Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Credential Play Panel Windows Group' = 'C:\srkbloa\iepxedjxcev4.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Shadow Software Office WebClient Workstation] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Shadow Software Office WebClient Workstation] 'ImagePath' = 'C:\srkbloa\iepxedjxcev4.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\srkbloa\zm9yac
- C:\srkbloa\zm9yac
- C:\srkbloa\tpchth2hwzcuu0fuorsc.exe
- C:\srkbloa\iepxedjxcev4.exe
- C:\srkbloa\rk6yyxx.exe
- C:\srkbloa\ber2jhffqizj
Sets the 'hidden' attribute to the following files:
- C:\srkbloa\iepxedjxcev4.exe
- C:\srkbloa\rk6yyxx.exe
Deletes the following files:
- %WINDIR%\srkbloa\zm9yac
- C:\srkbloa\tpchth2hwzcuu0fuorsc.exe
Substitutes the following files:
- %WINDIR%\srkbloa\zm9yac
Network activity:
Connects to:
- 'za#####ahethelbert.net':80
- 'al#####ercharnette.net':80
- 'ka#####nekingsley.net':80
- 'al#####erkingsley.net':80
- 'ka#####neanastasia.net':80
- 'al#####eranastasia.net':80
- 'ka#####neandriana.net':80
- 'al#####erandriana.net':80
- 'ma#####nacharnette.net':80
- 'al#####racharnette.net':80
- 'ma#####nakingsley.net':80
- 'al#####rakingsley.net':80
- 'ma#####naanastasia.net':80
- 'al#####raanastasia.net':80
- 'ma#####naandriana.net':80
- 'al#####raandriana.net':80
- 'am#####necharnette.net':80
- 'ce#####necharnette.net':80
- 'am#####nekingsley.net':80
- 'ce#####nekingsley.net':80
- 'am#####neanastasia.net':80
- 'ce#####neanastasia.net':80
- 'am#####neandriana.net':80
- 'ce#####neandriana.net':80
- 'ch#####necharnette.net':80
- 'sh#####lecharnette.net':80
- 'ch#####nekingsley.net':80
- 'sh#####lekingsley.net':80
- 'ka#####necharnette.net':80
- 'ch#####neanastasia.net':80
- 'ch#####antatianna.net':80
- 'ch#####anmichelyne.net':80
- 'ar#####ldsherwood.net':80
- 'za#####ahsherwood.net':80
- 'ar#####ldmichelyne.net':80
- 'za#####ahmichelyne.net':80
- 'ar#####ldtatianna.net':80
- 'za#####ahtatianna.net':80
- 'ge#####naethelbert.net':80
- 'ch#####leethelbert.net':80
- 'ge#####nasherwood.net':80
- 'ch#####lesherwood.net':80
- 'ge#####namichelyne.net':80
- 'ch#####lemichelyne.net':80
- 'ge#####natatianna.net':80
- 'ch#####letatianna.net':80
- 'an#####leethelbert.net':80
- 'gu#####enethelbert.net':80
- 'an#####lesherwood.net':80
- 'gu#####ensherwood.net':80
- 'an#####lemichelyne.net':80
- 'gu#####enmichelyne.net':80
- 'an#####letatianna.net':80
- 'gu#####entatianna.net':80
- 'gw#####reethelbert.net':80
- 'ch#####anethelbert.net':80
- 'gw#####resherwood.net':80
- 'ch#####ansherwood.net':80
- 'gw#####remichelyne.net':80
- 'gw#####retatianna.net':80
- 'sh#####leanastasia.net':80
TCP:
HTTP GET requests:
- http://za#####ahethelbert.net/index.php
- http://al#####ercharnette.net/index.php
- http://ka#####nekingsley.net/index.php
- http://al#####erkingsley.net/index.php
- http://ka#####neanastasia.net/index.php
- http://al#####eranastasia.net/index.php
- http://ka#####neandriana.net/index.php
- http://al#####erandriana.net/index.php
- http://ma#####nacharnette.net/index.php
- http://al#####racharnette.net/index.php
- http://ma#####nakingsley.net/index.php
- http://al#####rakingsley.net/index.php
- http://ma#####naanastasia.net/index.php
- http://al#####raanastasia.net/index.php
- http://ma#####naandriana.net/index.php
- http://al#####raandriana.net/index.php
- http://am#####necharnette.net/index.php
- http://ce#####necharnette.net/index.php
- http://am#####nekingsley.net/index.php
- http://ce#####nekingsley.net/index.php
- http://am#####neanastasia.net/index.php
- http://ce#####neanastasia.net/index.php
- http://am#####neandriana.net/index.php
- http://ce#####neandriana.net/index.php
