Technical Information
Modifies file system
Creates the following files
- %TEMP%\uxeblnyywa.js
- %TEMP%\vybdkgi_25904.exe
- %TEMP%\vybdkgi_73245.exe
- %TEMP%\vybdkgi_59718.exe
Network activity
TCP
HTTP GET requests
- http://av###ix.com.br/mgw1Z9
- http://nk##ock.com/YVBz90
- http://st######tjewellery.co.uk/Wgb1kc
- http://se#########74-248-139.live-servers.net/fNgOsU
- http://we###mpo.com.br/mGX80k
- http://lk###estige.com/aR8LBr
- http://ra####yknickers.com/Ftko5D
- http://nu####vitamins.ca/twZLMm
- http://bu#######intandwallpaper.com/zhb1iJ
- http://fa####ecia.com.br/2CNiOa/
- http://fa####ecia.com.br/2CNiOa
- http://me####plyonline.com/8Y9Z1a
- http://wa######sformations.co.uk/9TOV5X
- http://st####fit.com.br/i3Dvy5
- http://wb####online.com/lKUYSO
- http://se####furniture.com/WLXTvD
- http://ph###onlamp.com/mqSfkV
- http://ho####fluggage.com/dcFPfq
- http://ae####ant.com.br/D0d34W
- http://as###nyc.com/ZLyoO2
- http://kb#.com.au/P6nsHZ
- http://ve###as.com.br/Z4HMtD
- http://po####irect.net.au/XMxmTv
- http://de#####looringltd.co.uk/7aVde2
UDP
- DNS ASK ro####egmeals.com
- DNS ASK fa####ecia.com.br
- DNS ASK bu#######intandwallpaper.com
- DNS ASK fa####racelets.com
- DNS ASK zi######gento.dealopia.com
- DNS ASK nu####vitamins.ca
- DNS ASK ra####yknickers.com
- DNS ASK br###heeezi.com
- DNS ASK wa######sformations.co.uk
- DNS ASK me####plyonline.com
- DNS ASK in####brasil.com.br
- DNS ASK se#########74-248-139.live-servers.net
- DNS ASK st######tjewellery.co.uk
- DNS ASK nk##ock.com
- DNS ASK pi#######b.cespecialties.com
- DNS ASK po####irect.net.au
- DNS ASK de#####looringltd.co.uk
- DNS ASK mr####online.com
- DNS ASK lk###estige.com
- DNS ASK we###mpo.com.br
- DNS ASK le######cyandsupply.com.sg
- DNS ASK st####fit.com.br
- DNS ASK pa####etwork.com
- DNS ASK av###ix.com.br
- DNS ASK ve###as.com.br
- DNS ASK ju####info.com.br
- DNS ASK pe#####buyutuculer.com
- DNS ASK kb#.com.au
- DNS ASK me#####ilavsiparisi.com
- DNS ASK ht####niture.com
- DNS ASK co#####rmuseumbd.com
- DNS ASK le###asari.com
- DNS ASK as###nyc.com
- DNS ASK ae####ant.com.br
- DNS ASK pa####dicrafts.com
- DNS ASK ho####fluggage.com
- DNS ASK xi##.com.sg
- DNS ASK ph###onlamp.com
- DNS ASK se####furniture.com
- DNS ASK wb####online.com
- DNS ASK ga####zoneuk.com
- DNS ASK sa####yonline.com
- DNS ASK bo###g.com.br
- DNS ASK lo####fbengal.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' %TEMP%\uxEBlnYYWA.js
