Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Enumerator Diagnostic Key Store Health' = 'C:\jrujhnxdj\vwyvgbrqbz.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Fax Device Connections Power Encryption] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\jrujhnxdj\ihubkayjybzt.exe' "c:\jrujhnxdj\vwyvgbrqbz.exe"
- 'C:\jrujhnxdj\vwyvgbrqbz.exe'
- 'C:\jrujhnxdj\gaqj33j3yrbjixxyx.exe'
Modifies file system :
Creates the following files:
- C:\jrujhnxdj\vwyvgbrqbz.exe
- C:\jrujhnxdj\ihubkayjybzt.exe
- C:\jrujhnxdj\iar2zymur
- %WINDIR%\jrujhnxdj\hqin3hfdw6h4
- C:\jrujhnxdj\hqin3hfdw6h4
- C:\jrujhnxdj\gaqj33j3yrbjixxyx.exe
Sets the 'hidden' attribute to the following files:
- C:\jrujhnxdj\ihubkayjybzt.exe
- C:\jrujhnxdj\vwyvgbrqbz.exe
Deletes the following files:
- C:\jrujhnxdj\gaqj33j3yrbjixxyx.exe
- %WINDIR%\jrujhnxdj\hqin3hfdw6h4
Network activity:
Connects to:
- 'be###river.net':80
- 'kn####ervice.net':80
- 'be####ervice.net':80
- 'cr###mister.net':80
- 'su####mister.net':80
- 'kn###river.net':80
- 'kn####uppose.net':80
- 'me###rriver.net':80
- 'fo###wriver.net':80
- 'me####service.net':80
- 'be####uppose.net':80
- 'kn###mister.net':80
- 'be###mister.net':80
- 'su####suppose.net':80
- 'th####tservice.net':80
- 'wa####uppose.net':80
- 'th####tsuppose.net':80
- 'wa###river.net':80
- 'th####triver.net':80
- 'wa####ervice.net':80
- 'wa###mister.net':80
- 'cr####ervice.net':80
- 'su####service.net':80
- 'cr####uppose.net':80
- 'th####tmister.net':80
- 'cr###river.net':80
- 'su###rriver.net':80
- 'ex#####ncesuppose.net':80
- 'fr####uppose.net':80
- 'ex#####ncemister.net':80
- 'fr###river.net':80
- 'ex#####nceservice.net':80
- 'fr####ervice.net':80
- 'fr###mister.net':80
- 'pa###angry.net':80
- 'fi####ifteen.net':80
- 'pa####ifteen.net':80
- 'fi####rticle.net':80
- 'pa####rticle.net':80
- 'fi###angry.net':80
- 'ex####enceriver.net':80
- 'me####mister.net':80
- 'fo####mister.net':80
- 'al####yriver.net':80
- 'fo####service.net':80
- 'me####suppose.net':80
- 'fo####suppose.net':80
- 'ge####manriver.net':80
- 'ge#####ansuppose.net':80
- 'al####ymister.net':80
- 'ge####manmister.net':80
- 'al####yservice.net':80
- 'ge#####anservice.net':80
- 'al####ysuppose.net':80
TCP:
HTTP GET requests:
- http://be###river.net/index.php?me########
- http://kn####ervice.net/index.php?me########
- http://be####ervice.net/index.php?me########
- http://cr###mister.net/index.php?me########
- http://su####mister.net/index.php?me########
- http://kn###river.net/index.php?me########
- http://kn####uppose.net/index.php?me########
- http://me###rriver.net/index.php?me########
- http://fo###wriver.net/index.php?me########
- http://me####service.net/index.php?me########
- http://be####uppose.net/index.php?me########
- http://kn###mister.net/index.php?me########
- http://be###mister.net/index.php?me########
- http://su####suppose.net/index.php?me########
- http://th####tservice.net/index.php?me########
- http://wa####uppose.net/index.php?me########
- http://th####tsuppose.net/index.php?me########
- http://wa###river.net/index.php?me########
- http://th####triver.net/index.php?me########
- http://wa####ervice.net/index.php?me########
