com
- DNS ASK ft#####qyhpeeqgioow.com
- DNS ASK ua###hhbwg.com
- DNS ASK yd####nmfuwbs.com
- DNS ASK pc####orttyw.com
- DNS ASK ru###vuufk.com
- DNS ASK lj#####xbuvkjcwuyyx.com
- DNS ASK to#####txvnjtsaqdp.com
- DNS ASK uw####uxharsm.com
- DNS ASK ch#####mftwldiucf.com
- DNS ASK ea####ndtxvub.com
- DNS ASK sx####frwwrq.com
- DNS ASK fp####cbmcdcyeu.com
- DNS ASK gj###lwgk.com
- DNS ASK us####ueaneumqx.com
- DNS ASK hs#####sussiiwuwyw.com
- DNS ASK google.com
- DNS ASK gh#####gujyymhvvg.com
- DNS ASK sw#####pvdbxsjos.com
- DNS ASK ri####qoyjjpb.com
- DNS ASK pf####bptnbxyk.com
- DNS ASK wq#####ucvawktbqx.com
- DNS ASK ty####xnmdpcukb.com
- DNS ASK lw#####qsoqbfspvvg.com
- DNS ASK hh####adcpxa.com
- DNS ASK lg####lajpthlt.com
- DNS ASK uf###ewmo.com
- DNS ASK ej###lri.com
- DNS ASK ca#####tbvnnadmly.com
- DNS ASK qd####alumvj.com
- DNS ASK xe####cieuxgr.com
- DNS ASK bn#####jibsrqvycxv.com
- DNS ASK ah#####utgpituoybn.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\byjjjqlf.exe'
Executes the following:
- '<SYSTEM32>\svchost.exe'
