Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Upgrade Propagation Device Workstation Alerts' = 'C:\obqfelqmsvn\bkcspytt.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Update Discovery Netlogon Extensible Redirector] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\obqfelqmsvn\ietacdixezh.exe' "c:\obqfelqmsvn\bkcspytt.exe"
- 'C:\obqfelqmsvn\bkcspytt.exe'
- 'C:\obqfelqmsvn\zi12p8frmwnfjwx.exe'
Modifies file system :
Creates the following files:
- C:\obqfelqmsvn\bkcspytt.exe
- C:\obqfelqmsvn\ietacdixezh.exe
- C:\obqfelqmsvn\jqneeznfs
- %WINDIR%\obqfelqmsvn\udh0nro8u
- C:\obqfelqmsvn\udh0nro8u
- C:\obqfelqmsvn\zi12p8frmwnfjwx.exe
Sets the 'hidden' attribute to the following files:
- C:\obqfelqmsvn\ietacdixezh.exe
- C:\obqfelqmsvn\bkcspytt.exe
Deletes the following files:
- C:\obqfelqmsvn\zi12p8frmwnfjwx.exe
- %WINDIR%\obqfelqmsvn\udh0nro8u
Network activity:
Connects to:
- 'ge####borrow.net':80
- 'he####delight.net':80
- 'le####delight.net':80
- 'ge###etrain.net':80
- 'va####sborrow.net':80
- 'ge####delight.net':80
- 'ge#####lectricity.net':80
- 'he#####lectricity.net':80
- 'le####borrow.net':80
- 're####edelight.net':80
- 'or####elight.net':80
- 'he####borrow.net':80
- 'le#####lectricity.net':80
- 'he###ntrain.net':80
- 'le###rtrain.net':80
- 're####borrow.net':80
- 'de####strike.net':80
- 'fo####dposition.net':80
- 'de####position.net':80
- 'fo####dstrike.net':80
- 'an####number.net':80
- 'fo####dpartial.net':80
- 'de####partial.net':80
- 'fo####dnumber.net':80
- 'va#####electricity.net':80
- 're###ntrain.net':80
- 'va####strain.net':80
- 're#####lectricity.net':80
- 'de####number.net':80
- 're####delight.net':80
- 'va####sdelight.net':80
- 're#####electricity.net':80
- 'di####ultborrow.net':80
- 'gl####elight.net':80
- 'an####delight.net':80
- 'he###borrow.net':80
- 'di######telectricity.net':80
- 'he###train.net':80
- 'di####ulttrain.net':80
- 'gl#####ectricity.net':80
- 'an####borrow.net':80
- 'fo####ddelight.net':80
- 'de####delight.net':80
- 'gl###borrow.net':80
- 'an#####lectricity.net':80
- 'gl###train.net':80
- 'an###rtrain.net':80
- 'he#####ectricity.net':80
- 'or###borrow.net':80
- 'ne#####rydelight.net':80
- 'pl####ntdelight.net':80
- 're####eborrow.net':80
- 'or#####ectricity.net':80
- 're####etrain.net':80
- 'or###train.net':80
- 'ne######yelectricity.net':80
- 'pl####ntborrow.net':80
- 'he####elight.net':80
- 'di#####ltdelight.net':80
- 'ne####aryborrow.net':80
- 'pl#####telectricity.net':80
- 'ne####arytrain.net':80
- 'pl####nttrain.net':80
TCP:
HTTP GET requests:
- http://ge####borrow.net/index.php?me########
- http://he####delight.net/index.php?me########
- http://le####delight.net/index.php?me########
- http://ge###etrain.net/index.php?me########
- http://va####sborrow.net/index.php?me########
- http://ge####delight.net/index.php?me########
- http://ge#####lectricity.net/index.php?me########
- http://he#####lectricity.net/index.php?me########
- http://le####borrow.net/index.php?me########
- http://re####edelight.net/index.php?me########
- http://or####elight.net/index.php?me########
- http://he####borrow.net/index.php?me########
- http://le#####lectricity.net/index.php?me########
- http://he###ntrain.net/index.php?me########
- http://le###rtrain.net/index.php?me########
- http://re####borrow.net/index.php?me########
- http://de####strike.net/index.php?me########
- http://fo####dposition.net/index.php?me########
- http://de####position.net/index.php?me########
- http://fo####dstrike.net/index.php?me########
- http://an####number.net/index.php?me########
- http://fo####dpartial.net/index.php?me########
- http://de####partial.net/index.php?me########
- http://fo####dnumber.net/index.php?me########
- http://va#####electricity.net/index.php?me########
