Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Service Device Now Controls' = 'C:\ui5s0gtoz\jzfacogob4.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Keying Controls Agent Interface PC Backup] 'ImagePath' = 'C:\ui5s0gtoz\jzfacogob4.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Keying Controls Agent Interface PC Backup] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\ui5s0gtoz\bc4uqx1ay.exe' "c:\ui5s0gtoz\jzfacogob4.exe"
- 'C:\ui5s0gtoz\jzfacogob4.exe'
- 'C:\ui5s0gtoz\kukjclr3dr8vyl6jughncnr.exe'
Modifies file system:
Creates the following files:
- C:\ui5s0gtoz\jzfacogob4.exe
- C:\ui5s0gtoz\bc4uqx1ay.exe
- C:\ui5s0gtoz\qod1c0if
- %WINDIR%\ui5s0gtoz\o36bnoiuq
- C:\ui5s0gtoz\o36bnoiuq
- C:\ui5s0gtoz\kukjclr3dr8vyl6jughncnr.exe
Sets the 'hidden' attribute to the following files:
- C:\ui5s0gtoz\bc4uqx1ay.exe
- C:\ui5s0gtoz\jzfacogob4.exe
Deletes the following files:
- C:\ui5s0gtoz\kukjclr3dr8vyl6jughncnr.exe
- %WINDIR%\ui5s0gtoz\o36bnoiuq
Network activity:
Connects to:
- 'kr#####herarkwright.net':80
- 'ca#####rahoneysett.net':80
- 'kr#####hersouthgate.net':80
- 'ca#####raarkwright.net':80
- 'ze#####ahharrelson.net':80
- 'ma#####kebannerman.net':80
- 'kr#####herhoneysett.net':80
- 'ma#####keharrelson.net':80
- 'ca#####rasouthgate.net':80
- 'ki#####eearkwright.net':80
- 'ma#####ianarkwright.net':80
- 'ki#####eesouthgate.net':80
- 'ma#####iansouthgate.net':80
- 'ca#####raroyceston.net':80
- 'kr#####herroyceston.net':80
- 'ki#####eehoneysett.net':80
- 'ma#####ianhoneysett.net':80
- 'ge#####vebroadbent.net':80
- 'je#####nebroadbent.net':80
- 'ge#####vesanderson.net':80
- 'je#####nesanderson.net':80
- 'gl#####lebannerman.net':80
- 'ki#####ynbannerman.net':80
- 'gl#####leharrelson.net':80
- 'ki#####ynharrelson.net':80
- 'je#####nebannerman.net':80
- 'ze#####ahsanderson.net':80
- 'ma#####kebroadbent.net':80
- 'ze#####ahbannerman.net':80
- 'ma#####kesanderson.net':80
- 'je#####neharrelson.net':80
- 'ge#####vebannerman.net':80
- 'ze#####ahbroadbent.net':80
- 'ge#####veharrelson.net':80
TCP:
HTTP GET requests:
- http://kr#####herarkwright.net/index.php
- http://ca#####rahoneysett.net/index.php
- http://kr#####hersouthgate.net/index.php
- http://ca#####raarkwright.net/index.php
- http://ze#####ahharrelson.net/index.php
- http://ma#####kebannerman.net/index.php
- http://kr#####herhoneysett.net/index.php
- http://ma#####keharrelson.net/index.php
- http://ca#####rasouthgate.net/index.php
- http://ki#####eearkwright.net/index.php
- http://ma#####ianarkwright.net/index.php
- http://ki#####eesouthgate.net/index.php
- http://ma#####iansouthgate.net/index.php
- http://ca#####raroyceston.net/index.php
- http://kr#####herroyceston.net/index.php
- http://ki#####eehoneysett.net/index.php
- http://ma#####ianhoneysett.net/index.php
- http://ge#####vebroadbent.net/index.php
- http://je#####nebroadbent.net/index.php
- http://ge#####vesanderson.net/index.php
- http://je#####nesanderson.net/index.php
- http://gl#####lebannerman.net/index.php
- http://ki#####ynbannerman.net/index.php
- http://gl#####leharrelson.net/index.php
- http://ki#####ynharrelson.net/index.php
- http://je#####nebannerman.net/index.php
- http://ze#####ahsanderson.net/index.php
- http://ma#####kebroadbent.net/index.php
- http://ze#####ahbannerman.net/index.php
- http://ma#####kesanderson.net/index.php
- http://je#####neharrelson.net/index.php
- http://ge#####vebannerman.net/index.php
- http://ze#####ahbroadbent.net/index.php
- http://ge#####veharrelson.net/index.php
UDP:
- DNS ASK ca#####raarkwright.net
- DNS ASK kr#####herarkwright.net
- DNS ASK ca#####rasouthgate.net
- DNS ASK kr#####hersouthgate.net
- DNS ASK ma#####keharrelson.net
- DNS ASK ze#####ahharrelson.net
- DNS ASK ca#####rahoneysett.net
- DNS ASK kr#####herhoneysett.net
- DNS ASK kr#####herroyceston.net
- DNS ASK ma#####iansouthgate.net
- DNS ASK ki#####eearkwright.net
- DNS ASK ma#####ianroyceston.net
- DNS ASK ki#####eesouthgate.net
- DNS ASK ma#####ianhoneysett.net
- DNS ASK ca#####raroyceston.net
- DNS ASK ma#####ianarkwright.net
- DNS ASK ki#####eehoneysett.net
- DNS ASK ma#####kebannerman.net
- DNS ASK ge#####vebroadbent.net
- DNS ASK je#####nebroadbent.net
- DNS ASK ge#####vesanderson.net
- DNS ASK je#####nesanderson.net
- DNS ASK gl#####lebannerman.net
- DNS ASK ki#####ynbannerman.net
- DNS ASK gl#####leharrelson.net
- DNS ASK ki#####ynharrelson.net
- DNS ASK je#####nebannerman.net
- DNS ASK ze#####ahsanderson.net
- DNS ASK ma#####kebroadbent.net
- DNS ASK ze#####ahbannerman.net
- DNS ASK ma#####kesanderson.net
- DNS ASK je#####neharrelson.net
- DNS ASK ge#####vebannerman.net
- DNS ASK ze#####ahbroadbent.net
- DNS ASK ge#####veharrelson.net
