Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Redirector Interactive Registrar Center User-mode' = 'C:\szfxkoo\fw8rsahzebd.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Defragmenter Protocol Task Search Program] 'ImagePath' = 'C:\szfxkoo\fw8rsahzebd.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Defragmenter Protocol Task Search Program] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- C:\szfxkoo\fw8rsahzebd.exe
- C:\szfxkoo\bdkbrm9q.exe
- C:\szfxkoo\z1mocc
- %WINDIR%\szfxkoo\otksnmdin
- C:\szfxkoo\otksnmdin
- C:\szfxkoo\r2cfch2fg0mtjm0velewqu.exe
Sets the 'hidden' attribute to the following files:
- C:\szfxkoo\bdkbrm9q.exe
- C:\szfxkoo\fw8rsahzebd.exe
Deletes the following files:
- C:\szfxkoo\r2cfch2fg0mtjm0velewqu.exe
- %WINDIR%\szfxkoo\otksnmdin
Substitutes the following files:
- %WINDIR%\szfxkoo\otksnmdin
Network activity:
Connects to:
- 'an#####laharoldson.net':80
- 'ga#####ledonaldson.net':80
- 'ga#####leharoldson.net':80
- 'gr#####lepettigrew.net':80
- 'si#####erpettigrew.net':80
- 'an#####ladonaldson.net':80
- 'an#####lastrudwick.net':80
- 'ga#####laharoldson.net':80
- 'ga#####lestrudwick.net':80
- 'ga#####leconstable.net':80
- 'an#####laconstable.net':80
- 'si#####ersackville.net':80
- 'he#####onsackville.net':80
- 'kr#####lepettigrew.net':80
- 'kr#####lesackville.net':80
- 'kr#####lehoneycutt.net':80
- 'he#####onhoneycutt.net':80
- 'he#####onpettigrew.net':80
- 'si#####erhoneycutt.net':80
- 'gr#####lesackville.net':80
- 'gr#####lehoneycutt.net':80
- 'gr#####lefairchild.net':80
- 'si#####erfairchild.net':80
- 'ge#####neharoldson.net':80
- 'he#####taharoldson.net':80
- 'gr#####orstrudwick.net':80
- 'gr#####orconstable.net':80
- 'sh#####lestrudwick.net':80
- 'ge#####nedonaldson.net':80
- 'ge#####nestrudwick.net':80
- 'he#####tastrudwick.net':80
- 'he#####taconstable.net':80
- 'he#####tadonaldson.net':80
- 'ge#####neconstable.net':80
- 'sh#####leconstable.net':80
- 'ga#####laconstable.net':80
- 'br#####iaconstable.net':80
- 'br#####iadonaldson.net':80
- 'br#####iaharoldson.net':80
- 'ga#####ladonaldson.net':80
- 'ga#####lastrudwick.net':80
- 'sh#####ledonaldson.net':80
- 'gr#####ordonaldson.net':80
- 'gr#####orharoldson.net':80
- 'br#####iastrudwick.net':80
- 'sh#####leharoldson.net':80
TCP:
HTTP GET requests:
- http://an#####laharoldson.net/index.php
- http://ga#####ledonaldson.net/index.php
- http://ga#####leharoldson.net/index.php
- http://gr#####lepettigrew.net/index.php
- http://si#####erpettigrew.net/index.php
- http://an#####ladonaldson.net/index.php
- http://an#####lastrudwick.net/index.php
- http://ga#####laharoldson.net/index.php
- http://ga#####lestrudwick.net/index.php
- http://ga#####leconstable.net/index.php
- http://an#####laconstable.net/index.php
- http://si#####ersackville.net/index.php
- http://he#####onsackville.net/index.php
- http://kr#####lepettigrew.net/index.php
- http://kr#####lesackville.net/index.php
- http://kr#####lehoneycutt.net/index.php
