Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Experience Engine Play Adaptive Human Level' = 'C:\vxtp96hgk\yz54hbl.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Manager Connections Endpoint Socket] 'ImagePath' = 'C:\vxtp96hgk\yz54hbl.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Manager Connections Endpoint Socket] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- C:\vxtp96hgk\yz54hbl.exe
- C:\vxtp96hgk\xn5qokez5e.exe
- C:\vxtp96hgk\wulghrf
- %WINDIR%\vxtp96hgk\o3awr01qrvxq
- C:\vxtp96hgk\o3awr01qrvxq
- C:\vxtp96hgk\ygyxdb2gczzyggexbchbn.exe
Sets the 'hidden' attribute to the following files:
- C:\vxtp96hgk\xn5qokez5e.exe
- C:\vxtp96hgk\yz54hbl.exe
Deletes the following files:
- C:\vxtp96hgk\ygyxdb2gczzyggexbchbn.exe
- %WINDIR%\vxtp96hgk\o3awr01qrvxq
Substitutes the following files:
- %WINDIR%\vxtp96hgk\o3awr01qrvxq
Network activity:
Connects to:
- 'se#####ancharisma.net':80
- 'ch#####nacharisma.net':80
- 'se#####ananastacia.net':80
- 'ch#####naanastacia.net':80
- 'se#####anbernadine.net':80
- 'de#####sttennyson.net':80
- 'la#####iamillicent.net':80
- 'ch#####nabernadine.net':80
- 'la#####iatennyson.net':80
- 'ch#####naanderson.net':80
- 'cl#####ndanastacia.net':80
- 'ch#####neanastacia.net':80
- 'cl#####ndanderson.net':80
- 'ch#####neanderson.net':80
- 'cl#####ndcharisma.net':80
- 'ch#####nebernadine.net':80
- 'se#####ananderson.net':80
- 'ch#####necharisma.net':80
- 'cl#####ndbernadine.net':80
- 'de#####stmillicent.net':80
- 'ka#####ratennyson.net':80
- 'ch#####tatennyson.net':80
- 'pr#####laernestine.net':80
- 'ma#####anernestine.net':80
- 'ka#####ramillicent.net':80
- 'ch#####tachastity.net':80
- 'ka#####raernestine.net':80
- 'ch#####tamillicent.net':80
- 'ka#####rachastity.net':80
- 'ma#####anchastity.net':80
- 'la#####iaernestine.net':80
- 'de#####sternestine.net':80
- 'la#####iachastity.net':80
- 'de#####stchastity.net':80
- 'pr#####latennyson.net':80
- 'ma#####anmillicent.net':80
- 'pr#####lachastity.net':80
- 'ma#####antennyson.net':80
- 'pr#####lamillicent.net':80
TCP:
HTTP GET requests:
- http://se#####ancharisma.net/index.php
- http://ch#####nacharisma.net/index.php
- http://se#####ananastacia.net/index.php
- http://ch#####naanastacia.net/index.php
- http://se#####anbernadine.net/index.php
- http://de#####sttennyson.net/index.php
- http://la#####iamillicent.net/index.php
- http://ch#####nabernadine.net/index.php
- http://la#####iatennyson.net/index.php
- http://ch#####naanderson.net/index.php
- http://cl#####ndanastacia.net/index.php
- http://ch#####neanastacia.net/index.php
- http://cl#####ndanderson.net/index.php
- http://ch#####neanderson.net/index.php
- http://cl#####ndcharisma.net/index.php
- http://ch#####nebernadine.net/index.php
- http://se#####ananderson.net/index.php
- http://ch#####necharisma.net/index.php
- http://cl#####ndbernadine.net/index.php
- http://de#####stmillicent.net/index.php
- http://ka#####ratennyson.net/index.php
- http://ch#####tatennyson.net/index.php
- http://pr#####laernestine.net/index.php
- http://ma#####anernestine.net/index.php
- http://ka#####ramillicent.net/index.php
- http://ch#####tachastity.net/index.php
- http://ka#####raernestine.net/index.php
- http://ch#####tamillicent.net/index.php
- http://ka#####rachastity.net/index.php
- http://ma#####anchastity.net/index.php
- http://la#####iaernestine.net/index.php
- http://de#####sternestine.net/index.php
- http://la#####iachastity.net/index.php
- http://de#####stchastity.net/index.php
- http://pr#####latennyson.net/index.php
- http://ma#####anmillicent.net/index.php
- http://pr#####lachastity.net/index.php
- http://ma#####antennyson.net/index.php
- http://pr#####lamillicent.net/index.php
UDP:
- DNS ASK se#####ancharisma.net
- DNS ASK ch#####nacharisma.net
- DNS ASK ch#####naanastacia.net
- DNS ASK ch#####naanderson.net
- DNS ASK se#####ananastacia.net
- DNS ASK de#####sttennyson.net
- DNS ASK la#####iamillicent.net
- DNS ASK la#####iatennyson.net
- DNS ASK se#####anbernadine.net
- DNS ASK ch#####nabernadine.net
- DNS ASK cl#####ndanastacia.net
- DNS ASK ch#####neanastacia.net
- DNS ASK ch#####neanderson.net
- DNS ASK cr#####onbernadine.net
- DNS ASK cl#####ndanderson.net
- DNS ASK ch#####nebernadine.net
- DNS ASK se#####ananderson.net
- DNS ASK cl#####ndbernadine.net
- DNS ASK cl#####ndcharisma.net
- DNS ASK ch#####necharisma.net
- DNS ASK ka#####ratennyson.net
- DNS ASK ch#####tatennyson.net
- DNS ASK ma#####anernestine.net
- DNS ASK ma#####anchastity.net
- DNS ASK pr#####laernestine.net
- DNS ASK ch#####tachastity.net
- DNS ASK ka#####raernestine.net
- DNS ASK ka#####rachastity.net
- DNS ASK ka#####ramillicent.net
- DNS ASK ch#####tamillicent.net
- DNS ASK la#####iaernestine.net
- DNS ASK de#####sternestine.net
- DNS ASK de#####stchastity.net
- DNS ASK de#####stmillicent.net
- DNS ASK la#####iachastity.net
- DNS ASK ma#####anmillicent.net
- DNS ASK pr#####lachastity.net
- DNS ASK pr#####lamillicent.net
- DNS ASK pr#####latennyson.net
- DNS ASK ma#####antennyson.net
Miscellaneous:
Creates and executes the following:
- 'C:\vxtp96hgk\xn5qokez5e.exe' "c:\vxtp96hgk\yz54hbl.exe"
- 'C:\vxtp96hgk\yz54hbl.exe'
- 'C:\vxtp96hgk\ygyxdb2gczzyggexbchbn.exe'