- http://ch#####necharnette.net/index.php
- http://sh#####lecharnette.net/index.php
- http://ch#####nekingsley.net/index.php
- http://sh#####lekingsley.net/index.php
- http://ka#####necharnette.net/index.php
- http://ch#####neanastasia.net/index.php
- http://ch#####antatianna.net/index.php
- http://ch#####anmichelyne.net/index.php
- http://ar#####ldsherwood.net/index.php
- http://za#####ahsherwood.net/index.php
- http://ar#####ldmichelyne.net/index.php
- http://za#####ahmichelyne.net/index.php
- http://ar#####ldtatianna.net/index.php
- http://za#####ahtatianna.net/index.php
- http://ge#####naethelbert.net/index.php
- http://ch#####leethelbert.net/index.php
- http://ge#####nasherwood.net/index.php
- http://ch#####lesherwood.net/index.php
- http://ge#####namichelyne.net/index.php
- http://ch#####lemichelyne.net/index.php
- http://ge#####natatianna.net/index.php
- http://ch#####letatianna.net/index.php
- http://an#####leethelbert.net/index.php
- http://gu#####enethelbert.net/index.php
- http://an#####lesherwood.net/index.php
- http://gu#####ensherwood.net/index.php
- http://an#####lemichelyne.net/index.php
- http://gu#####enmichelyne.net/index.php
- http://an#####letatianna.net/index.php
- http://gu#####entatianna.net/index.php
- http://gw#####reethelbert.net/index.php
- http://ch#####anethelbert.net/index.php
- http://gw#####resherwood.net/index.php
- http://ch#####ansherwood.net/index.php
- http://gw#####remichelyne.net/index.php
- http://gw#####retatianna.net/index.php
- http://sh#####leanastasia.net/index.php
UDP:
- DNS ASK za#####ahethelbert.net
- DNS ASK al#####ercharnette.net
- DNS ASK ka#####nekingsley.net
- DNS ASK al#####erkingsley.net
- DNS ASK ka#####neanastasia.net
- DNS ASK al#####eranastasia.net
- DNS ASK ka#####neandriana.net
- DNS ASK al#####erandriana.net
- DNS ASK ma#####nacharnette.net
- DNS ASK al#####racharnette.net
- DNS ASK ma#####nakingsley.net
- DNS ASK al#####rakingsley.net
- DNS ASK ma#####naanastasia.net
- DNS ASK al#####raanastasia.net
- DNS ASK ma#####naandriana.net
- DNS ASK al#####raandriana.net
- DNS ASK am#####necharnette.net
- DNS ASK ce#####necharnette.net
- DNS ASK am#####nekingsley.net
- DNS ASK ce#####nekingsley.net
- DNS ASK am#####neanastasia.net
- DNS ASK ce#####neanastasia.net
- DNS ASK am#####neandriana.net
- DNS ASK ce#####neandriana.net
- DNS ASK ch#####necharnette.net
- DNS ASK sh#####lecharnette.net
- DNS ASK ch#####nekingsley.net
- DNS ASK sh#####lekingsley.net
- DNS ASK ka#####necharnette.net
- DNS ASK ch#####neanastasia.net
- DNS ASK ch#####antatianna.net
- DNS ASK ch#####anmichelyne.net
- DNS ASK ar#####ldsherwood.net
- DNS ASK za#####ahsherwood.net
- DNS ASK ar#####ldmichelyne.net
- DNS ASK za#####ahmichelyne.net
- DNS ASK ar#####ldtatianna.net
- DNS ASK za#####ahtatianna.net
- DNS ASK ge#####naethelbert.net
- DNS ASK ch#####leethelbert.net
- DNS ASK ge#####nasherwood.net
- DNS ASK ch#####lesherwood.net
- DNS ASK ge#####namichelyne.net
- DNS ASK ch#####lemichelyne.net
- DNS ASK ge#####natatianna.net
- DNS ASK ch#####letatianna.net
- DNS ASK an#####leethelbert.net
- DNS ASK gu#####enethelbert.net
- DNS ASK an#####lesherwood.net
- DNS ASK gu#####ensherwood.net
- DNS ASK an#####lemichelyne.net
- DNS ASK gu#####enmichelyne.net
- DNS ASK an#####letatianna.net
- DNS ASK gu#####entatianna.net
- DNS ASK gw#####reethelbert.net
- DNS ASK ch#####anethelbert.net
- DNS ASK gw#####resherwood.net
- DNS ASK ch#####ansherwood.net
- DNS ASK gw#####remichelyne.net
- DNS ASK gw#####retatianna.net
- DNS ASK sh#####leanastasia.net
Miscellaneous:
Creates and executes the following:
- 'C:\srkbloa\tpchth2hwzcuu0fuorsc.exe'
- 'C:\srkbloa\iepxedjxcev4.exe'
- 'C:\srkbloa\rk6yyxx.exe' "c:\srkbloa\iepxedjxcev4.exe"
