Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Backup Debugger UserMode Driver Interactive] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Backup Debugger UserMode Driver Interactive] 'ImagePath' = 'C:\ejzfyojyxmm\bmqmglyqqfz.exe'
Creates the following services
- 'Backup Debugger UserMode Driver Interactive' C:\ejzfyojyxmm\bmqmglyqqfz.exe
Modifies file system
Creates the following files
- %WINDIR%\ejzfyojyxmm\adrmu5cluif
- C:\ejzfyojyxmm\adrmu5cluif
- C:\ejzfyojyxmm\bxjnsku3hsdyrymqyt.exe
- C:\ejzfyojyxmm\bmqmglyqqfz.exe
- C:\ejzfyojyxmm\ugsaxez.exe
Sets the 'hidden' attribute to the following files
- C:\ejzfyojyxmm\bmqmglyqqfz.exe
- C:\ejzfyojyxmm\ugsaxez.exe
Deletes the following files
- %WINDIR%\ejzfyojyxmm\adrmu5cluif
- C:\ejzfyojyxmm\bxjnsku3hsdyrymqyt.exe
Substitutes the following files
- %WINDIR%\ejzfyojyxmm\adrmu5cluif
Network activity
Connects to
- 'br####beauty.net':80
- 'de####garden.net':80
- 'st####thbeauty.net':80
- 'ou####emillion.net':80
- 'st####illion.net':80
- 'do###rwhite.net':80
- 'do####pleasure.net':80
- 're####pleasure.net':80
- 'st####thwhite.net':80
- 'st###white.net':80
- 'bu####ngperfect.net':80
- 'pr####perfect.net':80
- 'do###rmayor.net':80
TCP
HTTP GET requests
- http://br####beauty.net/index.php
- http://de####garden.net/index.php
- http://st####thbeauty.net/index.php
- http://ou####emillion.net/index.php
- http://st####illion.net/index.php
- http://do###rwhite.net/index.php
- http://do####pleasure.net/index.php
- http://re####pleasure.net/index.php
- http://st####thwhite.net/index.php
- http://st###white.net/index.php
- http://pr####perfect.net/index.php
- http://do###rmayor.net/index.php
UDP
- DNS ASK re####report.net
- DNS ASK mo####ntbattle.net
- DNS ASK ou####emayor.net
- DNS ASK mo####ntmayor.net
- DNS ASK ou####eperfect.net
- DNS ASK mo####ntperfect.net
- DNS ASK ou####eheart.net
- DNS ASK mo####ntheart.net
- DNS ASK st####thwhite.net
- DNS ASK st####thmillion.net
- DNS ASK st#####hpleasure.net
- DNS ASK st####thtoward.net
- DNS ASK de###ewhite.net
- DNS ASK pr####ewhite.net
- DNS ASK de####million.net
- DNS ASK pr####emillion.net
- DNS ASK de####pleasure.net
- DNS ASK pr####epleasure.net
- DNS ASK de####toward.net
- DNS ASK pr####etoward.net
- DNS ASK re###twhite.net
- DNS ASK br###nwhite.net
- DNS ASK re####million.net
- DNS ASK br####million.net
- DNS ASK re####pleasure.net
- DNS ASK br####pleasure.net
- DNS ASK ou####ebattle.net
- DNS ASK bu####ngheart.net
- DNS ASK ev####gheart.net
- DNS ASK bu####ngperfect.net
- DNS ASK do###emayor.net
- DNS ASK fe###wmayor.net
- DNS ASK fe####perfect.net
- DNS ASK do###eheart.net
- DNS ASK fe###wheart.net
- DNS ASK pr####battle.net
- DNS ASK do####battle.net
- DNS ASK pr###ymayor.net
- DNS ASK do###rmayor.net
- DNS ASK pr####perfect.net
- DNS ASK do####perfect.net
- DNS ASK pr###yheart.net
- DNS ASK mi###battle.net
- DNS ASK do###rheart.net
- DNS ASK st###battle.net
- DNS ASK mi###mayor.net
- DNS ASK st###mayor.net
- DNS ASK mi####erfect.net
- DNS ASK st####erfect.net
- DNS ASK mi###heart.net
- DNS ASK st###heart.net
- DNS ASK ev####gbattle.net
- DNS ASK bu####ngbattle.net
- DNS ASK ev####gmayor.net
- DNS ASK bu####ngmayor.net
- DNS ASK ev####gperfect.net
- DNS ASK fe####battle.net
- DNS ASK re####toward.net
- DNS ASK br####toward.net
- DNS ASK do###ewhite.net
- DNS ASK mo####ntmillion.net
- DNS ASK ou####epleasure.net
- DNS ASK mo#####tpleasure.net
- DNS ASK ou####etoward.net
- DNS ASK mo####nttoward.net
- DNS ASK st###garden.net
- DNS ASK st####thgarden.net
- DNS ASK st###beauty.net
- DNS ASK st####thbeauty.net
- DNS ASK st###report.net
- DNS ASK st####threport.net
- DNS ASK st###market.net
- DNS ASK st####thmarket.net
- DNS ASK de####garden.net
- DNS ASK pr####egarden.net
- DNS ASK de####beauty.net
- DNS ASK pr####ebeauty.net
- DNS ASK de####report.net
- DNS ASK pr####ereport.net
- DNS ASK de####market.net
- DNS ASK pr####emarket.net
- DNS ASK re####garden.net
- DNS ASK br####garden.net
- DNS ASK re####beauty.net
- DNS ASK br####beauty.net
- DNS ASK ou####emillion.net
- DNS ASK mo####ntwhite.net
- DNS ASK ou####ewhite.net
- DNS ASK bu####ngtoward.net
- DNS ASK fe####million.net
- DNS ASK fe####pleasure.net
- DNS ASK fe####toward.net
- DNS ASK pr###ywhite.net
- DNS ASK do###rwhite.net
- DNS ASK pr####million.net
- DNS ASK do####million.net
- DNS ASK pr####pleasure.net
- DNS ASK do####pleasure.net
- DNS ASK pr####toward.net
- DNS ASK do####toward.net
- DNS ASK mi###white.net
- DNS ASK mi####illion.net
- DNS ASK st###white.net
- DNS ASK st####illion.net
- DNS ASK mi####leasure.net
- DNS ASK st####leasure.net
- DNS ASK mi###toward.net
- DNS ASK st###toward.net
- DNS ASK ev####gwhite.net
- DNS ASK bu####ngwhite.net
- DNS ASK ev####gmillion.net
- DNS ASK bu####ngmillion.net
- DNS ASK ev####gpleasure.net
- DNS ASK bu#####gpleasure.net
- DNS ASK ev####gtoward.net
- DNS ASK fe###wwhite.net
- DNS ASK br###nheart.net
Miscellaneous
Creates and executes the following
- 'C:\ejzfyojyxmm\bxjnsku3hsdyrymqyt.exe'
- 'C:\ejzfyojyxmm\bmqmglyqqfz.exe'
- 'C:\ejzfyojyxmm\ugsaxez.exe' "c:\ejzfyojyxmm\bmqmglyqqfz.exe"