- http://re###ntrain.net/index.php?me########
- http://va####strain.net/index.php?me########
- http://re#####lectricity.net/index.php?me########
- http://de####number.net/index.php?me########
- http://re####delight.net/index.php?me########
- http://va####sdelight.net/index.php?me########
- http://re#####electricity.net/index.php?me########
- http://di####ultborrow.net/index.php?me########
- http://gl####elight.net/index.php?me########
- http://an####delight.net/index.php?me########
- http://he###borrow.net/index.php?me########
- http://di######telectricity.net/index.php?me########
- http://he###train.net/index.php?me########
- http://di####ulttrain.net/index.php?me########
- http://gl#####ectricity.net/index.php?me########
- http://an####borrow.net/index.php?me########
- http://fo####ddelight.net/index.php?me########
- http://de####delight.net/index.php?me########
- http://gl###borrow.net/index.php?me########
- http://an#####lectricity.net/index.php?me########
- http://gl###train.net/index.php?me########
- http://an###rtrain.net/index.php?me########
- http://he#####ectricity.net/index.php?me########
- http://or###borrow.net/index.php?me########
- http://ne#####rydelight.net/index.php?me########
- http://pl####ntdelight.net/index.php?me########
- http://re####eborrow.net/index.php?me########
- http://or#####ectricity.net/index.php?me########
- http://re####etrain.net/index.php?me########
- http://or###train.net/index.php?me########
- http://ne######yelectricity.net/index.php?me########
- http://pl####ntborrow.net/index.php?me########
- http://he####elight.net/index.php?me########
- http://di#####ltdelight.net/index.php?me########
- http://ne####aryborrow.net/index.php?me########
- http://pl#####telectricity.net/index.php?me########
- http://ne####arytrain.net/index.php?me########
- http://pl####nttrain.net/index.php?me########
UDP:
- DNS ASK ge####borrow.net
- DNS ASK he####delight.net
- DNS ASK le####delight.net
- DNS ASK ge###etrain.net
- DNS ASK va####sborrow.net
- DNS ASK ge####delight.net
- DNS ASK ge#####lectricity.net
- DNS ASK he#####lectricity.net
- DNS ASK le####borrow.net
- DNS ASK re####edelight.net
- DNS ASK or####elight.net
- DNS ASK he####borrow.net
- DNS ASK le#####lectricity.net
- DNS ASK he###ntrain.net
- DNS ASK le###rtrain.net
- DNS ASK re####borrow.net
- DNS ASK de####strike.net
- DNS ASK fo####dposition.net
- DNS ASK de####position.net
- DNS ASK fo####dstrike.net
- DNS ASK an####number.net
- DNS ASK fo####dpartial.net
- DNS ASK de####partial.net
- DNS ASK fo####dnumber.net
- DNS ASK va#####electricity.net
- DNS ASK re###ntrain.net
- DNS ASK va####strain.net
- DNS ASK re#####lectricity.net
- DNS ASK de####number.net
- DNS ASK re####delight.net
- DNS ASK va####sdelight.net
- DNS ASK re#####electricity.net
- DNS ASK di####ultborrow.net
- DNS ASK gl####elight.net
- DNS ASK an####delight.net
- DNS ASK he###borrow.net
- DNS ASK di######telectricity.net
- DNS ASK he###train.net
- DNS ASK di####ulttrain.net
- DNS ASK gl#####ectricity.net
- DNS ASK an####borrow.net
- DNS ASK fo####ddelight.net
- DNS ASK de####delight.net
- DNS ASK gl###borrow.net
- DNS ASK an#####lectricity.net
- DNS ASK gl###train.net
- DNS ASK an###rtrain.net
- DNS ASK he#####ectricity.net
- DNS ASK or###borrow.net
- DNS ASK ne#####rydelight.net
- DNS ASK pl####ntdelight.net
- DNS ASK re####eborrow.net
- DNS ASK or#####ectricity.net
- DNS ASK re####etrain.net
- DNS ASK or###train.net
- DNS ASK ne######yelectricity.net
- DNS ASK pl####ntborrow.net
- DNS ASK he####elight.net
- DNS ASK di#####ltdelight.net
- DNS ASK ne####aryborrow.net
- DNS ASK pl#####telectricity.net
- DNS ASK ne####arytrain.net
- DNS ASK pl####nttrain.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
