Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WebClient Visual Publication BitLocker Software' = '<SYSTEM32>\lbxvvzz.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\DNS IP Interface WLAN Publication] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\eeytbuz.exe' "<SYSTEM32>\lbxvvzz.exe"
- '%WINDIR%\Temp\p60nbmwzb4cnwsl4z.exe' -r 22853 tcp
- '%TEMP%\p60nbmwzd2t90ol4znfdxmmns.exe'
- '<SYSTEM32>\lbxvvzz.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\bxvxhmxokvt\run
- <SYSTEM32>\bxvxhmxokvt\rng
- %WINDIR%\Temp\p60nbmwzb4cnwsl4z.exe
- <SYSTEM32>\bxvxhmxokvt\cfg
- %TEMP%\p60nbmwzd2t90ol4znfdxmmns.exe
- <SYSTEM32>\bxvxhmxokvt\tst
- <SYSTEM32>\eeytbuz.exe
- <SYSTEM32>\lbxvvzz.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\eeytbuz.exe
- <SYSTEM32>\lbxvvzz.exe
Deletes the following files:
- %WINDIR%\Temp\p60nbmwzb4cnwsl4z.exe
- %TEMP%\p60nbmwzd2t90ol4znfdxmmns.exe
Network activity:
Connects to:
- 'vi###ule.net':80
- 'lr###rule.net':80
- 'lr###hear.net':80
- 'pl###show.net':80
- 'vi###ear.net':80
- 'lr###show.net':80
- 'yo###ear.net':80
- 'vi###how.net':80
- 'vi###unt.net':80
- 'lr###hunt.net':80
- 'fi###ear.net':80
- 'pl###hear.net':80
- 'se###show.net':80
- 'se###hunt.net':80
- 'le###show.net':80
- 'pl###hunt.net':80
- 'fi###how.net':80
- 'fi###unt.net':80
- 'fi###ule.net':80
- 'pl###rule.net':80
- 'tr###hear.net':80
- 'ch####nother.net':80
- 'mo####gduring.net':80
- 'gw#####ynhuddleston.net':80
- 'ri###nstorm.net':80
- 'of####urprise.net':80
- 'jo####ymeasure.net':80
- 'or###thrown.net':80
- 'de####promise.net':80
- 'si######edwerryhouse.net':80
- 'se####strong.net':80
- 'tr###hunt.net':80
- 'yo###how.net':80
- 'yo###unt.net':80
- 'yo###ule.net':80
- 'tr###rule.net':80
- 'th###while.net':80
- 'ef###tbuilt.net':80
- 'wa###uter.net':80
- 'tr###show.net':80
- 'ta###uter.net':80
TCP:
HTTP GET requests:
- http://vi###ule.net/index.php
- http://lr###rule.net/index.php
- http://lr###hear.net/index.php
- http://pl###show.net/index.php
- http://vi###ear.net/index.php
- http://lr###show.net/index.php
- http://yo###ear.net/index.php
- http://vi###how.net/index.php
- http://vi###unt.net/index.php
- http://lr###hunt.net/index.php
- http://fi###ear.net/index.php
- http://pl###hear.net/index.php
- http://se###show.net/index.php
- http://se###hunt.net/index.php
- http://le###show.net/index.php
- http://pl###hunt.net/index.php
- http://fi###how.net/index.php
- http://fi###unt.net/index.php
- http://fi###ule.net/index.php
- http://pl###rule.net/index.php
- http://tr###hear.net/index.php
- http://ch####nother.net/index.php
- http://mo####gduring.net/index.php
- http://gw#####ynhuddleston.net/index.php
- http://ri###nstorm.net/index.php
- http://of####urprise.net/index.php
- http://jo####ymeasure.net/index.php
- http://or###thrown.net/index.php
- http://de####promise.net/index.php
- http://si######edwerryhouse.net/index.php
- http://se####strong.net/index.php
- http://tr###hunt.net/index.php
- http://yo###how.net/index.php
- http://yo###unt.net/index.php
- http://yo###ule.net/index.php
- http://tr###rule.net/index.php
- http://th###while.net/index.php
- http://ef###tbuilt.net/index.php
- http://wa###uter.net/index.php
- http://tr###show.net/index.php
- http://ta###uter.net/index.php
UDP:
- DNS ASK vi###ule.net
- DNS ASK lr###rule.net
- DNS ASK lr###hear.net
- DNS ASK pl###show.net
- DNS ASK vi###ear.net
- DNS ASK lr###show.net
- DNS ASK yo###ear.net
- DNS ASK vi###how.net
- DNS ASK vi###unt.net
- DNS ASK lr###hunt.net
- DNS ASK fi###how.net
- DNS ASK se###show.net
- DNS ASK fi###ear.net
- DNS ASK le###show.net
- DNS ASK le###hunt.net
- DNS ASK se###hunt.net
- DNS ASK fi###unt.net
- DNS ASK pl###hunt.net
- DNS ASK pl###rule.net
- DNS ASK pl###hear.net
- DNS ASK fi###ule.net
- DNS ASK tr###hear.net
- DNS ASK ch####nother.net
- DNS ASK mo####gduring.net
- DNS ASK gw#####ynhuddleston.net
- DNS ASK ri###nstorm.net
- DNS ASK of####urprise.net
- DNS ASK jo####ymeasure.net
- DNS ASK or###thrown.net
- DNS ASK de####promise.net
- DNS ASK si######edwerryhouse.net
- DNS ASK se####strong.net
- DNS ASK tr###hunt.net
- DNS ASK yo###how.net
- DNS ASK yo###unt.net
- DNS ASK yo###ule.net
- DNS ASK tr###rule.net
- DNS ASK th###while.net
- DNS ASK ef###tbuilt.net
- DNS ASK wa###uter.net
- DNS ASK tr###show.net
- DNS ASK ta###uter.net
- '23#.#55.255.250':1900
