Technical Information
Modifies file system
Creates the following files
- %TEMP%\lygrbzviruec.js
- %TEMP%\nfchbmp_59411.exe
- %TEMP%\nfchbmp_95059.exe
- %TEMP%\nfchbmp_71616.exe
Network activity
Connects to
- 'lo###rana.com':7080
TCP
HTTP GET requests
- http://ti###fly.com/L5IJDi
- http://vi#####shairstore.com/oaS39q
- http://pa##ra.com/2h06OR
- http://hi####ket.com.ua/tsnuaA
- http://mu###mart.com/QyZkdj
- http://be#####irecttohome.com/0xdc4u
- http://sw###led.co.uk/lTKbdU
- http://lu###bling.com/UK0NdI
- http://th####ding.pictures/EnKLJk
- http://ma####obilya.com/1d9qpc
- http://gr####lounge.com/iwFqDz
UDP
- DNS ASK ti###fly.com
- DNS ASK ya##lom.ca
- DNS ASK ma####obilya.com
- DNS ASK te###-foni.com
- DNS ASK th####ding.pictures
- DNS ASK se###ecarts.com
- DNS ASK ch####utplanet.com
- DNS ASK lu###bling.com
- DNS ASK sw###led.co.uk
- DNS ASK gr####lounge.com
- DNS ASK be#####irecttohome.com
- DNS ASK hi####ket.com.ua
- DNS ASK li###orms.com
- DNS ASK pa##ra.com
- DNS ASK vi#####shairstore.com
- DNS ASK ir##ems.com
- DNS ASK te########dofgiftsandbargains.co.uk
- DNS ASK sa####boutique.com
- DNS ASK th#####dothanhly.com
- DNS ASK mu###mart.com
- DNS ASK lo###rana.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' %TEMP%\lYgrbzviruEc.js
