Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'BitLocker Registrar TP' = '%APPDATA%\obqmirmiqwhfk\nbldvgxheg.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\obqmirmiqwhfk\jzvhlvv.exe' "%APPDATA%\obqmirmiqwhfk\nbldvgxheg.exe"
- '%APPDATA%\obqmirmiqwhfk\nbldvgxheg.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\obqmirmiqwhfk\nbldvgxheg.hvm
- %APPDATA%\obqmirmiqwhfk\jzvhlvv.exe
- %APPDATA%\obqmirmiqwhfk\nbldvgxheg.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\obqmirmiqwhfk\jzvhlvv.exe
- %APPDATA%\obqmirmiqwhfk\nbldvgxheg.exe
Network activity:
Connects to:
- 'de#####childhood.net':80
- 'li####object.net':80
- 'li####childhood.net':80
- 'be####station.net':80
- 'ri####station.net':80
- 'li####station.net':80
- 'de####ystation.net':80
- 'de####ythird.net':80
- 'de####yobject.net':80
- 'li###ethird.net':80
- 'ch####tation.net':80
- 'be####childhood.net':80
- 'th####tation.net':80
- 'th###third.net':80
- 'ch###third.net':80
- 'be###gthird.net':80
- 'ri###nthird.net':80
- 'ri####object.net':80
- 'ri####childhood.net':80
- 'be####object.net':80
- 'wo###listen.net':80
- 're####erbring.net':80
- 're####erlisten.net':80
- 're####erdemand.net':80
- 'wo###demand.net':80
- 'in####sedemand.net':80
- 'fo####demand.net':80
- 'fo###tshout.net':80
- 'wo###bring.net':80
- 'in####seshout.net':80
- 'jo####yobject.net':80
- 'hu####dthird.net':80
- 'hu####dobject.net':80
- 'hu#####childhood.net':80
- 'jo#####childhood.net':80
- 're####ershout.net':80
- 'wo###shout.net':80
- 'jo####ystation.net':80
- 'jo####ythird.net':80
- 'hu####dstation.net':80
TCP:
HTTP GET requests:
- de#####childhood.net/forum/search.php?em#######################################
- li####object.net/forum/search.php?em#######################################
- li####childhood.net/forum/search.php?em#######################################
- be####station.net/forum/search.php?em#######################################
- ri####station.net/forum/search.php?em#######################################
- li####station.net/forum/search.php?em#######################################
- de####ystation.net/forum/search.php?em#######################################
- de####ythird.net/forum/search.php?em#######################################
- de####yobject.net/forum/search.php?em#######################################
- li###ethird.net/forum/search.php?em#######################################
- ch####tation.net/forum/search.php?em#######################################
- be####childhood.net/forum/search.php?em#######################################
- th####tation.net/forum/search.php?em#######################################
- th###third.net/forum/search.php?em#######################################
- ch###third.net/forum/search.php?em#######################################
- be###gthird.net/forum/search.php?em#######################################
- ri###nthird.net/forum/search.php?em#######################################
- ri####object.net/forum/search.php?em#######################################
- ri####childhood.net/forum/search.php?em#######################################
- be####object.net/forum/search.php?em#######################################
- wo###listen.net/forum/search.php?em#######################################
- re####erbring.net/forum/search.php?em#######################################
- re####erlisten.net/forum/search.php?em#######################################
- re####erdemand.net/forum/search.php?em#######################################
- wo###demand.net/forum/search.php?em#######################################
- in####sedemand.net/forum/search.php?em#######################################
- fo####demand.net/forum/search.php?em#######################################
- fo###tshout.net/forum/search.php?em#######################################
- wo###bring.net/forum/search.php?em#######################################
- in####seshout.net/forum/search.php?em#######################################
- jo####yobject.net/forum/search.php?em#######################################
- hu####dthird.net/forum/search.php?em#######################################
- hu####dobject.net/forum/search.php?em#######################################
- hu#####childhood.net/forum/search.php?em#######################################
- jo#####childhood.net/forum/search.php?em#######################################
- re####ershout.net/forum/search.php?em#######################################
- wo###shout.net/forum/search.php?em#######################################
- jo####ystation.net/forum/search.php?em#######################################
- jo####ythird.net/forum/search.php?em#######################################
- hu####dstation.net/forum/search.php?em#######################################
UDP:
- DNS ASK li####childhood.net
- DNS ASK de#####childhood.net
- DNS ASK ri####station.net
- DNS ASK ri###nthird.net
- DNS ASK be####station.net
- DNS ASK de####ythird.net
- DNS ASK li####station.net
- DNS ASK li###ethird.net
- DNS ASK li####object.net
- DNS ASK de####yobject.net
- DNS ASK th####tation.net
- DNS ASK ch####tation.net
- DNS ASK ch###third.net
- DNS ASK ch###object.net
- DNS ASK th###third.net
- DNS ASK ri####object.net
- DNS ASK be###gthird.net
- DNS ASK be####object.net
- DNS ASK be####childhood.net
- DNS ASK ri####childhood.net
- DNS ASK de####ystation.net
- DNS ASK wo###listen.net
- DNS ASK re####erbring.net
- DNS ASK re####erlisten.net
- DNS ASK re####erdemand.net
- DNS ASK wo###demand.net
- DNS ASK in####sedemand.net
- DNS ASK fo####demand.net
- DNS ASK fo###tshout.net
- DNS ASK wo###bring.net
- DNS ASK in####seshout.net
- DNS ASK jo####yobject.net
- DNS ASK hu####dthird.net
- DNS ASK hu####dobject.net
- DNS ASK hu#####childhood.net
- DNS ASK jo#####childhood.net
- DNS ASK re####ershout.net
- DNS ASK wo###shout.net
- DNS ASK jo####ystation.net
- DNS ASK jo####ythird.net
- DNS ASK hu####dstation.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
