Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Information HomeGroup Protected Connect] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Information HomeGroup Protected Connect] 'ImagePath' = '%WINDIR%\ubafceaar.exe'
- [HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Creates the following services
- 'Information HomeGroup Protected Connect' %WINDIR%\ubafceaar.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode disable
Modifies file system
Creates the following files
- %WINDIR%\ytrkmpmxkydt\tst
- %TEMP%\zvxqhhllk2xhgxdwrafq.exe
- %WINDIR%\ubafceaar.exe
- %WINDIR%\mgiyoflsovp.exe
- %WINDIR%\ytrkmpmxkydt\rng
- %WINDIR%\ytrkmpmxkydt\run
- %WINDIR%\ytrkmpmxkydt\cfg
- %WINDIR%\temp\zvxqhhfcw7asgx.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\ubafceaar.exe
- %WINDIR%\mgiyoflsovp.exe
Deletes the following files
- %TEMP%\zvxqhhllk2xhgxdwrafq.exe
- %WINDIR%\temp\zvxqhhfcw7asgx.exe
Network activity
Connects to
- 'ri###nstorm.net':80
- 'wa###aily.net':80
- 'mo###lose.net':80
- 'wa###ose.net':80
- 'dr###blood.net':80
TCP
HTTP GET requests
- http://ri###nstorm.net/index.php
- http://wa###aily.net/index.php
- http://mo###lose.net/index.php
- http://wa###ose.net/index.php
- http://dr###blood.net/index.php
UDP
- DNS ASK or###thrown.net
- DNS ASK fo###lose.net
- DNS ASK af###full.net
- DNS ASK fo###full.net
- DNS ASK se###lood.net
- DNS ASK we####dayblood.net
- DNS ASK se###aily.net
- DNS ASK we####daydaily.net
- DNS ASK se###ose.net
- DNS ASK we####daylose.net
- DNS ASK fo###blood.net
- DNS ASK we####dayfull.net
- DNS ASK dr###blood.net
- DNS ASK af###lose.net
- DNS ASK na###lood.net
- DNS ASK na###aily.net
- DNS ASK dr###lose.net
- DNS ASK na###ose.net
- DNS ASK dr###full.net
- DNS ASK na###ull.net
- DNS ASK fi###hold.net
- DNS ASK qu###hold.net
- DNS ASK fi###second.net
- DNS ASK qu###second.net
- DNS ASK fi###ocean.net
- DNS ASK fo###daily.net
- DNS ASK af###daily.net
- DNS ASK dr###daily.net
- DNS ASK af###blood.net
- DNS ASK se###ull.net
- DNS ASK st###full.net
- DNS ASK se####strong.net
- DNS ASK si######edwerryhouse.net
- DNS ASK mo####gduring.net
- DNS ASK ch####nother.net
- DNS ASK gw#####ynhuddleston.net
- DNS ASK of####urprise.net
- DNS ASK ri###nstorm.net
- DNS ASK ef###tbuilt.net
- DNS ASK we###ull.net
- DNS ASK wa###lood.net
- DNS ASK qu###ocean.net
- DNS ASK th###while.net
- DNS ASK mo###lose.net
- DNS ASK wa###ose.net
- DNS ASK mo###full.net
- DNS ASK wa###ull.net
- DNS ASK st###blood.net
- DNS ASK we###lood.net
- DNS ASK st###daily.net
- DNS ASK we###aily.net
- DNS ASK st###lose.net
- DNS ASK we###ose.net
- DNS ASK mo###daily.net
- DNS ASK fi###have.net
- DNS ASK wa###aily.net
- DNS ASK de####promise.net
- DNS ASK jo####ymeasure.net
- '23#.#55.255.250':1900
- 'localhost':51613
- 'localhost':54736
Miscellaneous
Creates and executes the following
- '%TEMP%\zvxqhhllk2xhgxdwrafq.exe'
- '%WINDIR%\ubafceaar.exe'
- '%WINDIR%\mgiyoflsovp.exe' "%WINDIR%\ubafceaar.exe"
- '%WINDIR%\temp\zvxqhhfcw7asgx.exe' -r 29706 tcp
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode disable' (with hidden window)
- '%WINDIR%\temp\zvxqhhfcw7asgx.exe' -r 29706 tcp' (with hidden window)
