Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Modules Sharing Endpoint Base Thread Call' = 'C:\m6km2reofga\jswufacvs.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Store Security Encryption User-mode] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Store Security Encryption User-mode] 'ImagePath' = 'C:\m6km2reofga\jswufacvs.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\m6km2reofga\kmljxkwmsrm
- C:\m6km2reofga\kmljxkwmsrm
- C:\m6km2reofga\yj7xkrl33n3dkafuulso.exe
- C:\m6km2reofga\jswufacvs.exe
- C:\m6km2reofga\hz1duluy.exe
- C:\m6km2reofga\hypvqia
Sets the 'hidden' attribute to the following files:
- C:\m6km2reofga\jswufacvs.exe
- C:\m6km2reofga\hz1duluy.exe
Deletes the following files:
- %WINDIR%\m6km2reofga\kmljxkwmsrm
- C:\m6km2reofga\yj7xkrl33n3dkafuulso.exe
Substitutes the following files:
- %WINDIR%\m6km2reofga\kmljxkwmsrm
Network activity:
Connects to:
- 'ch#####lefairclough.net':80
- 'cl#####ndethelinda.net':80
- 'ch#####netatyanna.net':80
- 'cl#####ndtatyanna.net':80
- 'cr#####onesmeralda.net':80
- 'ja#####ynesmeralda.net':80
- 'cr#####onbeverley.net':80
- 'ja#####ynbeverley.net':80
- 'cr#####onethelinda.net':80
- 'ja#####ynethelinda.net':80
- 'cr#####ontatyanna.net':80
- 'ja#####yntatyanna.net':80
- 'ro#####neesmeralda.net':80
- 'ja#####taesmeralda.net':80
- 'ro#####nebeverley.net':80
- 'ja#####tabeverley.net':80
- 'ro#####neethelinda.net':80
- 'ja#####taethelinda.net':80
- 'ro#####netatyanna.net':80
- 'ja#####tatatyanna.net':80
- 'ha#####taesmeralda.net':80
- 'co#####ceesmeralda.net':80
- 'ha#####tabeverley.net':80
- 'co#####cebeverley.net':80
- 'ha#####taethelinda.net':80
- 'co#####ceethelinda.net':80
- 'ha#####tatatyanna.net':80
- 'co#####cetatyanna.net':80
- 'ch#####neethelinda.net':80
- 'ch#####taesmeralda.net':80
- 'cl#####ndbeverley.net':80
- 'cl#####ndesmeralda.net':80
- 'ge#####naaugustine.net':80
- 'ch#####leaugustine.net':80
- 'an#####letimothyson.net':80
- 'gu#####entimothyson.net':80
- 'an#####lefairbairn.net':80
- 'gu#####enfairbairn.net':80
- 'an#####lefairclough.net':80
- 'gu#####enfairclough.net':80
- 'an#####leaugustine.net':80
- 'gu#####enaugustine.net':80
- 'gw#####retimothyson.net':80
- 'ch#####antimothyson.net':80
- 'gw#####refairbairn.net':80
- 'ch#####anfairbairn.net':80
- 'gw#####refairclough.net':80
- 'ch#####anfairclough.net':80
- 'gw#####reaugustine.net':80
- 'ch#####anaugustine.net':80
- 'ch#####naesmeralda.net':80
- 'se#####anesmeralda.net':80
- 'ch#####nabeverley.net':80
- 'se#####anbeverley.net':80
- 'ch#####naethelinda.net':80
- 'se#####anethelinda.net':80
- 'ch#####natatyanna.net':80
- 'se#####antatyanna.net':80
- 'ch#####neesmeralda.net':80
- 'ch#####nebeverley.net':80
- 'ka#####raesmeralda.net':80
TCP:
HTTP GET requests:
- http://ch#####lefairclough.net/index.php
- http://cl#####ndethelinda.net/index.php
- http://ch#####netatyanna.net/index.php
- http://cl#####ndtatyanna.net/index.php
- http://cr#####onesmeralda.net/index.php
- http://ja#####ynesmeralda.net/index.php
- http://cr#####onbeverley.net/index.php
- http://ja#####ynbeverley.net/index.php
- http://cr#####onethelinda.net/index.php
- http://ja#####ynethelinda.net/index.php
- http://cr#####ontatyanna.net/index.php
- http://ja#####yntatyanna.net/index.php
- http://ro#####neesmeralda.net/index.php
- http://ja#####taesmeralda.net/index.php
- http://ro#####nebeverley.net/index.php
- http://ja#####tabeverley.net/index.php
- http://ro#####neethelinda.net/index.php
- http://ja#####taethelinda.net/index.php
- http://ro#####netatyanna.net/index.php
- http://ja#####tatatyanna.net/index.php
- http://ha#####taesmeralda.net/index.php
- http://co#####ceesmeralda.net/index.php
- http://ha#####tabeverley.net/index.php
- http://co#####cebeverley.net/index.php
- http://ha#####taethelinda.net/index.php
