Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Tracking Encrypting WinHTTP' = 'C:\byjzxygohqji\ljpwvqin.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Microsoft Encryption Registrar Tablet Reports] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Microsoft Encryption Registrar Tablet Reports] 'ImagePath' = 'C:\byjzxygohqji\ljpwvqin.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\byjzxygohqji\i0hbut9mvora
- C:\byjzxygohqji\i0hbut9mvora
- C:\byjzxygohqji\iptd2w6vszdfryhu.exe
- C:\byjzxygohqji\ljpwvqin.exe
- C:\byjzxygohqji\nbsjbvlhqz.exe
Sets the 'hidden' attribute to the following files:
- C:\byjzxygohqji\ljpwvqin.exe
- C:\byjzxygohqji\nbsjbvlhqz.exe
Deletes the following files:
- %WINDIR%\byjzxygohqji\i0hbut9mvora
- C:\byjzxygohqji\iptd2w6vszdfryhu.exe
Substitutes the following files:
- %WINDIR%\byjzxygohqji\i0hbut9mvora
Network activity:
Connects to:
- 'bu#####gposition.net':80
- 'br####number.net':80
- 're####number.net':80
- 'br####position.net':80
- 're####position.net':80
- 'br####strike.net':80
- 're####strike.net':80
- 'br####partial.net':80
- 're####partial.net':80
- 'pr####enumber.net':80
- 'de####number.net':80
- 'pr####eposition.net':80
- 'de####position.net':80
- 'pr####estrike.net':80
- 'de####strike.net':80
- 'pr####epartial.net':80
- 'de####partial.net':80
- 'st####thnumber.net':80
- 'st#####hposition.net':80
- 'st####thstrike.net':80
- 'st####thpartial.net':80
- 'mo####ntattempt.net':80
- 'fe####partial.net':80
- 'ou####eattempt.net':80
- 'fe####strike.net':80
- 'fe####number.net':80
- 'ev####gposition.net':80
- 'bu####ngstrike.net':80
- 'ev####gstrike.net':80
- 'bu####ngpartial.net':80
- 'ev####gpartial.net':80
- 'st###number.net':80
- 'mi###number.net':80
- 'st####osition.net':80
- 'mi####osition.net':80
- 'st###strike.net':80
- 'mi###strike.net':80
- 'st####artial.net':80
- 'mi####artial.net':80
- 'do####number.net':80
- 'pr####number.net':80
- 'do####position.net':80
- 'pr####position.net':80
- 'do####strike.net':80
- 'pr####strike.net':80
- 'do####partial.net':80
- 'pr####partial.net':80
- 'fe####position.net':80
- 'mo####ntsquare.net':80
TCP:
HTTP GET requests:
- http://bu#####gposition.net/index.php
- http://br####number.net/index.php
- http://re####number.net/index.php
- http://br####position.net/index.php
- http://re####position.net/index.php
- http://br####strike.net/index.php
- http://re####strike.net/index.php
- http://br####partial.net/index.php
- http://re####partial.net/index.php
- http://pr####enumber.net/index.php
- http://de####number.net/index.php
- http://pr####eposition.net/index.php
- http://de####position.net/index.php
- http://pr####estrike.net/index.php
- http://de####strike.net/index.php
- http://pr####epartial.net/index.php
- http://de####partial.net/index.php
- http://st####thnumber.net/index.php
- http://st#####hposition.net/index.php
- http://st####thstrike.net/index.php
- http://st####thpartial.net/index.php
- http://mo####ntattempt.net/index.php
- http://fe####partial.net/index.php
- http://ou####eattempt.net/index.php
- http://fe####strike.net/index.php
- http://fe####number.net/index.php
- http://ev####gposition.net/index.php
- http://bu####ngstrike.net/index.php
- http://ev####gstrike.net/index.php
- http://bu####ngpartial.net/index.php
- http://ev####gpartial.net/index.php
- http://st###number.net/index.php
- http://mi###number.net/index.php
- http://st####osition.net/index.php
- http://mi####osition.net/index.php
- http://st###strike.net/index.php
- http://mi###strike.net/index.php
- http://st####artial.net/index.php
- http://mi####artial.net/index.php
- http://do####number.net/index.php
- http://pr####number.net/index.php
- http://do####position.net/index.php
- http://pr####position.net/index.php
- http://do####strike.net/index.php
- http://pr####strike.net/index.php
- http://do####partial.net/index.php
- http://pr####partial.net/index.php
- http://fe####position.net/index.php
- http://mo####ntsquare.net/index.php
UDP:
- DNS ASK bu#####gposition.net
- DNS ASK br####position.net
- DNS ASK re####position.net
- DNS ASK br####strike.net
- DNS ASK re####strike.net
- DNS ASK br####partial.net
- DNS ASK re####partial.net
- DNS ASK pr####enumber.net
- DNS ASK de####number.net
- DNS ASK pr####eposition.net
- DNS ASK st####artial.net
- DNS ASK de####position.net
- DNS ASK de####strike.net
- DNS ASK pr####epartial.net
- DNS ASK de####partial.net
- DNS ASK st####thnumber.net
- DNS ASK st#####hposition.net
- DNS ASK st####thstrike.net
- DNS ASK st####thpartial.net
- DNS ASK mo####ntattempt.net
- DNS ASK ou####eattempt.net
- DNS ASK br####number.net
- DNS ASK re####number.net
- DNS ASK fe####partial.net
- DNS ASK fe####strike.net
- DNS ASK fe####position.net
- DNS ASK bu####ngstrike.net
- DNS ASK ev####gstrike.net
- DNS ASK bu####ngpartial.net
- DNS ASK ev####gpartial.net
- DNS ASK st###number.net
- DNS ASK mi###number.net
- DNS ASK st####osition.net
- DNS ASK mi####osition.net
- DNS ASK st###strike.net
- DNS ASK mo####ntsquare.net
- DNS ASK pr####estrike.net
- DNS ASK mi###strike.net
- DNS ASK do####number.net
- DNS ASK pr####number.net
- DNS ASK do####position.net
- DNS ASK pr####position.net
- DNS ASK do####strike.net
- DNS ASK pr####strike.net
- DNS ASK do####partial.net
- DNS ASK pr####partial.net
- DNS ASK fe####number.net
- DNS ASK ev####gposition.net
- DNS ASK mi####artial.net
- DNS ASK ou####esquare.net
Miscellaneous:
Creates and executes the following:
- 'C:\byjzxygohqji\iptd2w6vszdfryhu.exe'
- 'C:\byjzxygohqji\ljpwvqin.exe'
- 'C:\byjzxygohqji\nbsjbvlhqz.exe' "c:\byjzxygohqji\ljpwvqin.exe"
