Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Interactive Driver Keying WWAN' = '<SYSTEM32>\mnjjfbyb.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Awareness IPsec Video Filtering DHCP Client] 'ImagePath' = '<SYSTEM32>\mnjjfbyb.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Awareness IPsec Video Filtering DHCP Client] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Executes the following:
- '<SYSTEM32>\ubkdrlddwnbb.exe' "<SYSTEM32>\mnjjfbyb.exe"
- '%WINDIR%\Temp\gerlwmy2xv7cxrof.exe' -r 30612 tcp
- '%TEMP%\gerlwmy2nakcxrofpkuuvzw.exe'
- '<SYSTEM32>\mnjjfbyb.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\voakbwklc\run
- <SYSTEM32>\voakbwklc\rng
- %WINDIR%\Temp\gerlwmy2xv7cxrof.exe
- <SYSTEM32>\voakbwklc\cfg
- <SYSTEM32>\ubkdrlddwnbb.exe
- %TEMP%\gerlwmy2nakcxrofpkuuvzw.exe
- <SYSTEM32>\voakbwklc\tst
- <SYSTEM32>\mnjjfbyb.exe
- <SYSTEM32>\voakbwklc\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\ubkdrlddwnbb.exe
- <SYSTEM32>\mnjjfbyb.exe
Deletes the following files:
- %WINDIR%\Temp\gerlwmy2xv7cxrof.exe
- <DRIVERS>\etc\hosts
- %TEMP%\gerlwmy2nakcxrofpkuuvzw.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'we####daywing.net':80
- 'se###ing.net':80
- 'fo###fish.net':80
- 'se###ast.net':80
- 'we####daylady.net':80
- 'se###ady.net':80
- 'we####daypast.net':80
- 'af###past.net':80
- 'fo###wing.net':80
- 'af###wing.net':80
- 'fo###past.net':80
- 'af###fish.net':80
- 'fo###lady.net':80
- 'af###lady.net':80
- 'na###ish.net':80
- 'dr###fish.net':80
- 'na###ady.net':80
- 'lo###row.net':80
- 'so###ear.net':80
- 'lo###ear.net':80
- 'so###row.net':80
- 'dr###wing.net':80
- 'we####dayfish.net':80
- 'se###ish.net':80
- 'na###ing.net':80
- 'dr###lady.net':80
- 'na###ast.net':80
- 'dr###past.net':80
- 'we###ish.net':80
- 'le###lady.net':80
- 'fa###ast.net':80
- 'le###past.net':80
- 'fa###ady.net':80
- 'mo###wing.net':80
- 'fa###ish.net':80
- 'le###fish.net':80
- 'be##lxc.com':80
- 'af###sllc.com':80
- 'ri###nstorm.net':80
- 'de###lxc.com':80
- 'fa###ing.net':80
- 'le###wing.net':80
- 'ga###ish.net':80
- 'st###past.net':80
- 'we###ing.net':80
- 'st###wing.net':80
- 'we###ast.net':80
- 'st###fish.net':80
- 'we###ady.net':80
- 'st###lady.net':80
- 'wa###ast.net':80
- 'mo###past.net':80
- 'wa###ing.net':80
- 'mo###lady.net':80
- 'wa###ish.net':80
- 'mo###fish.net':80
- 'wa###ady.net':80
TCP:
HTTP GET requests:
- http://we####daywing.net/index.php
- http://se###ing.net/index.php
- http://fo###fish.net/index.php
- http://se###ast.net/index.php
- http://we####daylady.net/index.php
- http://se###ady.net/index.php
- http://we####daypast.net/index.php
- http://af###past.net/index.php
- http://fo###wing.net/index.php
- http://af###wing.net/index.php
- http://fo###past.net/index.php
- http://af###fish.net/index.php
- http://fo###lady.net/index.php
- http://af###lady.net/index.php
- http://na###ish.net/index.php
- http://dr###fish.net/index.php
- http://na###ady.net/index.php
- http://lo###row.net/index.php
- http://so###ear.net/index.php
- http://lo###ear.net/index.php
- http://so###row.net/index.php
- http://dr###wing.net/index.php
- http://we####dayfish.net/index.php
- http://se###ish.net/index.php
- http://na###ing.net/index.php
- http://dr###lady.net/index.php
- http://na###ast.net/index.php
- http://dr###past.net/index.php
- http://we###ish.net/index.php
- http://le###lady.net/index.php
- http://fa###ast.net/index.php
- http://le###past.net/index.php
- http://fa###ady.net/index.php
- http://mo###wing.net/index.php
- http://fa###ish.net/index.php
- http://le###fish.net/index.php
- http://be##lxc.com/index.php
- http://af###sllc.com/index.php
- http://ri###nstorm.net/index.php
- http://de###lxc.com/index.php
- http://fa###ing.net/index.php
- http://le###wing.net/index.php
- http://ga###ish.net/index.php
- http://st###past.net/index.php
- http://we###ing.net/index.php
- http://st###wing.net/index.php
- http://we###ast.net/index.php
- http://st###fish.net/index.php
- http://we###ady.net/index.php
- http://st###lady.net/index.php
- http://wa###ast.net/index.php
- http://mo###past.net/index.php
- http://wa###ing.net/index.php
- http://mo###lady.net/index.php
- http://wa###ish.net/index.php
- http://mo###fish.net/index.php
- http://wa###ady.net/index.php
UDP:
- DNS ASK we####daywing.net
- DNS ASK se###ing.net
- DNS ASK fo###fish.net
- DNS ASK se###ast.net
- DNS ASK we####daylady.net
- DNS ASK se###ady.net
- DNS ASK we####daypast.net
- DNS ASK af###past.net
- DNS ASK fo###wing.net
- DNS ASK af###wing.net
- DNS ASK fo###past.net
- DNS ASK af###fish.net
- DNS ASK fo###lady.net
- DNS ASK af###lady.net
- DNS ASK se###ish.net
- DNS ASK lo###row.net
- DNS ASK na###ish.net
- DNS ASK dr###fish.net
- DNS ASK so###row.net
- DNS ASK lo###hank.net
- DNS ASK so###ear.net
- DNS ASK lo###ear.net
- DNS ASK na###ing.net
- DNS ASK dr###wing.net
- DNS ASK we####dayfish.net
- DNS ASK dr###past.net
- DNS ASK na###ady.net
- DNS ASK dr###lady.net
- DNS ASK na###ast.net
- DNS ASK we###ish.net
- DNS ASK le###lady.net
- DNS ASK fa###ast.net
- DNS ASK le###past.net
- DNS ASK fa###ady.net
- DNS ASK mo###wing.net
- DNS ASK fa###ish.net
- DNS ASK le###fish.net
- DNS ASK be##lxc.com
- DNS ASK af###sllc.com
- DNS ASK ri###nstorm.net
- DNS ASK de###lxc.com
- DNS ASK fa###ing.net
- DNS ASK le###wing.net
- DNS ASK ga###ish.net
- DNS ASK st###past.net
- DNS ASK we###ing.net
- DNS ASK st###wing.net
- DNS ASK we###ast.net
- DNS ASK st###fish.net
- DNS ASK we###ady.net
- DNS ASK st###lady.net
- DNS ASK wa###ast.net
- DNS ASK mo###past.net
- DNS ASK wa###ing.net
- DNS ASK mo###lady.net
- DNS ASK wa###ish.net
- DNS ASK mo###fish.net
- DNS ASK wa###ady.net
- '23#.#55.255.250':1900
