Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Server Registrar Encrypting Reports' = '<SYSTEM32>\luvnomjbe.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Encryption Name Experience Solutions Hardware] 'ImagePath' = '<SYSTEM32>\luvnomjbe.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Encryption Name Experience Solutions Hardware] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\bbjnfqcpl.exe' "<SYSTEM32>\luvnomjbe.exe"
- '<SYSTEM32>\luvnomjbe.exe'
- '%TEMP%\o9svdtub2nvedbusqox22j.exe'
Executes the following:
- '%WINDIR%\Temp\o9svdtub2uaadb.exe' -r 48366 tcp
Modifies file system:
Creates the following files:
- <SYSTEM32>\lkifphtazbmac\run
- <SYSTEM32>\lkifphtazbmac\rng
- %WINDIR%\Temp\o9svdtub2uaadb.exe
- <SYSTEM32>\lkifphtazbmac\cfg
- <SYSTEM32>\bbjnfqcpl.exe
- %TEMP%\o9svdtub2nvedbusqox22j.exe
- <SYSTEM32>\lkifphtazbmac\tst
- <SYSTEM32>\luvnomjbe.exe
- <SYSTEM32>\lkifphtazbmac\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\bbjnfqcpl.exe
- <SYSTEM32>\luvnomjbe.exe
Deletes the following files:
- %WINDIR%\Temp\o9svdtub2uaadb.exe
- <DRIVERS>\etc\hosts
- %TEMP%\o9svdtub2nvedbusqox22j.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'fi###loor.net':80
- 'se###threw.net':80
- 'fi###hade.net':80
- 'pl###floor.net':80
- 'le###threw.net':80
- 'se###shade.net':80
- 'le###shade.net':80
- 'se###cross.net':80
- 'le###cross.net':80
- 'lr###floor.net':80
- 'vi###loor.net':80
- 'lr###shade.net':80
- 'vi###hade.net':80
- 'pl###threw.net':80
- 'fi###ross.net':80
- 'pl###shade.net':80
- 'fi###hrew.net':80
- 'pl###cross.net':80
- 'se###floor.net':80
- 'we###ross.net':80
- 've###ross.net':80
- 'we###hrew.net':80
- 've###hrew.net':80
- 'we###hade.net':80
- 've###loor.net':80
- 'pi###threw.net':80
- 've###hade.net':80
- 'we###loor.net':80
- 'fa###hrew.net':80
- 'to###ross.net':80
- 'le###floor.net':80
- 'to###hrew.net':80
- 'fa###ross.net':80
- 'to###loor.net':80
- 'fa###loor.net':80
- 'to###hade.net':80
- 'fa###hade.net':80
- 'vi###ross.net':80
- 'al###being.net':80
- 'ri###nstorm.net':80
- 'pr####tbottom.net':80
- 'ca####nbring.net':80
- 'mu###ise.net':80
- 'pi###pull.net':80
- 'mu###ull.net':80
- 'pi###noise.net':80
- 'mu###oise.net':80
- 'jo####ymeasure.net':80
- 'cr#####onaraminta.net':80
- 'ef###tbuilt.net':80
- 'th###while.net':80
- 'le###form.net':80
- 'ab###ell.net':80
- 'mo###olor.net':80
- 'mo###ugust.net':80
- 'mi###hown.net':80
- 'wa###ruit.net':80
- 'tr###shade.net':80
- 'yo###hade.net':80
- 'tr###cross.net':80
- 'yo###ross.net':80
- 'tr###floor.net':80
- 'vi###hrew.net':80
- 'lr###cross.net':80
- 'yo###loor.net':80
- 'lr###threw.net':80
- 'ta###ise.net':80
- 'wa###oise.net':80
- 'ta###ruit.net':80
- 'wa###ise.net':80
- 'ta###oise.net':80
- 'tr###threw.net':80
- 'yo###hrew.net':80
- 'wa###ull.net':80
- 'ta###ull.net':80
TCP:
HTTP GET requests:
- http://fi###loor.net/index.php
- http://se###threw.net/index.php
- http://fi###hade.net/index.php
- http://pl###floor.net/index.php
- http://le###threw.net/index.php
- http://se###shade.net/index.php
- http://le###shade.net/index.php
- http://se###cross.net/index.php
- http://le###cross.net/index.php
- http://lr###floor.net/index.php
- http://vi###loor.net/index.php
- http://lr###shade.net/index.php
- http://vi###hade.net/index.php
- http://pl###threw.net/index.php
- http://fi###ross.net/index.php
- http://pl###shade.net/index.php
- http://fi###hrew.net/index.php
- http://pl###cross.net/index.php
- http://se###floor.net/index.php
- http://we###ross.net/index.php
- http://ve###ross.net/index.php
- http://we###hrew.net/index.php
- http://ve###hrew.net/index.php
- http://we###hade.net/index.php
