Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'KtmRm Task Adapter Host RPC WMI Group AuthIP' = 'C:\fjlxnibrszwkbus\ltmfbnecz.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\AutoConnect Provider Auto Modules Now] 'ImagePath' = 'C:\fjlxnibrszwkbus\ltmfbnecz.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\AutoConnect Provider Auto Modules Now] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\fjlxnibrszwkbus\zsjpowmmr.exe' "c:\fjlxnibrszwkbus\ltmfbnecz.exe"
- 'C:\fjlxnibrszwkbus\ltmfbnecz.exe'
- 'C:\fjlxnibrszwkbus\fvzq2znvdkwhlqtdl.exe'
Modifies file system:
Creates the following files:
- C:\fjlxnibrszwkbus\ltmfbnecz.exe
- C:\fjlxnibrszwkbus\zsjpowmmr.exe
- C:\fjlxnibrszwkbus\fvzq2znvdkwhlqtdl.exe
- %WINDIR%\fjlxnibrszwkbus\ixy5ypy
- C:\fjlxnibrszwkbus\ixy5ypy
Sets the 'hidden' attribute to the following files:
- C:\fjlxnibrszwkbus\zsjpowmmr.exe
- C:\fjlxnibrszwkbus\ltmfbnecz.exe
Deletes the following files:
- C:\fjlxnibrszwkbus\fvzq2znvdkwhlqtdl.exe
- %WINDIR%\fjlxnibrszwkbus\ixy5ypy
Substitutes the following files:
- %WINDIR%\fjlxnibrszwkbus\ixy5ypy
Network activity:
Connects to:
- 'ra####realize.net':80
- 'mo####gdollar.net':80
- 'ra####dollar.net':80
- 'hi####yshore.net':80
- 'st####eshore.net':80
- 'mo####grealize.net':80
- 'ra###rshore.net':80
- 'tw####realize.net':80
- 'mi####realize.net':80
- 'mo####gwritten.net':80
- 'ra####written.net':80
- 'mo####gshore.net':80
- 'st####ewritten.net':80
- 'we####rwritten.net':80
- 'am####written.net':80
- 'we####rshore.net':80
- 'am####realize.net':80
- 'we####rdollar.net':80
- 'am####dollar.net':80
- 'hi####ydollar.net':80
- 'st####edollar.net':80
- 'hi####ywritten.net':80
- 'am###tshore.net':80
- 'hi####yrealize.net':80
- 'st####erealize.net':80
- 'co####edollar.net':80
- 'ch###dollar.net':80
- 'co####ewritten.net':80
- 'of###shore.net':80
- 'co####erealize.net':80
- 'ch####ealize.net':80
- 'pr####trealize.net':80
- 'th####ealize.net':80
- 'pr####tdollar.net':80
- 'ch####ritten.net':80
- 'co####eshore.net':80
- 'ch###shore.net':80
- 'al###shore.net':80
- 'mi####written.net':80
- 'tw###eshore.net':80
- 'mi###eshore.net':80
- 'tw####dollar.net':80
- 'mi####dollar.net':80
- 'tw####written.net':80
- 'of###dollar.net':80
- 'al####ritten.net':80
- 'of####ritten.net':80
- 'al####ealize.net':80
- 'of####ealize.net':80
- 'al###dollar.net':80
TCP:
HTTP GET requests:
- http://ra####realize.net/index.php
- http://mo####gdollar.net/index.php
- http://ra####dollar.net/index.php
- http://hi####yshore.net/index.php
- http://st####eshore.net/index.php
- http://mo####grealize.net/index.php
- http://ra###rshore.net/index.php
- http://tw####realize.net/index.php
- http://mi####realize.net/index.php
- http://mo####gwritten.net/index.php
- http://ra####written.net/index.php
- http://mo####gshore.net/index.php
- http://st####ewritten.net/index.php
- http://we####rwritten.net/index.php
- http://am####written.net/index.php
- http://we####rshore.net/index.php
- http://am####realize.net/index.php
- http://we####rdollar.net/index.php
- http://am####dollar.net/index.php
- http://hi####ydollar.net/index.php
- http://st####edollar.net/index.php
- http://hi####ywritten.net/index.php
- http://am###tshore.net/index.php
- http://hi####yrealize.net/index.php
- http://st####erealize.net/index.php
- http://co####edollar.net/index.php
- http://ch###dollar.net/index.php
- http://co####ewritten.net/index.php
- http://of###shore.net/index.php
- http://co####erealize.net/index.php
- http://ch####ealize.net/index.php
- http://pr####trealize.net/index.php
- http://th####ealize.net/index.php
- http://pr####tdollar.net/index.php
- http://ch####ritten.net/index.php
- http://co####eshore.net/index.php
- http://ch###shore.net/index.php
- http://al###shore.net/index.php
- http://mi####written.net/index.php
- http://tw###eshore.net/index.php
- http://mi###eshore.net/index.php
- http://tw####dollar.net/index.php
- http://mi####dollar.net/index.php
- http://tw####written.net/index.php
- http://of###dollar.net/index.php
- http://al####ritten.net/index.php
- http://of####ritten.net/index.php
- http://al####ealize.net/index.php
- http://of####ealize.net/index.php
- http://al###dollar.net/index.php
UDP:
- DNS ASK mo####grealize.net
- DNS ASK ra####realize.net
- DNS ASK mo####gdollar.net
- DNS ASK st####ewritten.net
- DNS ASK hi####yshore.net
- DNS ASK st####eshore.net
- DNS ASK mo####gshore.net
- DNS ASK ra###rshore.net
- DNS ASK tw####realize.net
- DNS ASK ra####dollar.net
- DNS ASK mo####gwritten.net
- DNS ASK ra####written.net
- DNS ASK hi####ywritten.net
- DNS ASK am####dollar.net
- DNS ASK we####rwritten.net
- DNS ASK am####written.net
- DNS ASK we####rrealize.net
- DNS ASK am####realize.net
- DNS ASK we####rdollar.net
- DNS ASK st####erealize.net
- DNS ASK hi####ydollar.net
- DNS ASK st####edollar.net
- DNS ASK we####rshore.net
- DNS ASK am###tshore.net
- DNS ASK hi####yrealize.net
- DNS ASK mi####realize.net
- DNS ASK co####edollar.net
- DNS ASK ch###dollar.net
- DNS ASK co####ewritten.net
- DNS ASK of###shore.net
- DNS ASK co####erealize.net
- DNS ASK ch####ealize.net
- DNS ASK pr####trealize.net
- DNS ASK th####ealize.net
- DNS ASK pr####tdollar.net
- DNS ASK ch####ritten.net
- DNS ASK co####eshore.net
- DNS ASK ch###shore.net
- DNS ASK al###shore.net
- DNS ASK mi####written.net
- DNS ASK tw###eshore.net
- DNS ASK mi###eshore.net
- DNS ASK tw####dollar.net
- DNS ASK mi####dollar.net
- DNS ASK tw####written.net
- DNS ASK of###dollar.net
- DNS ASK al####ritten.net
- DNS ASK of####ritten.net
- DNS ASK al####ealize.net
- DNS ASK of####ealize.net
- DNS ASK al###dollar.net
