Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Computer Engine Logs Application] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Computer Engine Logs Application] 'ImagePath' = 'C:\axshlfnmbtb\renresrldba.exe'
Creates the following services
- 'Computer Engine Logs Application' C:\axshlfnmbtb\renresrldba.exe
Modifies file system
Creates the following files
- %WINDIR%\axshlfnmbtb\bviaokwrcz
- C:\axshlfnmbtb\bviaokwrcz
- C:\axshlfnmbtb\uvds6l08cryrteehv.exe
- C:\axshlfnmbtb\renresrldba.exe
- C:\axshlfnmbtb\ezfbykk.exe
Sets the 'hidden' attribute to the following files
- C:\axshlfnmbtb\renresrldba.exe
- C:\axshlfnmbtb\ezfbykk.exe
Deletes the following files
- %WINDIR%\axshlfnmbtb\bviaokwrcz
- C:\axshlfnmbtb\uvds6l08cryrteehv.exe
Substitutes the following files
- %WINDIR%\axshlfnmbtb\bviaokwrcz
Network activity
Connects to
- 'bu####ngmarket.net':80
- 'bu####ngreport.net':80
- 'bu####ngbeauty.net':80
- 'ev####ggarden.net':80
- 'st###report.net':80
- 'mi###report.net':80
- 'st###garden.net':80
- 'do####market.net':80
- 'do####beauty.net':80
- 'pr####garden.net':80
- 'br####beauty.net':80
- 'de####garden.net':80
- 'bu####ngmillion.net':80
- 'do####pleasure.net':80
TCP
HTTP GET requests
- http://bu####ngmarket.net/index.php
- http://bu####ngbeauty.net/index.php
- http://ev####ggarden.net/index.php
- http://mi###report.net/index.php
- http://st###garden.net/index.php
- http://do####market.net/index.php
- http://do####beauty.net/index.php
- http://pr####garden.net/index.php
- http://br####beauty.net/index.php
- http://de####garden.net/index.php
- http://bu####ngmillion.net/index.php
- http://do####pleasure.net/index.php
UDP
- DNS ASK st####thsquare.net
- DNS ASK ev####gtoward.net
- DNS ASK bu####ngtoward.net
- DNS ASK ou####ewhite.net
- DNS ASK mo####ntwhite.net
- DNS ASK ou####emillion.net
- DNS ASK mo####ntmillion.net
- DNS ASK ou####epleasure.net
- DNS ASK mo#####tpleasure.net
- DNS ASK ou####etoward.net
- DNS ASK mo####nttoward.net
- DNS ASK st####thgarden.net
- DNS ASK st####thbeauty.net
- DNS ASK st####threport.net
- DNS ASK st####thmarket.net
- DNS ASK de####garden.net
- DNS ASK pr####egarden.net
- DNS ASK de####beauty.net
- DNS ASK pr####ebeauty.net
- DNS ASK de####report.net
- DNS ASK pr####ereport.net
- DNS ASK de####market.net
- DNS ASK bu#####gpleasure.net
- DNS ASK bu####ngmillion.net
- DNS ASK fe###wwhite.net
- DNS ASK ev####gmillion.net
- DNS ASK fe####million.net
- DNS ASK fe####pleasure.net
- DNS ASK fe####toward.net
- DNS ASK pr###ywhite.net
- DNS ASK do###rwhite.net
- DNS ASK pr####million.net
- DNS ASK do####million.net
- DNS ASK pr####pleasure.net
- DNS ASK do####pleasure.net
- DNS ASK pr####toward.net
- DNS ASK do####toward.net
- DNS ASK mi###white.net
- DNS ASK st###white.net
- DNS ASK mi####illion.net
- DNS ASK st####illion.net
- DNS ASK mi####leasure.net
- DNS ASK st####leasure.net
- DNS ASK mi###toward.net
- DNS ASK st###toward.net
- DNS ASK ev####gwhite.net
- DNS ASK bu####ngwhite.net
- DNS ASK pr####emarket.net
- DNS ASK ev####gpleasure.net
- DNS ASK re####garden.net
- DNS ASK mi###market.net
- DNS ASK ev####ggarden.net
- DNS ASK bu####nggarden.net
- DNS ASK ev####gbeauty.net
- DNS ASK bu####ngbeauty.net
- DNS ASK ev####greport.net
- DNS ASK bu####ngreport.net
- DNS ASK ev####gmarket.net
- DNS ASK bu####ngmarket.net
- DNS ASK ou####egarden.net
- DNS ASK mo####ntgarden.net
- DNS ASK ou####ebeauty.net
- DNS ASK mo####ntbeauty.net
- DNS ASK ou####ereport.net
- DNS ASK mo####ntreport.net
- DNS ASK ou####emarket.net
- DNS ASK mo####ntmarket.net
- DNS ASK st###spread.net
- DNS ASK st####thspread.net
- DNS ASK st####eighbor.net
- DNS ASK st#####hneighbor.net
- DNS ASK st###square.net
- DNS ASK st###market.net
- DNS ASK st###report.net
- DNS ASK re####beauty.net
- DNS ASK mi###report.net
- DNS ASK br####beauty.net
- DNS ASK re####report.net
- DNS ASK br####report.net
- DNS ASK re####market.net
- DNS ASK br####market.net
- DNS ASK fe####garden.net
- DNS ASK fe####beauty.net
- DNS ASK fe####report.net
- DNS ASK fe####market.net
- DNS ASK pr####garden.net
- DNS ASK do####garden.net
- DNS ASK pr####beauty.net
- DNS ASK do####beauty.net
- DNS ASK pr####report.net
- DNS ASK do####report.net
- DNS ASK pr####market.net
- DNS ASK do####market.net
- DNS ASK mi###garden.net
- DNS ASK st###garden.net
- DNS ASK mi###beauty.net
- DNS ASK st###beauty.net
- DNS ASK br####garden.net
- DNS ASK do###ewhite.net
Miscellaneous
Creates and executes the following
- 'C:\axshlfnmbtb\uvds6l08cryrteehv.exe'
- 'C:\axshlfnmbtb\renresrldba.exe'
- 'C:\axshlfnmbtb\ezfbykk.exe' "c:\axshlfnmbtb\renresrldba.exe"
