Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%LOCALAPPDATA%\bymlhdht\jfebrgqk.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'JfeBrgqk' = '%LOCALAPPDATA%\bymlhdht\jfebrgqk.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\jfebrgqk.exe
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Micorsoft Windows Service] 'ImagePath' = '%TEMP%\qqciudjw.sys'
Creates the following services
- 'Micorsoft Windows Service' %TEMP%\qqciudjw.sys
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
- Windows Update
- Windows Security Center
- Windows Defender
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\bkyvtisq.exe
- %ALLUSERSPROFILE%\xmyoitpf.log
- %LOCALAPPDATA%\klqtkfle.log
- %LOCALAPPDATA%\bymlhdht\jfebrgqk.exe
- %TEMP%\qqciudjw.sys
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\jfebrgqk.exe
Deletes the following files
- %TEMP%\qqciudjw.sys
Network activity
Connects to
- 'google.com':80
- 'vo#####uxkkmhbmuac.com':443
- 'su#####rwhjfxdqbt.com':443
- 'qu###xiga.com':443
- 'qb#####jlbetfrjfh.com':443
- 'aa####jyvxlosy.com':443
TCP
Other
- 'vo#####uxkkmhbmuac.com':443
- 'su#####rwhjfxdqbt.com':443
- 'qu###xiga.com':443
UDP
- DNS ASK google.com
- DNS ASK rn#####hmhcuewwvm.com
- DNS ASK ku####lhpqfxv.com
- DNS ASK ic###lgk.com
- DNS ASK bj###dybgv.com
- DNS ASK tn#####xenaqbdtavwq.com
- DNS ASK pj#####olyjcktcrt.com
- DNS ASK je#####otxdmsdii.com
- DNS ASK vk####rosfly.com
- DNS ASK xd###topx.com
- DNS ASK ji#####jbrmwcvux.com
- DNS ASK sd###kbhsk.com
- DNS ASK uw#####ixgltepqsfv.com
- DNS ASK th###fxfgq.com
- DNS ASK ku####glgmou.com
- DNS ASK ii#####fsmoxsdepvo.com
- DNS ASK eq####nvcyjwf.com
- DNS ASK io###quoujd.com
- DNS ASK nj#####ejmvkacla.com
- DNS ASK rc#####ppjmvcsiiqc.com
- DNS ASK er###nya.com
- DNS ASK ey#####lecqsgdghv.com
- DNS ASK sl#####uwfxnfweg.com
- DNS ASK ta####oqnuhxe.com
- DNS ASK cx#####phvqlduqqj.com
- DNS ASK oq####udrctwy.com
- DNS ASK nd###gecu.com
- DNS ASK qw###ygxhjr.com
- DNS ASK jd###bvkleb.com
- DNS ASK eq###gxi.com
- DNS ASK ea#####dokkgarfmuj.com
- DNS ASK sc###oelqc.com
- DNS ASK yw####ahywcmub.com
- DNS ASK ai####uwohodb.com
- DNS ASK vi###wqkq.com
- DNS ASK gd###inrnck.com
- DNS ASK cs#####weytrimmb.com
- DNS ASK kg#####ntvypekpui.com
- DNS ASK eq####khtelypr.com
- DNS ASK ek#####rwtnmkrgo.com
- DNS ASK cq####etbxkk.com
- DNS ASK la###ffr.com
- DNS ASK gl###fkwxhe.com
- DNS ASK cw####vnopquj.com
- DNS ASK cq####ajfpumhco.com
- DNS ASK ys####ufhioygn.com
- DNS ASK ku###cqp.com
- DNS ASK uf###werdk.com
- DNS ASK mw###cio.com
- DNS ASK nd####elkoxl.com
- DNS ASK vu#####tkqunkgkw.com
- DNS ASK av####ecjgcl.com
- DNS ASK fr####yrrpmddw.com
- DNS ASK un####yqmgiibda.com
- DNS ASK kw#####pbyvwrcifta.com
- DNS ASK rl###klmwx.com
- DNS ASK bp#####gdsvainlukh.com
- DNS ASK ih####xqfhdgin.com
- DNS ASK op###ynxck.com
- DNS ASK ux####arcnhlus.com
- DNS ASK pk###ajo.com
- DNS ASK aj#####rtfjosnhar.com
- DNS ASK da####dlrssoljn.com
- DNS ASK hu###jlmgv.com
- DNS ASK lp###yfmm.com
- DNS ASK rd###cksret.com
- DNS ASK se####tuhvjq.com
- DNS ASK tu#####wwampyvti.com
- DNS ASK vf####ugjnno.com
- DNS ASK vh####yfqdumdgp.com
- DNS ASK qq###xnu.com
- DNS ASK jn####tgfbvyau.com
- DNS ASK uu#####gktqwlknjopq.com
- DNS ASK xh####kuhtgxutw.com
- DNS ASK lv####jsoqwht.com
- DNS ASK wg###kqynja.com
- DNS ASK vg###xeg.com
- DNS ASK jj###cnoicy.com
- DNS ASK il####fajfic.com
- DNS ASK ms#####crhgwpkhvf.com
- DNS ASK ue####whtvakwu.com
- DNS ASK wc####cymbuias.com
- DNS ASK nx####gsgyen.com
- DNS ASK pg####awntkl.com
- DNS ASK dc#####ybjwxqqbwmfx.com
- DNS ASK np###duxgw.com
