Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Defragmenter Transfer Profile Filtering COM' = 'C:\xfyjwpafqg4k\lbmbzlvokbdg.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Performance Layer TP System Problem Player] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Performance Layer TP System Problem Player] 'ImagePath' = 'C:\xfyjwpafqg4k\lbmbzlvokbdg.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\xfyjwpafqg4k\qwt6suwnm
- C:\xfyjwpafqg4k\qwt6suwnm
- C:\xfyjwpafqg4k\wfvc5uw2m4wiitsmhqfbfg.exe
- C:\xfyjwpafqg4k\lbmbzlvokbdg.exe
- C:\xfyjwpafqg4k\ytbnyhbyqex.exe
- C:\xfyjwpafqg4k\uyojnhkbqc
Sets the 'hidden' attribute to the following files:
- C:\xfyjwpafqg4k\lbmbzlvokbdg.exe
- C:\xfyjwpafqg4k\ytbnyhbyqex.exe
Deletes the following files:
- %WINDIR%\xfyjwpafqg4k\qwt6suwnm
- C:\xfyjwpafqg4k\wfvc5uw2m4wiitsmhqfbfg.exe
Substitutes the following files:
- %WINDIR%\xfyjwpafqg4k\qwt6suwnm
Network activity:
Connects to:
- 'ag#####anabolics.com':80
- 'sp##tnav.ru':80
- 'ga####liongrass.net':80
- 'bu####rmansion.com':80
- 'do##bate.cn':80
- 'sc####ainbow.net':80
- 'ma######anderrickson.net':80
- 'ki#####eewhittemore.net':80
- 'an#####teherbertson.ru':80
- 'ca#####nawilliamson.ru':80
- 'an#####tewhittemore.net':80
- 'ch#####tewilliamson.net':80
- 'ma#####nederrickson.net':80
- 'st#####iewilliamson.net':80
- 'st#####ieherbertson.net':80
- 'ch#####teherbertson.net':80
- 'gl#####lewilliamson.ru':80
- 'gr###factory.cn':80
- 'ma#####neherbertson.net':80
- 'ca#####eeitinthecup.org':80
- 'cl####portsmen.com':80
- 'so####ryducks.com':80
- 'un###lgrain.org':80
- 'ga#####yundongyuan.cn':80
- 'pr##card.ru':80
- 'gu##155.cn':80
- 'ye####gdongwu.cn':80
- 'si###ypeas.net':80
- 'to###tosales.ru':80
- 'ha####nhalflion.net':80
- 'ta#####pielenreiten.org':80
- 'cl#####ortswomen.com':80
- 'sc#####epuzzlechess.org':80
- 'pr####anabolikov.ru':80
- 'ch####isportsmen.ru':80
- 'ka#######ayajivayapriroda.ru':80
- 'pi##asia.cn':80
- 'na##top.ru':80
- 'an#####teherbertson.net':80
TCP:
HTTP GET requests:
- http://ag#####anabolics.com/index.php
- http://sp##tnav.ru/index.php
- http://ga####liongrass.net/index.php
- http://bu####rmansion.com/index.php
- http://do##bate.cn/index.php
- http://sc####ainbow.net/index.php
- http://ma######anderrickson.net/index.php
- http://ki#####eewhittemore.net/index.php
- http://an#####teherbertson.ru/index.php
- http://ca#####nawilliamson.ru/index.php
- http://an#####tewhittemore.net/index.php
- http://ch#####tewilliamson.net/index.php
- http://ma#####nederrickson.net/index.php
- http://st#####iewilliamson.net/index.php
- http://st#####ieherbertson.net/index.php
- http://ch#####teherbertson.net/index.php
- http://gl#####lewilliamson.ru/index.php
- http://gr###factory.cn/index.php
- http://ma#####neherbertson.net/index.php
- http://ca#####eeitinthecup.org/index.php
