Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Peer Publication Resolution' = 'C:\urs7bfkvrugvc\ah9alh0.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Collector Receiver Panel Protected Update] 'ImagePath' = 'C:\urs7bfkvrugvc\ah9alh0.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Collector Receiver Panel Protected Update] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\urs7bfkvrugvc\wibw4dmsmhn6e.exe' "c:\urs7bfkvrugvc\ah9alh0.exe"
- 'C:\urs7bfkvrugvc\ah9alh0.exe'
- 'C:\urs7bfkvrugvc\dwogoc2wbnk54go23nqybf.exe'
Modifies file system:
Creates the following files:
- C:\urs7bfkvrugvc\ah9alh0.exe
- C:\urs7bfkvrugvc\wibw4dmsmhn6e.exe
- C:\urs7bfkvrugvc\fpukbkr
- %WINDIR%\urs7bfkvrugvc\aggujsby
- C:\urs7bfkvrugvc\aggujsby
- C:\urs7bfkvrugvc\dwogoc2wbnk54go23nqybf.exe
Sets the 'hidden' attribute to the following files:
- C:\urs7bfkvrugvc\wibw4dmsmhn6e.exe
- C:\urs7bfkvrugvc\ah9alh0.exe
Deletes the following files:
- C:\urs7bfkvrugvc\dwogoc2wbnk54go23nqybf.exe
- %WINDIR%\urs7bfkvrugvc\aggujsby
Substitutes the following files:
- %WINDIR%\urs7bfkvrugvc\aggujsby
Network activity:
Connects to:
- 'ze######hbreckenridge.net':80
- 'ma#####kewashington.net':80
- 'ze#####ahwashington.net':80
- 'ze#####ahstrickland.net':80
- 'ca######abenjaminson.net':80
- 'kr######erbenjaminson.net':80
- 'ma#####kestrickland.net':80
- 'je######ebreckenridge.net':80
- 'ge#####vewashington.net':80
- 'je#####newashington.net':80
- 'ge######ebreckenridge.net':80
- 'ze######hwinterbottom.net':80
- 'ge#####vestrickland.net':80
- 'je#####nestrickland.net':80
- 'kr######ercartwright.net':80
- 'ma######anblackbourne.net':80
- 'ki#####eecartwright.net':80
- 'ma######ancartwright.net':80
- 'ki######eblackbourne.net':80
- 'ca######ebenjaminson.net':80
- 'ki#####eechancellor.net':80
- 'ma######anchancellor.net':80
- 'ca######ablackbourne.net':80
- 'kr######erblackbourne.net':80
- 'ca#####racartwright.net':80
- 'kr######erchancellor.net':80
- 'ki######ebenjaminson.net':80
- 'ma######anbenjaminson.net':80
- 'ca#####rachancellor.net':80
- 'ge######ewinterbottom.net':80
- 'ma######ebreckenridge.net':80
- 'an######ebreckenridge.net':80
- 'ma#####newashington.net':80
- 'an#####testrickland.net':80
- 'st######ewinterbottom.net':80
- 'ch######ewinterbottom.net':80
- 'ma#####nestrickland.net':80
- 'ca#####nastrickland.net':80
- 'ca######ebreckenridge.net':80
- 'ca######abreckenridge.net':80
- 'ca#####nestrickland.net':80
- 'an#####tewashington.net':80
- 'ma######ewinterbottom.net':80
- 'an######ewinterbottom.net':80
- 'ch#####tewashington.net':80
- 'ki######nbreckenridge.net':80
- 'gl#####lewashington.net':80
- 'ki#####ynwashington.net':80
- 'gl######ebreckenridge.net':80
- 'je######ewinterbottom.net':80
- 'gl#####lestrickland.net':80
- 'ki#####ynstrickland.net':80
- 'st######ebreckenridge.net':80
- 'ch######ebreckenridge.net':80
- 'st#####iewashington.net':80
- 'ch#####testrickland.net':80
- 'gl######ewinterbottom.net':80
- 'ki######nwinterbottom.net':80
- 'st#####iestrickland.net':80
TCP:
HTTP GET requests:
- http://ze######hbreckenridge.net/index.php
- http://ma#####kewashington.net/index.php
- http://ze#####ahwashington.net/index.php
- http://ze#####ahstrickland.net/index.php
- http://ca######abenjaminson.net/index.php
- http://kr######erbenjaminson.net/index.php
- http://ma#####kestrickland.net/index.php
- http://je######ebreckenridge.net/index.php
- http://ge#####vewashington.net/index.php
- http://je#####newashington.net/index.php
- http://ge######ebreckenridge.net/index.php
- http://ze######hwinterbottom.net/index.php
- http://ge#####vestrickland.net/index.php
- http://je#####nestrickland.net/index.php
- http://kr######ercartwright.net/index.php
- http://ma######anblackbourne.net/index.php
- http://ki#####eecartwright.net/index.php
- http://ma######ancartwright.net/index.php
- http://ki######eblackbourne.net/index.php