- http://he#####onhoneycutt.net/index.php
- http://he#####onpettigrew.net/index.php
- http://si#####erhoneycutt.net/index.php
- http://gr#####lesackville.net/index.php
- http://gr#####lehoneycutt.net/index.php
- http://gr#####lefairchild.net/index.php
- http://si#####erfairchild.net/index.php
- http://ge#####neharoldson.net/index.php
- http://he#####taharoldson.net/index.php
- http://gr#####orstrudwick.net/index.php
- http://gr#####orconstable.net/index.php
- http://sh#####lestrudwick.net/index.php
- http://ge#####nedonaldson.net/index.php
- http://ge#####nestrudwick.net/index.php
- http://he#####tastrudwick.net/index.php
- http://he#####taconstable.net/index.php
- http://he#####tadonaldson.net/index.php
- http://ge#####neconstable.net/index.php
- http://sh#####leconstable.net/index.php
- http://ga#####laconstable.net/index.php
- http://br#####iaconstable.net/index.php
- http://br#####iadonaldson.net/index.php
- http://br#####iaharoldson.net/index.php
- http://ga#####ladonaldson.net/index.php
- http://ga#####lastrudwick.net/index.php
- http://sh#####ledonaldson.net/index.php
- http://gr#####ordonaldson.net/index.php
- http://gr#####orharoldson.net/index.php
- http://br#####iastrudwick.net/index.php
- http://sh#####leharoldson.net/index.php
UDP:
- DNS ASK an#####laharoldson.net
- DNS ASK ga#####ledonaldson.net
- DNS ASK ga#####leharoldson.net
- DNS ASK gr#####lepettigrew.net
- DNS ASK si#####erpettigrew.net
- DNS ASK an#####ladonaldson.net
- DNS ASK an#####lastrudwick.net
- DNS ASK ga#####laharoldson.net
- DNS ASK ga#####lestrudwick.net
- DNS ASK ga#####leconstable.net
- DNS ASK an#####laconstable.net
- DNS ASK si#####ersackville.net
- DNS ASK he#####onsackville.net
- DNS ASK kr#####lepettigrew.net
- DNS ASK kr#####lesackville.net
- DNS ASK kr#####lehoneycutt.net
- DNS ASK he#####onhoneycutt.net
- DNS ASK he#####onpettigrew.net
- DNS ASK si#####erhoneycutt.net
- DNS ASK gr#####lesackville.net
- DNS ASK gr#####lehoneycutt.net
- DNS ASK gr#####lefairchild.net
- DNS ASK si#####erfairchild.net
- DNS ASK ge#####neharoldson.net
- DNS ASK he#####taharoldson.net
- DNS ASK gr#####orstrudwick.net
- DNS ASK gr#####orconstable.net
- DNS ASK sh#####lestrudwick.net
- DNS ASK ge#####nedonaldson.net
- DNS ASK ge#####nestrudwick.net
- DNS ASK he#####tastrudwick.net
- DNS ASK he#####taconstable.net
- DNS ASK he#####tadonaldson.net
- DNS ASK ge#####neconstable.net
- DNS ASK sh#####leconstable.net
- DNS ASK ga#####laconstable.net
- DNS ASK br#####iaconstable.net
- DNS ASK br#####iadonaldson.net
- DNS ASK br#####iaharoldson.net
- DNS ASK ga#####ladonaldson.net
- DNS ASK ga#####lastrudwick.net
- DNS ASK sh#####ledonaldson.net
- DNS ASK gr#####ordonaldson.net
- DNS ASK gr#####orharoldson.net
- DNS ASK br#####iastrudwick.net
- DNS ASK sh#####leharoldson.net
Miscellaneous:
Creates and executes the following:
- 'C:\szfxkoo\bdkbrm9q.exe' "c:\szfxkoo\fw8rsahzebd.exe"
- 'C:\szfxkoo\fw8rsahzebd.exe'
- 'C:\szfxkoo\r2cfch2fg0mtjm0velewqu.exe'