- http://ve###loor.net/index.php
- http://pi###threw.net/index.php
- http://ve###hade.net/index.php
- http://we###loor.net/index.php
- http://fa###hrew.net/index.php
- http://to###ross.net/index.php
- http://le###floor.net/index.php
- http://to###hrew.net/index.php
- http://fa###ross.net/index.php
- http://to###loor.net/index.php
- http://fa###loor.net/index.php
- http://to###hade.net/index.php
- http://fa###hade.net/index.php
- http://vi###ross.net/index.php
- http://al###being.net/index.php
- http://ri###nstorm.net/index.php
- http://pr####tbottom.net/index.php
- http://ca####nbring.net/index.php
- http://mu###ise.net/index.php
- http://pi###pull.net/index.php
- http://mu###ull.net/index.php
- http://pi###noise.net/index.php
- http://mu###oise.net/index.php
- http://jo####ymeasure.net/index.php
- http://cr#####onaraminta.net/index.php
- http://ef###tbuilt.net/index.php
- http://th###while.net/index.php
- http://le###form.net/index.php
- http://ab###ell.net/index.php
- http://mo###olor.net/index.php
- http://mo###ugust.net/index.php
- http://mi###hown.net/index.php
- http://wa###ruit.net/index.php
- http://tr###shade.net/index.php
- http://yo###hade.net/index.php
- http://tr###cross.net/index.php
- http://yo###ross.net/index.php
- http://tr###floor.net/index.php
- http://vi###hrew.net/index.php
- http://lr###cross.net/index.php
- http://yo###loor.net/index.php
- http://lr###threw.net/index.php
- http://ta###ise.net/index.php
- http://wa###oise.net/index.php
- http://ta###ruit.net/index.php
- http://wa###ise.net/index.php
- http://ta###oise.net/index.php
- http://tr###threw.net/index.php
- http://yo###hrew.net/index.php
- http://wa###ull.net/index.php
- http://ta###ull.net/index.php
UDP:
- DNS ASK se###threw.net
- DNS ASK le###threw.net
- DNS ASK pl###floor.net
- DNS ASK fi###loor.net
- DNS ASK se###cross.net
- DNS ASK le###shade.net
- DNS ASK se###floor.net
- DNS ASK le###cross.net
- DNS ASK se###shade.net
- DNS ASK fi###hade.net
- DNS ASK lr###floor.net
- DNS ASK vi###loor.net
- DNS ASK lr###shade.net
- DNS ASK vi###hade.net
- DNS ASK pl###threw.net
- DNS ASK fi###ross.net
- DNS ASK pl###shade.net
- DNS ASK fi###hrew.net
- DNS ASK pl###cross.net
- DNS ASK ve###ross.net
- DNS ASK we###hade.net
- DNS ASK ve###hrew.net
- DNS ASK we###ross.net
- DNS ASK ve###hade.net
- DNS ASK pi###threw.net
- DNS ASK mu###hrew.net
- DNS ASK we###loor.net
- DNS ASK ve###loor.net
- DNS ASK we###hrew.net
- DNS ASK fa###hrew.net
- DNS ASK to###ross.net
- DNS ASK le###floor.net
- DNS ASK to###hrew.net
- DNS ASK fa###ross.net
- DNS ASK to###loor.net
- DNS ASK fa###loor.net
- DNS ASK to###hade.net
- DNS ASK fa###hade.net
- DNS ASK vi###ross.net
- DNS ASK al###being.net
- DNS ASK ri###nstorm.net
- DNS ASK pr####tbottom.net
- DNS ASK ca####nbring.net
- DNS ASK mu###ise.net
- DNS ASK pi###pull.net
- DNS ASK mu###ull.net
- DNS ASK pi###noise.net
- DNS ASK mu###oise.net
- DNS ASK jo####ymeasure.net
- DNS ASK cr#####onaraminta.net
- DNS ASK ef###tbuilt.net
- DNS ASK th###while.net
- DNS ASK le###form.net
- DNS ASK ab###ell.net
- DNS ASK mo###olor.net
- DNS ASK mo###ugust.net
- DNS ASK mi###hown.net
- DNS ASK wa###ruit.net
- DNS ASK tr###shade.net
- DNS ASK yo###hade.net
- DNS ASK tr###cross.net
- DNS ASK yo###ross.net
- DNS ASK tr###floor.net
- DNS ASK vi###hrew.net
- DNS ASK lr###cross.net
- DNS ASK yo###loor.net
- DNS ASK lr###threw.net
- DNS ASK ta###ise.net
- DNS ASK wa###oise.net
- DNS ASK ta###ruit.net
- DNS ASK wa###ise.net
- DNS ASK ta###oise.net
- DNS ASK tr###threw.net
- DNS ASK yo###hrew.net
- DNS ASK wa###ull.net
- DNS ASK ta###ull.net
- '23#.#55.255.250':1900