- http://ca######ebenjaminson.net/index.php
- http://ki#####eechancellor.net/index.php
- http://ma######anchancellor.net/index.php
- http://ca######ablackbourne.net/index.php
- http://kr######erblackbourne.net/index.php
- http://ca#####racartwright.net/index.php
- http://kr######erchancellor.net/index.php
- http://ki######ebenjaminson.net/index.php
- http://ma######anbenjaminson.net/index.php
- http://ca#####rachancellor.net/index.php
- http://ge######ewinterbottom.net/index.php
- http://ma######ebreckenridge.net/index.php
- http://an######ebreckenridge.net/index.php
- http://ma#####newashington.net/index.php
- http://an#####testrickland.net/index.php
- http://st######ewinterbottom.net/index.php
- http://ch######ewinterbottom.net/index.php
- http://ma#####nestrickland.net/index.php
- http://ca#####nastrickland.net/index.php
- http://ca######ebreckenridge.net/index.php
- http://ca######abreckenridge.net/index.php
- http://ca#####nestrickland.net/index.php
- http://an#####tewashington.net/index.php
- http://ma######ewinterbottom.net/index.php
- http://an######ewinterbottom.net/index.php
- http://ch#####tewashington.net/index.php
- http://ki######nbreckenridge.net/index.php
- http://gl#####lewashington.net/index.php
- http://ki#####ynwashington.net/index.php
- http://gl######ebreckenridge.net/index.php
- http://je######ewinterbottom.net/index.php
- http://gl#####lestrickland.net/index.php
- http://ki#####ynstrickland.net/index.php
- http://st######ebreckenridge.net/index.php
- http://ch######ebreckenridge.net/index.php
- http://st#####iewashington.net/index.php
- http://ch#####testrickland.net/index.php
- http://gl######ewinterbottom.net/index.php
- http://ki######nwinterbottom.net/index.php
- http://st#####iestrickland.net/index.php
UDP:
- DNS ASK ze#####ahstrickland.net
- DNS ASK ze######hbreckenridge.net
- DNS ASK ma#####kewashington.net
- DNS ASK ma#####kestrickland.net
- DNS ASK kr######ercartwright.net
- DNS ASK ca######abenjaminson.net
- DNS ASK kr######erbenjaminson.net
- DNS ASK ze#####ahwashington.net
- DNS ASK je######ebreckenridge.net
- DNS ASK ge#####vewashington.net
- DNS ASK je#####newashington.net
- DNS ASK ge######ebreckenridge.net
- DNS ASK ze######hwinterbottom.net
- DNS ASK ge#####vestrickland.net
- DNS ASK je#####nestrickland.net
- DNS ASK ki######eblackbourne.net
- DNS ASK ma######anblackbourne.net
- DNS ASK ki#####eecartwright.net
- DNS ASK ma######anchancellor.net
- DNS ASK ca#####nacartwright.net
- DNS ASK ca######ebenjaminson.net
- DNS ASK ki#####eechancellor.net
- DNS ASK ma######ancartwright.net
- DNS ASK ca######ablackbourne.net
- DNS ASK kr######erblackbourne.net
- DNS ASK ca#####racartwright.net
- DNS ASK kr######erchancellor.net
- DNS ASK ki######ebenjaminson.net
- DNS ASK ma######anbenjaminson.net
- DNS ASK ca#####rachancellor.net
- DNS ASK an#####testrickland.net
- DNS ASK ma######ebreckenridge.net
- DNS ASK an######ebreckenridge.net
- DNS ASK ma#####nestrickland.net
- DNS ASK ch#####tewashington.net
- DNS ASK st######ewinterbottom.net
- DNS ASK ch######ewinterbottom.net
- DNS ASK ma#####newashington.net
- DNS ASK ca#####nastrickland.net
- DNS ASK ca######ebreckenridge.net
- DNS ASK ca######abreckenridge.net
- DNS ASK ca#####nestrickland.net
- DNS ASK an#####tewashington.net
- DNS ASK ma######ewinterbottom.net
- DNS ASK an######ewinterbottom.net
- DNS ASK gl######ebreckenridge.net
- DNS ASK ki######nbreckenridge.net
- DNS ASK gl#####lewashington.net
- DNS ASK ki#####ynstrickland.net
- DNS ASK ge######ewinterbottom.net
- DNS ASK je######ewinterbottom.net
- DNS ASK gl#####lestrickland.net
- DNS ASK ki#####ynwashington.net
- DNS ASK st######ebreckenridge.net
- DNS ASK ch######ebreckenridge.net
- DNS ASK st#####iewashington.net
- DNS ASK ch#####testrickland.net
- DNS ASK gl######ewinterbottom.net
- DNS ASK ki######nwinterbottom.net
- DNS ASK st#####iestrickland.net