- http://cl####portsmen.com/index.php
- http://so####ryducks.com/index.php
- http://un###lgrain.org/index.php
- http://ga#####yundongyuan.cn/index.php
- http://pr##card.ru/index.php
- http://gu##155.cn/index.php
- http://ye####gdongwu.cn/index.php
- http://si###ypeas.net/index.php
- http://to###tosales.ru/index.php
- http://ha####nhalflion.net/index.php
- http://ta#####pielenreiten.org/index.php
- http://cl#####ortswomen.com/index.php
- http://sc#####epuzzlechess.org/index.php
- http://pr####anabolikov.ru/index.php
- http://ch####isportsmen.ru/index.php
- http://ka#######ayajivayapriroda.ru/index.php
- http://pi##asia.cn/index.php
- http://na##top.ru/index.php
- http://an#####teherbertson.net/index.php
UDP:
- DNS ASK ag#####anabolics.com
- DNS ASK ca#####raamethyst.ru
- DNS ASK ca#####raamethyst.net
- DNS ASK ma#####ianmirabelle.net
- DNS ASK ma#####ianmadelina.net
- DNS ASK ki#####eemadelina.net
- DNS ASK ca#####raesmaralda.net
- DNS ASK kr#####heramethyst.net
- DNS ASK ki#####eemirabelle.net
- DNS ASK ma#####ianesmaralda.net
- DNS ASK ma#####ianamethyst.net
- DNS ASK ki#####eeamethyst.net
- DNS ASK ca#####namirabelle.net
- DNS ASK ca#####nemirabelle.ru
- DNS ASK ma#####ianesmaralda.ru
- DNS ASK ki#####eeesmaralda.net
- DNS ASK ca#####ramadelina.net
- DNS ASK kr#####heresmaralda.net
- DNS ASK kr#####hermadelina.ru
- DNS ASK ge#####vederrickson.net
- DNS ASK ze#####ahwilliamson.ru
- DNS ASK ma#####kewilliamson.net
- DNS ASK ze#####ahherbertson.net
- DNS ASK ze#####ahwilliamson.net
- DNS ASK ma#####keherbertson.net
- DNS ASK je#####nederrickson.net
- DNS ASK ze#####ahwhittemore.net
- DNS ASK ma#####kewhittemore.net
- DNS ASK ze#####ahderrickson.net
- DNS ASK ma#####kederrickson.net
- DNS ASK ca#####ramirabelle.net
- DNS ASK kr#####hermirabelle.net
- DNS ASK kr#####hermadelina.net
- DNS ASK ma#####kewhittemore.ru
- DNS ASK ca#####nemirabelle.net
- DNS ASK ca#####nemadelina.net
- DNS ASK je#####nemirabelle.net
- DNS ASK ca#####naesmaralda.net
- DNS ASK st#####ieesmaralda.net
- DNS ASK ch#####teesmaralda.net
- DNS ASK st#####ieamethyst.net
- DNS ASK ki#####ynmirabelle.net
- DNS ASK gl#####lemirabelle.net
- DNS ASK st#####iemadelina.net
- DNS ASK ch#####teamethyst.net
- DNS ASK ki#####ynmadelina.ru
- DNS ASK gl#####leesmaralda.net
- DNS ASK gl#####lemadelina.net
- DNS ASK ki#####ynamethyst.net
- DNS ASK gl#####leamethyst.ru
- DNS ASK gl#####leamethyst.net
- DNS ASK ki#####ynesmaralda.net
- DNS ASK ki#####ynmadelina.net
- DNS ASK st#####ieesmaralda.ru
- DNS ASK ch#####temadelina.net
- DNS ASK st#####iemirabelle.net
- DNS ASK ca#####naamethyst.ru
- DNS ASK ca#####naamethyst.net
- DNS ASK ca#####neamethyst.net
- DNS ASK an#####temirabelle.net
- DNS ASK ma#####nemirabelle.net
- DNS ASK ma#####nemadelina.ru
- DNS ASK ca#####neesmaralda.net
- DNS ASK an#####temadelina.net
- DNS ASK an#####teesmaralda.net
