Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Play File Firewall DLL Interface Link-Layer' = 'C:\ixbbfctkknov\xgukkgm.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Window Awareness Identity Biometric] 'ImagePath' = 'C:\ixbbfctkknov\xgukkgm.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Window Awareness Identity Biometric] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\ixbbfctkknov\idyamxk.exe' "c:\ixbbfctkknov\xgukkgm.exe"
- 'C:\ixbbfctkknov\xgukkgm.exe'
- 'C:\ixbbfctkknov\u6rkz3a09ppnyt4hou.exe'
Modifies file system:
Creates the following files:
- C:\ixbbfctkknov\xgukkgm.exe
- C:\ixbbfctkknov\idyamxk.exe
- C:\ixbbfctkknov\u6rkz3a09ppnyt4hou.exe
- %WINDIR%\ixbbfctkknov\rtijujct12
- C:\ixbbfctkknov\rtijujct12
Sets the 'hidden' attribute to the following files:
- C:\ixbbfctkknov\idyamxk.exe
- C:\ixbbfctkknov\xgukkgm.exe
Deletes the following files:
- C:\ixbbfctkknov\u6rkz3a09ppnyt4hou.exe
- %WINDIR%\ixbbfctkknov\rtijujct12
Network activity:
Connects to:
- 'pe#####electricity.net':80
- 'wi###wtrain.net':80
- 'pe####strain.net':80
- 'wi####delight.net':80
- 'pe####sdelight.net':80
- 'wi#####lectricity.net':80
- 'mo####indelight.net':80
- 'po#####eelectricity.net':80
- 'mo#####nelectricity.net':80
- 'wi####borrow.net':80
- 'pe####sborrow.net':80
- 'po####ledelight.net':80
- 'su####tborrow.net':80
- 'fi#####lectricity.net':80
- 'le###train.net':80
- 'fi###htrain.net':80
- 'le####elight.net':80
- 'fi####delight.net':80
- 'le#####ectricity.net':80
- 'su#####electricity.net':80
- 'su####ttrain.net':80
- 'wi###rtrain.net':80
- 'le###borrow.net':80
- 'fi####borrow.net':80
- 'su####tdelight.net':80
- 'la###train.net':80
- 'se###atrain.net':80
- 'la###borrow.net':80
- 'se####delight.net':80
- 'la#####ectricity.net':80
- 'se#####lectricity.net':80
- 'ma####altwenty.net':80
- 'se####ltwenty.net':80
- 'ma####almeeting.net':80
- 'se####borrow.net':80
- 'ma#####lunderstood.net':80
- 'se#####understood.net':80
- 'la####elight.net':80
- 'mo####inborrow.net':80
- 'mo####delight.net':80
- 'si####delight.net':80
- 'po####letrain.net':80
- 'mo####intrain.net':80
- 'po####leborrow.net':80
- 'si###etrain.net':80
- 'mo####borrow.net':80
- 'si####borrow.net':80
- 'mo#####lectricity.net':80
- 'si#####lectricity.net':80
- 'mo###rtrain.net':80
TCP:
HTTP GET requests:
- http://pe#####electricity.net/index.php
- http://wi###wtrain.net/index.php
- http://pe####strain.net/index.php
- http://wi####delight.net/index.php
- http://pe####sdelight.net/index.php
- http://wi#####lectricity.net/index.php
- http://mo####indelight.net/index.php
- http://po#####eelectricity.net/index.php
- http://mo#####nelectricity.net/index.php
- http://wi####borrow.net/index.php
- http://pe####sborrow.net/index.php
- http://po####ledelight.net/index.php
- http://su####tborrow.net/index.php
- http://fi#####lectricity.net/index.php
- http://le###train.net/index.php
- http://fi###htrain.net/index.php
- http://le####elight.net/index.php
- http://fi####delight.net/index.php
- http://le#####ectricity.net/index.php
- http://su#####electricity.net/index.php
- http://su####ttrain.net/index.php
- http://wi###rtrain.net/index.php
- http://le###borrow.net/index.php
- http://fi####borrow.net/index.php
- http://su####tdelight.net/index.php
- http://la###train.net/index.php
- http://se###atrain.net/index.php
- http://la###borrow.net/index.php
- http://se####delight.net/index.php
- http://la#####ectricity.net/index.php
- http://se#####lectricity.net/index.php
- http://ma####altwenty.net/index.php
- http://se####ltwenty.net/index.php
- http://ma####almeeting.net/index.php
- http://se####borrow.net/index.php
- http://ma#####lunderstood.net/index.php
- http://se#####understood.net/index.php
- http://la####elight.net/index.php
- http://mo####inborrow.net/index.php
- http://mo####delight.net/index.php
- http://si####delight.net/index.php
- http://po####letrain.net/index.php
- http://mo####intrain.net/index.php
- http://po####leborrow.net/index.php
- http://si###etrain.net/index.php
- http://mo####borrow.net/index.php
- http://si####borrow.net/index.php
- http://mo#####lectricity.net/index.php
- http://si#####lectricity.net/index.php
- http://mo###rtrain.net/index.php
UDP:
- DNS ASK wi#####lectricity.net
- DNS ASK pe#####electricity.net
- DNS ASK wi###wtrain.net
- DNS ASK su####tborrow.net
- DNS ASK wi####delight.net
- DNS ASK pe####sdelight.net
- DNS ASK po####ledelight.net
- DNS ASK mo####indelight.net
- DNS ASK po#####eelectricity.net
- DNS ASK pe####strain.net
- DNS ASK wi####borrow.net
- DNS ASK pe####sborrow.net
- DNS ASK wi###rtrain.net
- DNS ASK le#####ectricity.net
- DNS ASK fi#####lectricity.net
- DNS ASK le###train.net
- DNS ASK sw###borrow.net
- DNS ASK le####elight.net
- DNS ASK fi####delight.net
- DNS ASK su####tdelight.net
- DNS ASK su#####electricity.net
- DNS ASK su####ttrain.net
- DNS ASK fi###htrain.net
- DNS ASK le###borrow.net
- DNS ASK fi####borrow.net
- DNS ASK mo#####nelectricity.net
- DNS ASK la###train.net
- DNS ASK se###atrain.net
- DNS ASK la###borrow.net
- DNS ASK se####delight.net
- DNS ASK la#####ectricity.net
- DNS ASK se#####lectricity.net
- DNS ASK ma####altwenty.net
- DNS ASK se####ltwenty.net
- DNS ASK ma####almeeting.net
- DNS ASK se####borrow.net
- DNS ASK ma#####lunderstood.net
- DNS ASK se#####understood.net
- DNS ASK la####elight.net
- DNS ASK mo####inborrow.net
- DNS ASK mo####delight.net
- DNS ASK si####delight.net
- DNS ASK po####letrain.net
- DNS ASK mo####intrain.net
- DNS ASK po####leborrow.net
- DNS ASK si###etrain.net
- DNS ASK mo####borrow.net
- DNS ASK si####borrow.net
- DNS ASK mo#####lectricity.net
- DNS ASK si#####lectricity.net
- DNS ASK mo###rtrain.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