- http://wa###mister.net/index.php?me########
- http://cr####ervice.net/index.php?me########
- http://su####service.net/index.php?me########
- http://cr####uppose.net/index.php?me########
- http://th####tmister.net/index.php?me########
- http://cr###river.net/index.php?me########
- http://su###rriver.net/index.php?me########
- http://ex#####ncesuppose.net/index.php?me########
- http://fr####uppose.net/index.php?me########
- http://ex#####ncemister.net/index.php?me########
- http://fr###river.net/index.php?me########
- http://ex#####nceservice.net/index.php?me########
- http://fr####ervice.net/index.php?me########
- http://fr###mister.net/index.php?me########
- http://pa###angry.net/index.php?me########
- http://fi####ifteen.net/index.php?me########
- http://pa####ifteen.net/index.php?me########
- http://fi####rticle.net/index.php?me########
- http://pa####rticle.net/index.php?me########
- http://fi###angry.net/index.php?me########
- http://ex####enceriver.net/index.php?me########
- http://me####mister.net/index.php?me########
- http://fo####mister.net/index.php?me########
- http://al####yriver.net/index.php?me########
- http://fo####service.net/index.php?me########
- http://me####suppose.net/index.php?me########
- http://fo####suppose.net/index.php?me########
- http://ge####manriver.net/index.php?me########
- http://ge#####ansuppose.net/index.php?me########
- http://al####ymister.net/index.php?me########
- http://ge####manmister.net/index.php?me########
- http://al####yservice.net/index.php?me########
- http://ge#####anservice.net/index.php?me########
- http://al####ysuppose.net/index.php?me########
UDP:
- DNS ASK kn###river.net
- DNS ASK be###river.net
- DNS ASK kn####ervice.net
- DNS ASK su####suppose.net
- DNS ASK cr###mister.net
- DNS ASK su####mister.net
- DNS ASK be####ervice.net
- DNS ASK be###mister.net
- DNS ASK me###rriver.net
- DNS ASK fo###wriver.net
- DNS ASK kn####uppose.net
- DNS ASK be####uppose.net
- DNS ASK kn###mister.net
- DNS ASK cr####uppose.net
- DNS ASK wa####ervice.net
- DNS ASK th####tservice.net
- DNS ASK wa####uppose.net
- DNS ASK wo###mister.net
- DNS ASK wa###river.net
- DNS ASK th####triver.net
- DNS ASK th####tsuppose.net
- DNS ASK su###rriver.net
- DNS ASK cr####ervice.net
- DNS ASK su####service.net
- DNS ASK wa###mister.net
- DNS ASK th####tmister.net
- DNS ASK cr###river.net
- DNS ASK me####service.net
- DNS ASK ex#####ncesuppose.net
- DNS ASK fr####uppose.net
- DNS ASK ex#####ncemister.net
- DNS ASK fr###river.net
- DNS ASK ex#####nceservice.net
- DNS ASK fr####ervice.net
- DNS ASK fr###mister.net
- DNS ASK pa###angry.net
- DNS ASK fi####ifteen.net
- DNS ASK pa####ifteen.net
- DNS ASK fi####rticle.net
- DNS ASK pa####rticle.net
- DNS ASK fi###angry.net
- DNS ASK ex####enceriver.net
- DNS ASK me####mister.net
- DNS ASK fo####mister.net
- DNS ASK al####yriver.net
- DNS ASK fo####service.net
- DNS ASK me####suppose.net
- DNS ASK fo####suppose.net
- DNS ASK ge####manriver.net
- DNS ASK ge#####ansuppose.net
- DNS ASK al####ymister.net
- DNS ASK ge####manmister.net
- DNS ASK al####yservice.net
- DNS ASK ge#####anservice.net
- DNS ASK al####ysuppose.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
