Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Resource Resolution Time Copy Biometric' = 'C:\aaxoxfjpukb\jbf4evid.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Cryptographic DLL Location] 'ImagePath' = 'C:\aaxoxfjpukb\jbf4evid.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Cryptographic DLL Location] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\aaxoxfjpukb\kctwd53.exe' "c:\aaxoxfjpukb\jbf4evid.exe"
- 'C:\aaxoxfjpukb\jbf4evid.exe'
- 'C:\aaxoxfjpukb\veplrtew2vw0yhxzfndz.exe'
Modifies file system:
Creates the following files:
- C:\aaxoxfjpukb\jbf4evid.exe
- C:\aaxoxfjpukb\kctwd53.exe
- C:\aaxoxfjpukb\aywjltau
- %WINDIR%\aaxoxfjpukb\iuubzjt09g5
- C:\aaxoxfjpukb\iuubzjt09g5
- C:\aaxoxfjpukb\veplrtew2vw0yhxzfndz.exe
Sets the 'hidden' attribute to the following files:
- C:\aaxoxfjpukb\kctwd53.exe
- C:\aaxoxfjpukb\jbf4evid.exe
Deletes the following files:
- C:\aaxoxfjpukb\veplrtew2vw0yhxzfndz.exe
- %WINDIR%\aaxoxfjpukb\iuubzjt09g5
Network activity:
Connects to:
- 'ma#####neeccleston.net':80
- 'gr#####lepickering.net':80
- 'ma#####nepickering.net':80
- 'gr#####leeccleston.net':80
- 'ma#####negrenville.net':80
- 'gr#####legeorgeson.net':80
- 'ma#####negeorgeson.net':80
- 'ki#####eyeccleston.net':80
- 'je#####teeccleston.net':80
- 'ki#####eypickering.net':80
- 'je#####tegeorgeson.net':80
- 'ki#####eygrenville.net':80
- 'je#####tegrenville.net':80
- 'ki#####eygeorgeson.net':80
- 'gr#####legrenville.net':80
- 'ca#####nestevenson.net':80
- 'me#####herstevenson.net':80
- 'st#####iagrenville.net':80
- 'me#####hersamuelson.net':80
- 'ca#####nethompsett.net':80
- 'me#####herthompsett.net':80
- 'ca#####nesamuelson.net':80
- 'si#####teeccleston.net':80
- 'st#####iapickering.net':80
- 'si#####tepickering.net':80
- 'st#####iaeccleston.net':80
- 'si#####tegrenville.net':80
- 'st#####iageorgeson.net':80
- 'si#####tegeorgeson.net':80
- 'je#####tepickering.net':80
- 'wi#####edgeorgeson.net':80
- 'sy#####ereccleston.net':80
- 'wi#####edeccleston.net':80
- 'sy#####ergeorgeson.net':80
- 'ka#####napickering.net':80
- 'sy#####ergrenville.net':80
- 'wi#####edgrenville.net':80
- 'jo#####negeorgeson.net':80
- 'ma#####inegeorgeson.net':80
- 'jo#####neeccleston.net':80
- 'ma#####inegrenville.net':80
- 'sy#####erpickering.net':80
- 'wi#####edpickering.net':80
- 'jo#####negrenville.net':80
- 'br#####nnpickering.net':80
- 'gw#####yneccleston.net':80
- 'ha#####teeccleston.net':80
- 'gw#####ynpickering.net':80
- 'ha#####tegeorgeson.net':80
- 'gw#####yngrenville.net':80
- 'ha#####tegrenville.net':80
- 'gw#####yngeorgeson.net':80
- 'ka#####nageorgeson.net':80
- 'br#####nneccleston.net':80
- 'ka#####naeccleston.net':80
- 'br#####nngeorgeson.net':80
- 'ha#####tepickering.net':80
- 'br#####nngrenville.net':80
- 'ka#####nagrenville.net':80
TCP:
HTTP GET requests:
- http://ma#####neeccleston.net/index.php
- http://gr#####lepickering.net/index.php
- http://ma#####nepickering.net/index.php
- http://gr#####leeccleston.net/index.php
- http://ma#####negrenville.net/index.php
- http://gr#####legeorgeson.net/index.php
- http://ma#####negeorgeson.net/index.php
- http://ki#####eyeccleston.net/index.php
- http://je#####teeccleston.net/index.php
- http://ki#####eypickering.net/index.php
- http://je#####tegeorgeson.net/index.php
- http://ki#####eygrenville.net/index.php
- http://je#####tegrenville.net/index.php
- http://ki#####eygeorgeson.net/index.php
- http://gr#####legrenville.net/index.php
- http://ca#####nestevenson.net/index.php
- http://me#####herstevenson.net/index.php
- http://st#####iagrenville.net/index.php
- http://me#####hersamuelson.net/index.php
- http://ca#####nethompsett.net/index.php