- DNS ASK sa###yntu.com
- DNS ASK ev###ixdu.com
- DNS ASK ay###algrtc.com
- DNS ASK vj###tboyk.com
- DNS ASK pg###ybbh.com
- DNS ASK lj#####bgcmlqqcq.com
- DNS ASK xm###sfii.com
- DNS ASK vt#####nxnmfekcrnwr.com
- DNS ASK en####ajylwox.com
- DNS ASK en####xewvfarre.com
- DNS ASK cy#####tjacflvfc.com
- DNS ASK tt####rmscppu.com
- DNS ASK wi####fmbvjs.com
- DNS ASK qx####lqgbohed.com
- DNS ASK fp####oxhcajs.com
- DNS ASK lu#####xfwyjlpnpig.com
- DNS ASK jm#####pmvbliuoqw.com
- DNS ASK aa####jyvxlosy.com
- DNS ASK tu####asasucgkv.com
- DNS ASK yy####ghkfwqpyq.com
- DNS ASK pe####kmewcix.com
- DNS ASK mr###wva.com
- DNS ASK we####bsrjjf.com
- DNS ASK vd####rwmhpvtw.com
- DNS ASK of###xwx.com
- DNS ASK si####sxureorb.com
- DNS ASK kp###ugumx.com
- DNS ASK sv####vugdxo.com
- DNS ASK ib#####odpyxmfhyk.com
- DNS ASK fy#####lnlaedmnew.com
- DNS ASK ri###mncox.com
- DNS ASK vk####pjiqwejsv.com
- DNS ASK pq#####thkuhlyoycp.com
- DNS ASK il#####vfabsxnodio.com
- DNS ASK bg###vwufi.com
- DNS ASK xa####olgpym.com
- DNS ASK fb####kvhcgp.com
- DNS ASK wv####xvdjag.com
- DNS ASK aj###vwcsnp.com
- DNS ASK wf###jxywb.com
- DNS ASK ot####ndkmwgak.com
- DNS ASK ma###rada.com
- DNS ASK fo#####ykmdxodav.com
- DNS ASK qu###xiga.com
- DNS ASK po####jnvfauh.com
- DNS ASK xp###lpguj.com
- DNS ASK sd####lyavjif.com
- DNS ASK su#####rwhjfxdqbt.com
- DNS ASK la###jvqc.com
- DNS ASK de#####paoywbeccng.com
- DNS ASK bj###vngsn.com
- DNS ASK gx###jxn.com
- DNS ASK hx###cpwyxh.com
- DNS ASK ii###gbo.com
- DNS ASK er###qeq.com
- DNS ASK oq####sfugms.com
- DNS ASK wv#####liuqbakkxry.com
- DNS ASK vu####bqnuot.com
- DNS ASK lq#####thqejaosnm.com
- DNS ASK iu####gmqgyf.com
- DNS ASK qb#####jlbetfrjfh.com
- DNS ASK gm#####jcwvaidubfha.com
- DNS ASK te#####ncexyhhulq.com
- DNS ASK vo#####uxkkmhbmuac.com
- DNS ASK ov###fobf.com
- DNS ASK fm####ycqcllrql.com
- DNS ASK bg#####pdfqnqppg.com
- DNS ASK dv###yqhomu.com
- DNS ASK nv#####shkovbheq.com
- DNS ASK er###tbw.com
- DNS ASK ep#####qkbedarpd.com
- DNS ASK sx#####caaprwyocm.com
- DNS ASK ps###fybl.com
- DNS ASK ha#####acvhhmngyg.com
- DNS ASK dl#####nvmmgtngihh.com
- DNS ASK gn#####dxnwrwqkwpp.com
- DNS ASK dq####ddwvllihp.com
- DNS ASK sq####wlslkv.com
- DNS ASK qp###xefbxv.com
- DNS ASK qv###knv.com
- DNS ASK wd####rgmluxb.com
- DNS ASK bw#####maylcusgj.com
- DNS ASK be###ootil.com
- DNS ASK el#####qujjsojmx.com
- DNS ASK yj###uva.com
- DNS ASK ah####mbxjqjon.com
- DNS ASK rb###ssmhcx.com
- DNS ASK ej###jdfvkh.com
- DNS ASK ch#####jcohrghodar.com
- DNS ASK kg####ycaynei.com
- DNS ASK mr####oxjgrnqm.com
- DNS ASK rd###vyaon.com
- DNS ASK kb###agf.com
- DNS ASK iw###pbwppg.com
- DNS ASK oo####wmyxunlr.com
- DNS ASK gc###bgura.com
- DNS ASK xl####tggmabhpp.com
- DNS ASK rd###uyxkh.com
- DNS ASK ox###xtyyr.com
- DNS ASK py####pajlxoeoc.com
- DNS ASK yc####htqeenpso.com
- DNS ASK ip#####knysfvomq.com
- DNS ASK go####gvolnkcpo.com
- DNS ASK wg###cdb.com
- DNS ASK cy#####pqdllvrxqu.com
- DNS ASK br####kmgndn.com
- DNS ASK oq####mhigjfw.com
- DNS ASK ge###kyac.com
- DNS ASK ec###nbib.com
- DNS ASK rd####tsxxsvkj.com
- DNS ASK dp####aikowymh.com
- DNS ASK rq#####mmahyxpfg.com
- DNS ASK kx#####oqnlfwfvisbb.com
- DNS ASK mq####itbbak.com
- DNS ASK ke####bypwgfqyg.com
- DNS ASK da###lbs.com
- 'localhost':58151
- 'localhost':59575
Miscellaneous
Creates and executes the following
- '%TEMP%\bkyvtisq.exe' elevate
- '%TEMP%\bkyvtisq.exe' admin
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\bkyvtisq.exe"" admin
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\bkyvtisq.exe"" admin' (with hidden window)
