Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Provider Scheduler Office Protection' = 'C:\etcvnxxh\pratakxuespi.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\File Center Reporting Detection BitLocker WMI] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\File Center Reporting Detection BitLocker WMI] 'ImagePath' = 'C:\etcvnxxh\pratakxuespi.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\etcvnxxh\ipilh6
- C:\etcvnxxh\ipilh6
- C:\etcvnxxh\wyc3063pkhrfbr1bppi.exe
- C:\etcvnxxh\pratakxuespi.exe
- C:\etcvnxxh\hrxnfuy.exe
- C:\etcvnxxh\ou1kjyn8cjy
Sets the 'hidden' attribute to the following files:
- C:\etcvnxxh\pratakxuespi.exe
- C:\etcvnxxh\hrxnfuy.exe
Deletes the following files:
- %WINDIR%\etcvnxxh\ipilh6
- C:\etcvnxxh\wyc3063pkhrfbr1bppi.exe
Substitutes the following files:
- %WINDIR%\etcvnxxh\ipilh6
Network activity:
Connects to:
- 'la####eighbor.net':80
- 'su####tsquare.net':80
- 'su####tneighbor.net':80
- 'su####tspread.net':80
- 'fi####attempt.net':80
- 'le####ttempt.net':80
- 'fi####square.net':80
- 'le###square.net':80
- 'fi####neighbor.net':80
- 'le####eighbor.net':80
- 'po####leattempt.net':80
- 'fi####spread.net':80
- 'sw####ttempt.net':80
- 'pr####lyattempt.net':80
- 'sw###square.net':80
- 'pr####lysquare.net':80
- 'sw####eighbor.net':80
- 'pr#####yneighbor.net':80
- 'sw###spread.net':80
- 'pr####lyspread.net':80
- 'se####lattempt.net':80
- 'wi####spread.net':80
- 'su####tattempt.net':80
- 'pe####sspread.net':80
- 'wi####neighbor.net':80
- 'pe####sneighbor.net':80
- 'la###spread.net':80
- 'si####attempt.net':80
- 'mo####attempt.net':80
- 'si####square.net':80
- 'mo####square.net':80
- 'si####neighbor.net':80
- 'mo####neighbor.net':80
- 'si####spread.net':80
- 'mo####spread.net':80
- 'ma####alattempt.net':80
- 'le###spread.net':80
- 'mo####inattempt.net':80
- 'po####lesquare.net':80
- 'mo#####nneighbor.net':80
- 'po#####eneighbor.net':80
- 'mo####inspread.net':80
- 'po####lespread.net':80
- 'pe####sattempt.net':80
- 'wi####attempt.net':80
- 'pe####ssquare.net':80
- 'wi####square.net':80
- 'se####spread.net':80
- 'mo####insquare.net':80
- 'se####lsquare.net':80
TCP:
HTTP GET requests:
- http://la####eighbor.net/index.php
- http://su####tsquare.net/index.php
- http://su####tneighbor.net/index.php
- http://su####tspread.net/index.php
- http://fi####attempt.net/index.php
- http://le####ttempt.net/index.php
- http://fi####square.net/index.php
- http://le###square.net/index.php
- http://fi####neighbor.net/index.php
- http://le####eighbor.net/index.php
- http://po####leattempt.net/index.php
- http://fi####spread.net/index.php
- http://sw####ttempt.net/index.php
- http://pr####lyattempt.net/index.php
- http://sw###square.net/index.php
- http://pr####lysquare.net/index.php
- http://sw####eighbor.net/index.php
- http://pr#####yneighbor.net/index.php
- http://sw###spread.net/index.php
- http://pr####lyspread.net/index.php
- http://se####lattempt.net/index.php
- http://wi####spread.net/index.php
- http://su####tattempt.net/index.php
- http://pe####sspread.net/index.php
- http://wi####neighbor.net/index.php
- http://pe####sneighbor.net/index.php
- http://la###spread.net/index.php
- http://si####attempt.net/index.php
- http://mo####attempt.net/index.php
- http://si####square.net/index.php
- http://mo####square.net/index.php
- http://si####neighbor.net/index.php
- http://mo####neighbor.net/index.php
- http://si####spread.net/index.php
- http://mo####spread.net/index.php
- http://ma####alattempt.net/index.php
- http://le###spread.net/index.php
- http://mo####inattempt.net/index.php
- http://po####lesquare.net/index.php
- http://mo#####nneighbor.net/index.php
- http://po#####eneighbor.net/index.php
- http://mo####inspread.net/index.php
- http://po####lespread.net/index.php
- http://pe####sattempt.net/index.php
- http://wi####attempt.net/index.php
- http://pe####ssquare.net/index.php
- http://wi####square.net/index.php
- http://se####spread.net/index.php
- http://mo####insquare.net/index.php
- http://se####lsquare.net/index.php
UDP:
- DNS ASK la####eighbor.net
- DNS ASK su####tattempt.net
- DNS ASK su####tsquare.net
- DNS ASK su####tneighbor.net
- DNS ASK su####tspread.net
- DNS ASK fi####attempt.net
- DNS ASK le####ttempt.net
- DNS ASK fi####square.net
- DNS ASK le###square.net
- DNS ASK fi####neighbor.net
- DNS ASK le####eighbor.net
- DNS ASK le###spread.net
- DNS ASK se####lsquare.net
- DNS ASK sw####ttempt.net
- DNS ASK pr####lyattempt.net
- DNS ASK sw###square.net
- DNS ASK pr####lysquare.net
- DNS ASK sw####eighbor.net
- DNS ASK pr#####yneighbor.net
- DNS ASK sw###spread.net
- DNS ASK pr####lyspread.net
- DNS ASK se####lattempt.net
- DNS ASK ma####alattempt.net
- DNS ASK wi####spread.net
- DNS ASK fi####spread.net
- DNS ASK pe####sspread.net
- DNS ASK mo####inattempt.net
- DNS ASK se####spread.net
- DNS ASK la###spread.net
- DNS ASK si####attempt.net
- DNS ASK mo####attempt.net
- DNS ASK si####square.net
- DNS ASK mo####square.net
- DNS ASK si####neighbor.net
- DNS ASK mo####neighbor.net
- DNS ASK si####spread.net
- DNS ASK mo####spread.net
- DNS ASK po####leattempt.net
- DNS ASK pe####sneighbor.net
- DNS ASK mo####insquare.net
- DNS ASK po####lesquare.net
- DNS ASK mo#####nneighbor.net
- DNS ASK po#####eneighbor.net
- DNS ASK mo####inspread.net
- DNS ASK po####lespread.net
- DNS ASK pe####sattempt.net
- DNS ASK wi####attempt.net
- DNS ASK pe####ssquare.net
- DNS ASK wi####square.net
- DNS ASK wi####neighbor.net
- DNS ASK ma####alsquare.net
Miscellaneous:
Creates and executes the following:
- 'C:\etcvnxxh\wyc3063pkhrfbr1bppi.exe'
- 'C:\etcvnxxh\pratakxuespi.exe'
- 'C:\etcvnxxh\hrxnfuy.exe' "c:\etcvnxxh\pratakxuespi.exe"