- http://me#####herthompsett.net/index.php
- http://ca#####nesamuelson.net/index.php
- http://si#####teeccleston.net/index.php
- http://st#####iapickering.net/index.php
- http://si#####tepickering.net/index.php
- http://st#####iaeccleston.net/index.php
- http://si#####tegrenville.net/index.php
- http://st#####iageorgeson.net/index.php
- http://si#####tegeorgeson.net/index.php
- http://je#####tepickering.net/index.php
- http://wi#####edgeorgeson.net/index.php
- http://sy#####ereccleston.net/index.php
- http://wi#####edeccleston.net/index.php
- http://sy#####ergeorgeson.net/index.php
- http://ka#####napickering.net/index.php
- http://sy#####ergrenville.net/index.php
- http://wi#####edgrenville.net/index.php
- http://jo#####negeorgeson.net/index.php
- http://ma#####inegeorgeson.net/index.php
- http://jo#####neeccleston.net/index.php
- http://ma#####inegrenville.net/index.php
- http://sy#####erpickering.net/index.php
- http://wi#####edpickering.net/index.php
- http://jo#####negrenville.net/index.php
- http://br#####nnpickering.net/index.php
- http://gw#####yneccleston.net/index.php
- http://ha#####teeccleston.net/index.php
- http://gw#####ynpickering.net/index.php
- http://ha#####tegeorgeson.net/index.php
- http://gw#####yngrenville.net/index.php
- http://ha#####tegrenville.net/index.php
- http://gw#####yngeorgeson.net/index.php
- http://ka#####nageorgeson.net/index.php
- http://br#####nneccleston.net/index.php
- http://ka#####naeccleston.net/index.php
- http://br#####nngeorgeson.net/index.php
- http://ha#####tepickering.net/index.php
- http://br#####nngrenville.net/index.php
- http://ka#####nagrenville.net/index.php
UDP:
- DNS ASK gr#####leeccleston.net
- DNS ASK ma#####neeccleston.net
- DNS ASK gr#####lepickering.net
- DNS ASK ma#####negeorgeson.net
- DNS ASK gr#####legrenville.net
- DNS ASK ma#####negrenville.net
- DNS ASK gr#####legeorgeson.net
- DNS ASK ma#####nepickering.net
- DNS ASK ki#####eyeccleston.net
- DNS ASK je#####teeccleston.net
- DNS ASK ki#####eypickering.net
- DNS ASK je#####tegeorgeson.net
- DNS ASK ki#####eygrenville.net
- DNS ASK je#####tegrenville.net
- DNS ASK ki#####eygeorgeson.net
- DNS ASK me#####hersamuelson.net
- DNS ASK ca#####nestevenson.net
- DNS ASK me#####herstevenson.net
- DNS ASK ca#####nesamuelson.net
- DNS ASK me#####hercristians.net
- DNS ASK ca#####nethompsett.net
- DNS ASK me#####herthompsett.net
- DNS ASK st#####iagrenville.net
- DNS ASK si#####teeccleston.net
- DNS ASK st#####iapickering.net
- DNS ASK si#####tepickering.net
- DNS ASK st#####iaeccleston.net
- DNS ASK si#####tegrenville.net
- DNS ASK st#####iageorgeson.net
- DNS ASK si#####tegeorgeson.net
- DNS ASK sy#####ergeorgeson.net
- DNS ASK wi#####edgeorgeson.net
- DNS ASK sy#####ereccleston.net
- DNS ASK wi#####edgrenville.net
- DNS ASK br#####nnpickering.net
- DNS ASK ka#####napickering.net
- DNS ASK sy#####ergrenville.net
- DNS ASK wi#####edeccleston.net
- DNS ASK jo#####negeorgeson.net
- DNS ASK ma#####inegeorgeson.net
- DNS ASK jo#####neeccleston.net
- DNS ASK ma#####inegrenville.net
- DNS ASK sy#####erpickering.net
- DNS ASK wi#####edpickering.net
- DNS ASK jo#####negrenville.net
- DNS ASK ha#####tegeorgeson.net
- DNS ASK gw#####yneccleston.net
- DNS ASK ha#####teeccleston.net
- DNS ASK gw#####yngeorgeson.net
- DNS ASK je#####tepickering.net
- DNS ASK gw#####yngrenville.net
- DNS ASK ha#####tegrenville.net
- DNS ASK gw#####ynpickering.net
- DNS ASK ka#####nageorgeson.net
- DNS ASK br#####nneccleston.net
- DNS ASK ka#####naeccleston.net
- DNS ASK br#####nngeorgeson.net
- DNS ASK ha#####tepickering.net
- DNS ASK br#####nngrenville.net
- DNS ASK ka#####nagrenville.net
