Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Configuration Upgrade Logs Device' = 'C:\poi7zftxjjzb\urubacv5p.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Services Tunneling Defragmenter Update Task] 'ImagePath' = 'C:\poi7zftxjjzb\urubacv5p.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Services Tunneling Defragmenter Update Task] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\poi7zftxjjzb\lwrcm0rjs.exe' "c:\poi7zftxjjzb\urubacv5p.exe"
- 'C:\poi7zftxjjzb\urubacv5p.exe'
- 'C:\poi7zftxjjzb\hlnbrer33djfenzahol0rqc.exe'
Modifies file system:
Creates the following files:
- C:\poi7zftxjjzb\urubacv5p.exe
- C:\poi7zftxjjzb\lwrcm0rjs.exe
- C:\poi7zftxjjzb\at5hlhvgarys
- %WINDIR%\poi7zftxjjzb\diffpd28
- C:\poi7zftxjjzb\diffpd28
- C:\poi7zftxjjzb\hlnbrer33djfenzahol0rqc.exe
Sets the 'hidden' attribute to the following files:
- C:\poi7zftxjjzb\lwrcm0rjs.exe
- C:\poi7zftxjjzb\urubacv5p.exe
Deletes the following files:
- C:\poi7zftxjjzb\hlnbrer33djfenzahol0rqc.exe
- %WINDIR%\poi7zftxjjzb\diffpd28
Substitutes the following files:
- %WINDIR%\poi7zftxjjzb\diffpd28
Network activity:
Connects to:
- 'ca#####neroyceston.net':80
- 'ca#####naroyceston.net':80
- 'ca#####nesouthgate.net':80
- 'an#####tearkwright.net':80
- 'ma#####nehoneysett.net':80
- 'an#####tehoneysett.net':80
- 'ca#####nasouthgate.net':80
- 'ca#####nahoneysett.net':80
- 'ki#####eeroyceston.net':80
- 'ma#####ianroyceston.net':80
- 'ca#####nearkwright.net':80
- 'ca#####naarkwright.net':80
- 'ca#####nehoneysett.net':80
- 'ma#####nearkwright.net':80
- 'st#####iesouthgate.net':80
- 'ch#####tesouthgate.net':80
- 'st#####iearkwright.net':80
- 'ki#####ynhoneysett.net':80
- 'st#####ieroyceston.net':80
- 'ch#####teroyceston.net':80
- 'ch#####tearkwright.net':80
- 'an#####teroyceston.net':80
- 'ma#####nesouthgate.net':80
- 'an#####tesouthgate.net':80
- 'st#####iehoneysett.net':80
- 'ch#####tehoneysett.net':80
- 'ma#####neroyceston.net':80
- 'ki#####eesouthgate.net':80
- 'ma#####kesanderson.net':80
- 'ze#####ahsanderson.net':80
- 'ma#####kebroadbent.net':80
- 'ze#####ahharrelson.net':80
- 'ma#####kebannerman.net':80
- 'ze#####ahbannerman.net':80
- 'ze#####ahbroadbent.net':80
- 'je#####nebannerman.net':80
- 'ge#####vesanderson.net':80
- 'je#####nesanderson.net':80
- 'ge#####veharrelson.net':80
- 'je#####neharrelson.net':80
- 'ge#####vebannerman.net':80
- 'ma#####keharrelson.net':80
- 'ki#####eehoneysett.net':80
- 'ma#####ianhoneysett.net':80
- 'ca#####raroyceston.net':80
- 'ma#####iansouthgate.net':80
- 'ki#####eearkwright.net':80
- 'ma#####ianarkwright.net':80
- 'kr#####herroyceston.net':80
- 'kr#####herarkwright.net':80
- 'ca#####rahoneysett.net':80
- 'kr#####herhoneysett.net':80
- 'ca#####rasouthgate.net':80
- 'kr#####hersouthgate.net':80
- 'ca#####raarkwright.net':80
TCP:
HTTP GET requests:
- http://ca#####neroyceston.net/index.php
- http://ca#####naroyceston.net/index.php
- http://ca#####nesouthgate.net/index.php
- http://an#####tearkwright.net/index.php
- http://ma#####nehoneysett.net/index.php
- http://an#####tehoneysett.net/index.php
- http://ca#####nasouthgate.net/index.php
- http://ca#####nahoneysett.net/index.php
- http://ki#####eeroyceston.net/index.php
- http://ma#####ianroyceston.net/index.php
- http://ca#####nearkwright.net/index.php
- http://ca#####naarkwright.net/index.php
- http://ca#####nehoneysett.net/index.php
- http://ma#####nearkwright.net/index.php
- http://st#####iesouthgate.net/index.php
- http://ch#####tesouthgate.net/index.php