- DNS ASK an#####teamethyst.net
- DNS ASK ma#####neesmaralda.net
- DNS ASK ch#####temirabelle.ru
- DNS ASK ma#####neamethyst.net
- DNS ASK ch#####temirabelle.net
- DNS ASK ma#####nemadelina.net
- DNS ASK ge#####vewhittemore.net
- DNS ASK ca#####namadelina.net
- DNS ASK je#####newhittemore.net
- DNS ASK ch#####teherbertson.net
- DNS ASK sp##tnav.ru
- DNS ASK ga####liongrass.net
- DNS ASK bu####rmansion.com
- DNS ASK do##bate.cn
- DNS ASK sc####ainbow.net
- DNS ASK ca#####eeitinthecup.org
- DNS ASK gr###factory.cn
- DNS ASK ma######anderrickson.net
- DNS ASK an#####teherbertson.ru
- DNS ASK an#####tewhittemore.net
- DNS ASK ch#####tewilliamson.net
- DNS ASK ma#####nederrickson.net
- DNS ASK st#####iewilliamson.net
- DNS ASK ki#####eewhittemore.net
- DNS ASK ma#####neherbertson.net
- DNS ASK na##top.ru
- DNS ASK ha####nhalflion.net
- DNS ASK pi##asia.cn
- DNS ASK un###lgrain.org
- DNS ASK ga#####yundongyuan.cn
- DNS ASK pr##card.ru
- DNS ASK gu##155.cn
- DNS ASK ye####gdongwu.cn
- DNS ASK si###ypeas.net
- DNS ASK so####ryducks.com
- DNS ASK cl####portsmen.com
- DNS ASK ta#####pielenreiten.org
- DNS ASK cl#####ortswomen.com
- DNS ASK sc#####epuzzlechess.org
- DNS ASK pr####anabolikov.ru
- DNS ASK ch####isportsmen.ru
- DNS ASK ka#######ayajivayapriroda.ru
- DNS ASK to###tosales.ru
- DNS ASK st#####ieherbertson.net
- DNS ASK gl#####lewilliamson.ru
- DNS ASK ge#####veherbertson.ru
- DNS ASK ca#####nawilliamson.ru
- DNS ASK ca#####newilliamson.net
- DNS ASK an#####tederrickson.net
- DNS ASK ca#####nawilliamson.net
- DNS ASK an#####tewilliamson.net
- DNS ASK ki#####ynwhittemore.net
- DNS ASK ch#####tederrickson.net
- DNS ASK gl#####lewhittemore.net
- DNS ASK ca#####nederrickson.net
- DNS ASK ki#####ynderrickson.net
- DNS ASK gl#####lederrickson.net
- DNS ASK je#####newilliamson.net
- DNS ASK ge#####vewilliamson.net
- DNS ASK je#####neherbertson.net
- DNS ASK ca#####newhittemore.ru
- DNS ASK ma#####newilliamson.net
- DNS ASK gl#####lewilliamson.net
- DNS ASK ma#####nederrickson.ru
- DNS ASK ki#####ynderrickson.ru
- DNS ASK ch#####tewhittemore.ru
- DNS ASK ch#####tewhittemore.net
- DNS ASK st#####iewhittemore.net
- DNS ASK ma#####newhittemore.net
- DNS ASK ca#####naherbertson.net
- DNS ASK ki#####ynherbertson.net
- DNS ASK an#####teherbertson.net
- DNS ASK ca#####newhittemore.net
- DNS ASK gl#####leherbertson.net
- DNS ASK st#####iederrickson.net
- DNS ASK ca#####neherbertson.net
- DNS ASK ki#####eederrickson.net
- DNS ASK ca#####naderrickson.net
- DNS ASK ki#####ynwilliamson.net
- DNS ASK ca#####nawhittemore.net
- DNS ASK ge#####veherbertson.net
- DNS ASK ge#####vemirabelle.net
Miscellaneous:
Creates and executes the following:
- 'C:\xfyjwpafqg4k\wfvc5uw2m4wiitsmhqfbfg.exe'
- 'C:\xfyjwpafqg4k\lbmbzlvokbdg.exe'
- 'C:\xfyjwpafqg4k\ytbnyhbyqex.exe' "c:\xfyjwpafqg4k\lbmbzlvokbdg.exe"
