Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Biometric WebClient Bus Mapper Logs Defender] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Biometric WebClient Bus Mapper Logs Defender] 'ImagePath' = 'C:\vogrsxehghhxrae\bjgykncomumh.exe'
Creates the following services
- 'Biometric WebClient Bus Mapper Logs Defender' C:\vogrsxehghhxrae\bjgykncomumh.exe
Modifies file system
Creates the following files
- %WINDIR%\vogrsxehghhxrae\marfwfruc
- C:\vogrsxehghhxrae\marfwfruc
- C:\vogrsxehghhxrae\lrcmt4krmszeiny6ga.exe
- C:\vogrsxehghhxrae\bjgykncomumh.exe
- C:\vogrsxehghhxrae\rrgtmnczf.exe
Sets the 'hidden' attribute to the following files
- C:\vogrsxehghhxrae\bjgykncomumh.exe
- C:\vogrsxehghhxrae\rrgtmnczf.exe
Deletes the following files
- %WINDIR%\vogrsxehghhxrae\marfwfruc
- C:\vogrsxehghhxrae\lrcmt4krmszeiny6ga.exe
Substitutes the following files
- %WINDIR%\vogrsxehghhxrae\marfwfruc
Network activity
Connects to
- 'he###butter.net':80
- 'fo####dfifteen.net':80
- 'an###rdried.net':80
- 'pl####ntdried.net':80
- 'ge###edried.net':80
- 'an####service.net':80
- 'gl####ervice.net':80
- 'gl###river.net':80
- 'pl####ntriver.net':80
TCP
HTTP GET requests
- http://he###butter.net/index.php
- http://fo####dfifteen.net/index.php
- http://an###rdried.net/index.php
- http://pl####ntdried.net/index.php
- http://ge###edried.net/index.php
- http://an####service.net/index.php
- http://gl####ervice.net/index.php
- http://gl###river.net/index.php
UDP
- DNS ASK he###behind.net
- DNS ASK va####sangry.net
- DNS ASK re####fifteen.net
- DNS ASK va####sfifteen.net
- DNS ASK re###ndried.net
- DNS ASK va####sdried.net
- DNS ASK ge####article.net
- DNS ASK ge###eangry.net
- DNS ASK ge####fifteen.net
- DNS ASK ge###edried.net
- DNS ASK he####article.net
- DNS ASK le####article.net
- DNS ASK he###nangry.net
- DNS ASK le###rangry.net
- DNS ASK he####fifteen.net
- DNS ASK le####fifteen.net
- DNS ASK he###ndried.net
- DNS ASK le###rdried.net
- DNS ASK re####earticle.net
- DNS ASK or####rticle.net
- DNS ASK re####eangry.net
- DNS ASK or###angry.net
- DNS ASK re####efifteen.net
- DNS ASK or####ifteen.net
- DNS ASK re####edried.net
- DNS ASK or###dried.net
- DNS ASK ne#####ryarticle.net
- DNS ASK pl####ntarticle.net
- DNS ASK ne####aryangry.net
- DNS ASK pl####ntangry.net
- DNS ASK pl####ntfifteen.net
- DNS ASK ne#####ryfifteen.net
- DNS ASK re###nangry.net
- DNS ASK va####sarticle.net
- DNS ASK pl####ntservice.net
- DNS ASK ne#####rysuppose.net
- DNS ASK pl####ntsuppose.net
- DNS ASK ne####arymister.net
- DNS ASK pl####ntmister.net
- DNS ASK he###river.net
- DNS ASK di####ultriver.net
- DNS ASK he####ervice.net
- DNS ASK di#####ltservice.net
- DNS ASK he####uppose.net
- DNS ASK di#####ltsuppose.net
- DNS ASK he###mister.net
- DNS ASK di####ultmister.net
- DNS ASK gl###river.net
- DNS ASK gl####ervice.net
- DNS ASK fo####darticle.net
- DNS ASK an####service.net
- DNS ASK gl####uppose.net
- DNS ASK an####suppose.net
- DNS ASK gl###mister.net
- DNS ASK an####mister.net
- DNS ASK fo####driver.net
- DNS ASK de###eriver.net
- DNS ASK fo####dservice.net
- DNS ASK de####service.net
- DNS ASK fo####dsuppose.net
- DNS ASK de####suppose.net
- DNS ASK fo####dmister.net
- DNS ASK de####mister.net
- DNS ASK re####article.net
- DNS ASK ne####arydried.net
- DNS ASK pl####ntdried.net
- DNS ASK he####rticle.net
- DNS ASK ge#####nderstand.net
- DNS ASK he####nderstand.net
- DNS ASK he####butter.net
- DNS ASK le####butter.net
- DNS ASK he####behind.net
- DNS ASK le####behind.net
- DNS ASK he###nbroad.net
- DNS ASK le###rbroad.net
- DNS ASK he#####nderstand.net
- DNS ASK le#####nderstand.net
- DNS ASK re####ebutter.net
- DNS ASK or###butter.net
- DNS ASK re####ebehind.net
- DNS ASK or###behind.net
- DNS ASK re####ebroad.net
- DNS ASK or###broad.net
- DNS ASK re#####understand.net
- DNS ASK or####nderstand.net
- DNS ASK ne####arybutter.net
- DNS ASK pl####ntbutter.net
- DNS ASK ne####arybehind.net
- DNS ASK pl####ntbehind.net
- DNS ASK ne####arybroad.net
- DNS ASK pl####ntbroad.net
- DNS ASK ne#####ryunderstand.net
- DNS ASK pl#####tunderstand.net
- DNS ASK he###butter.net
- DNS ASK di####ultbutter.net
- DNS ASK ge###ebroad.net
- DNS ASK ge####behind.net
- DNS ASK he###broad.net
- DNS ASK ge####butter.net
- DNS ASK di#####ltarticle.net
- DNS ASK va#####understand.net
- DNS ASK he###angry.net
- DNS ASK di####ultangry.net
- DNS ASK he####ifteen.net
- DNS ASK di#####ltfifteen.net
- DNS ASK he###dried.net
- DNS ASK di####ultdried.net
- DNS ASK gl####rticle.net
- DNS ASK an####article.net
- DNS ASK gl###angry.net
- DNS ASK an###rangry.net
- DNS ASK gl####ifteen.net
- DNS ASK an####fifteen.net
- DNS ASK gl###dried.net
- DNS ASK an###rriver.net
- DNS ASK ne#####ryservice.net
- DNS ASK de####article.net
- DNS ASK fo####dangry.net
- DNS ASK de###eangry.net
- DNS ASK fo####dfifteen.net
- DNS ASK de####fifteen.net
- DNS ASK fo####ddried.net
- DNS ASK de###edried.net
- DNS ASK re####butter.net
- DNS ASK va####sbutter.net
- DNS ASK re####behind.net
- DNS ASK va####sbehind.net
- DNS ASK re###nbroad.net
- DNS ASK va####sbroad.net
- DNS ASK re#####nderstand.net
- DNS ASK an###rdried.net
- DNS ASK pl####ntriver.net
Miscellaneous
Creates and executes the following
- 'C:\vogrsxehghhxrae\lrcmt4krmszeiny6ga.exe'
- 'C:\vogrsxehghhxrae\bjgykncomumh.exe'
- 'C:\vogrsxehghhxrae\rrgtmnczf.exe' "c:\vogrsxehghhxrae\bjgykncomumh.exe"