- http://st#####iearkwright.net/index.php
- http://ki#####ynhoneysett.net/index.php
- http://st#####ieroyceston.net/index.php
- http://ch#####teroyceston.net/index.php
- http://ch#####tearkwright.net/index.php
- http://an#####teroyceston.net/index.php
- http://ma#####nesouthgate.net/index.php
- http://an#####tesouthgate.net/index.php
- http://st#####iehoneysett.net/index.php
- http://ch#####tehoneysett.net/index.php
- http://ma#####neroyceston.net/index.php
- http://ki#####eesouthgate.net/index.php
- http://ma#####kesanderson.net/index.php
- http://ze#####ahsanderson.net/index.php
- http://ma#####kebroadbent.net/index.php
- http://ze#####ahharrelson.net/index.php
- http://ma#####kebannerman.net/index.php
- http://ze#####ahbannerman.net/index.php
- http://ze#####ahbroadbent.net/index.php
- http://je#####nebannerman.net/index.php
- http://ge#####vesanderson.net/index.php
- http://je#####nesanderson.net/index.php
- http://ge#####veharrelson.net/index.php
- http://je#####neharrelson.net/index.php
- http://ge#####vebannerman.net/index.php
- http://ma#####keharrelson.net/index.php
- http://ki#####eehoneysett.net/index.php
- http://ma#####ianhoneysett.net/index.php
- http://ca#####raroyceston.net/index.php
- http://ma#####iansouthgate.net/index.php
- http://ki#####eearkwright.net/index.php
- http://ma#####ianarkwright.net/index.php
- http://kr#####herroyceston.net/index.php
- http://kr#####herarkwright.net/index.php
- http://ca#####rahoneysett.net/index.php
- http://kr#####herhoneysett.net/index.php
- http://ca#####rasouthgate.net/index.php
- http://kr#####hersouthgate.net/index.php
- http://ca#####raarkwright.net/index.php
UDP:
- DNS ASK ca#####neroyceston.net
- DNS ASK ca#####naroyceston.net
- DNS ASK ca#####nesouthgate.net
- DNS ASK an#####tehoneysett.net
- DNS ASK ma#####nearkwright.net
- DNS ASK an#####tearkwright.net
- DNS ASK ma#####nehoneysett.net
- DNS ASK ca#####nahoneysett.net
- DNS ASK ki#####eeroyceston.net
- DNS ASK ma#####ianroyceston.net
- DNS ASK ca#####nehoneysett.net
- DNS ASK ca#####nasouthgate.net
- DNS ASK ca#####nearkwright.net
- DNS ASK ca#####naarkwright.net
- DNS ASK st#####iesouthgate.net
- DNS ASK ch#####tesouthgate.net
- DNS ASK st#####iearkwright.net
- DNS ASK ch#####teroyceston.net
- DNS ASK gl#####lehoneysett.net
- DNS ASK ki#####ynhoneysett.net
- DNS ASK st#####ieroyceston.net
- DNS ASK an#####teroyceston.net
- DNS ASK ma#####nesouthgate.net
- DNS ASK an#####tesouthgate.net
- DNS ASK ma#####neroyceston.net
- DNS ASK ch#####tearkwright.net
- DNS ASK st#####iehoneysett.net
- DNS ASK ch#####tehoneysett.net
- DNS ASK ma#####kesanderson.net
- DNS ASK ze#####ahsanderson.net
- DNS ASK ma#####kebroadbent.net
- DNS ASK ze#####ahbannerman.net
- DNS ASK ma#####keharrelson.net
- DNS ASK ze#####ahharrelson.net
- DNS ASK ma#####kebannerman.net
- DNS ASK je#####nebannerman.net
- DNS ASK ge#####vesanderson.net
- DNS ASK je#####nesanderson.net
- DNS ASK ge#####vebannerman.net
- DNS ASK ze#####ahbroadbent.net
- DNS ASK ge#####veharrelson.net
- DNS ASK je#####neharrelson.net
- DNS ASK ki#####eehoneysett.net
- DNS ASK ma#####ianhoneysett.net
- DNS ASK ca#####raroyceston.net
- DNS ASK ma#####ianarkwright.net
- DNS ASK ki#####eesouthgate.net
- DNS ASK ma#####iansouthgate.net
- DNS ASK ki#####eearkwright.net
- DNS ASK kr#####herarkwright.net
- DNS ASK ca#####rahoneysett.net
- DNS ASK kr#####herhoneysett.net
- DNS ASK ca#####raarkwright.net
- DNS ASK kr#####herroyceston.net
- DNS ASK ca#####rasouthgate.net
- DNS ASK kr#####hersouthgate.net