- http://co#####ceethelinda.net/index.php
- http://ha#####tatatyanna.net/index.php
- http://co#####cetatyanna.net/index.php
- http://ch#####neethelinda.net/index.php
- http://ch#####taesmeralda.net/index.php
- http://cl#####ndbeverley.net/index.php
- http://cl#####ndesmeralda.net/index.php
- http://ge#####naaugustine.net/index.php
- http://ch#####leaugustine.net/index.php
- http://an#####letimothyson.net/index.php
- http://gu#####entimothyson.net/index.php
- http://an#####lefairbairn.net/index.php
- http://gu#####enfairbairn.net/index.php
- http://an#####lefairclough.net/index.php
- http://gu#####enfairclough.net/index.php
- http://an#####leaugustine.net/index.php
- http://gu#####enaugustine.net/index.php
- http://gw#####retimothyson.net/index.php
- http://ch#####antimothyson.net/index.php
- http://gw#####refairbairn.net/index.php
- http://ch#####anfairbairn.net/index.php
- http://gw#####refairclough.net/index.php
- http://ch#####anfairclough.net/index.php
- http://gw#####reaugustine.net/index.php
- http://ch#####anaugustine.net/index.php
- http://ch#####naesmeralda.net/index.php
- http://se#####anesmeralda.net/index.php
- http://ch#####nabeverley.net/index.php
- http://se#####anbeverley.net/index.php
- http://ch#####naethelinda.net/index.php
- http://se#####anethelinda.net/index.php
- http://ch#####natatyanna.net/index.php
- http://se#####antatyanna.net/index.php
- http://ch#####neesmeralda.net/index.php
- http://ch#####nebeverley.net/index.php
- http://ka#####raesmeralda.net/index.php
UDP:
- DNS ASK ch#####lefairclough.net
- DNS ASK cl#####ndtatyanna.net
- DNS ASK cr#####onesmeralda.net
- DNS ASK ja#####ynesmeralda.net
- DNS ASK cr#####onbeverley.net
- DNS ASK ja#####ynbeverley.net
- DNS ASK cr#####onethelinda.net
- DNS ASK ja#####ynethelinda.net
- DNS ASK cr#####ontatyanna.net
- DNS ASK ja#####yntatyanna.net
- DNS ASK ro#####neesmeralda.net
- DNS ASK ja#####taesmeralda.net
- DNS ASK ro#####nebeverley.net
- DNS ASK gw#####refairclough.net
- DNS ASK ja#####tabeverley.net
- DNS ASK ja#####taethelinda.net
- DNS ASK ro#####netatyanna.net
- DNS ASK ja#####tatatyanna.net
- DNS ASK ha#####taesmeralda.net
- DNS ASK co#####ceesmeralda.net
- DNS ASK ha#####tabeverley.net
- DNS ASK co#####cebeverley.net
- DNS ASK ha#####taethelinda.net
- DNS ASK co#####ceethelinda.net
- DNS ASK ha#####tatatyanna.net
- DNS ASK co#####cetatyanna.net
- DNS ASK ch#####taesmeralda.net
- DNS ASK cl#####ndethelinda.net
- DNS ASK ch#####netatyanna.net
- DNS ASK ch#####neethelinda.net
- DNS ASK cl#####ndbeverley.net
- DNS ASK ch#####nebeverley.net
- DNS ASK ch#####leaugustine.net
- DNS ASK an#####letimothyson.net
- DNS ASK gu#####entimothyson.net
- DNS ASK an#####lefairbairn.net
- DNS ASK gu#####enfairbairn.net
- DNS ASK an#####lefairclough.net
- DNS ASK gu#####enfairclough.net
- DNS ASK an#####leaugustine.net
- DNS ASK gu#####enaugustine.net
- DNS ASK gw#####retimothyson.net
- DNS ASK ch#####antimothyson.net
- DNS ASK gw#####refairbairn.net
- DNS ASK ka#####raesmeralda.net
- DNS ASK ro#####neethelinda.net
- DNS ASK ch#####anfairbairn.net
- DNS ASK gw#####reaugustine.net
- DNS ASK ch#####anaugustine.net
- DNS ASK ch#####naesmeralda.net
- DNS ASK se#####anesmeralda.net
- DNS ASK ch#####nabeverley.net
- DNS ASK se#####anbeverley.net
- DNS ASK ch#####naethelinda.net
- DNS ASK se#####anethelinda.net
- DNS ASK ch#####natatyanna.net
- DNS ASK se#####antatyanna.net
- DNS ASK ch#####neesmeralda.net
- DNS ASK cl#####ndesmeralda.net
- DNS ASK ge#####naaugustine.net
- DNS ASK ch#####anfairclough.net
- DNS ASK ch#####tabeverley.net
Miscellaneous:
Creates and executes the following:
- 'C:\m6km2reofga\yj7xkrl33n3dkafuulso.exe'
- 'C:\m6km2reofga\jswufacvs.exe'
- 'C:\m6km2reofga\hz1duluy.exe' "c:\m6km2reofga\jswufacvs.exe"
