Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Network activity:
Connects to:
- 'so####re-select.nl':80
- 'qr#p.us':80
- 'op####unitycup.com':80
- 'vo####rbrendan.me':80
- 'vo####rbrendan.us':80
- 'el###rosim.ro':80
- 'ne###nsult.by':80
- 'sh###media.com':80
- 'ma####elacasse.ca':80
- 'ay##zee.biz':80
- 'vo####rbrendan.biz':80
- 'be####yourtown.info':80
- 'bu#####gulamaoteli.com':80
- 'po#####efxstudio.co.uk':80
- 'me###loto.ru':80
- 'ca###imonte.ua':80
- 'at#####cequine.org.nz':80
- 'vo####rbrendan.info':80
- 'xn######ckeg1db2a.xn--p1ai':80
- 'pe##as.ru':80
- 'pr####tprovider.nl':80
- 'ro###iznesa.ru':80
- 'bo#o.by':80
- 'my####rnalip.com':80
- 'ip##ddr.es':80
- 'pa########tsgroomingacademy.co.uk':80
- 'cu###yip.com':80
- 'be###tv.com.tr':80
- 'vo####rbrendan.mobi':80
- 'z-#n.ru':80
- 'di###emodels.ru':80
- 'ob####vografico.es':80
- 'di####trailer.us':80
- 'dk##rma.ru':80
- 'ga###nddeli.com':80
- 'if###esti.ro':80
TCP:
HTTP GET requests:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
HTTP POST requests:
- http://qr#p.us/wp-content/themes/twentyfifteen/Bamzho.php?f=###############
- http://so####re-select.nl/wp-content/themes/genesis/qMfFUp.php?o=###############
- http://vo####rbrendan.us/wp-content/plugins/wordpress-importer/NyUkLc.php?h=###############
- http://ma####elacasse.ca/wp-content/plugins/symple-shortcodes/EmATUG.php?z=###############
- http://sh###media.com/wp-content/uploads/2015/09/9rjMyJ.php?u=###############
- http://vo####rbrendan.me/wp-content/themes/twentyfourteen/pYE7yW.php?z=###############
- http://me###loto.ru/wp-content/themes/Velluce/IzOSnD.php?v=###############
- http://ca###imonte.ua/wp-content/plugins/cherry-plugin/PLlfEN.php?q=###############
- http://pe##as.ru/wp-content/themes/twentytwelve/uQYbdq.php?s=###############
- http://op####unitycup.com/media/editors/tinymce/jscripts/tiny_mce/plugins/contextmenu/InyfWv.php?m=###############
- http://ca###imonte.ua/wp-content/plugins/cherry-plugin/D3sOjY.php?d=###############
- http://vo####rbrendan.mobi/wp-content/plugins/contact-form-7/t1TrNk.php?n=###############
- http://ro###iznesa.ru/wp-content/plugins/tw-recent-posts-widget/d30UGa.php?b=###############
- http://ob####vografico.es/wp-content/themes/book-store%20backup/BhRfIp.php?j=###############
- http://if###esti.ro/wp-content/plugins/navayan-subscribe/SYbJT9.php?c=###############
- http://ga###nddeli.com/media/editors/tinymce/jscripts/tiny_mce/plugins/paste/GbWzVt.php?z=###############
- http://be###tv.com.tr/wp-content/plugins/newsletter/4dMplH.php?y=###############
- http://ne###nsult.by/wp-content/plugins/all-in-one-seo-pack/JqT9Ls.php?d=###############
- http://el###rosim.ro/wp-content/plugins/contact-form-7/CwR04H.php?u=###############
- http://z-#n.ru/wp-content/plugins/wp-lightbox-2/107iNE.php?a=###############
- http://bo#o.by/wp-content/plugins/akismet/4BWtIF.php?a=###############
- http://di###emodels.ru/tmp/install_534f08d496bdb/tinymce/js/tinymce/plugins/b<Auxiliary name>/GAwCYO.php?p=###############
- http://di####trailer.us/wp-content/plugins/advanced-excerpt/1VtP3W.php?q=###########
- http://if###esti.ro/wp-content/plugins/navayan-subscribe/SYbJT9.php?d=###########
- http://dk##rma.ru/wp-content/themes/dk/Sp6u0B.php?m=###########
- http://ro###iznesa.ru/wp-content/plugins/tw-recent-posts-widget/ILEKUM.php?o=###########
- http://pr####tprovider.nl/wp-content/uploads/genesis-extender/plugin/images/HaryfG.php?w=###########
- http://ga###nddeli.com/media/editors/tinymce/jscripts/tiny_mce/plugins/paste/GbWzVt.php?z=###########
- http://be###tv.com.tr/wp-content/plugins/newsletter/4dMplH.php?b=###########
- http://bo#o.by/wp-content/plugins/akismet/4BWtIF.php?i=###########
- http://ro###iznesa.ru/wp-content/plugins/tw-recent-posts-widget/d30UGa.php?s=###########
- http://ob####vografico.es/wp-content/themes/book-store%20backup/BhRfIp.php?b=###########
- http://vo####rbrendan.mobi/wp-content/plugins/contact-form-7/t1TrNk.php?u=###########
- http://vo####rbrendan.biz/wp-content/themes/twentyfifteen/pLXtNm.php?e=###############
- http://ay##zee.biz/wp-content/plugins/max-banner-ads-pro/5Yfhdr.php?y=###############
- http://po#####efxstudio.co.uk/wp-content/themes/spacious/DiJv3L.php?d=###############
- http://vo####rbrendan.info/wp-content/themes/genesis/t58Esq.php?i=###############
- http://at#####cequine.org.nz/wp-content/themes/poloraytheme/functions/HdIC_W.php?k=###############
- http://bu#####gulamaoteli.com/wp-content/themes/welcome_inn-parent/framework/extensions/contactform/static/VNtDfl.php?d=###############
- http://pe##as.ru/wp-content/themes/twentytwelve/6x_nV5.php?q=###########
- http://xn######ckeg1db2a.xn--p1ai/wp-content/plugins/shortcodes-ultimate/hntNzB.php?t=###########
- http://bo#o.by/wp-content/plugins/akismet/O_xjRv.php?w=###########
- http://be####yourtown.info/wp-content/themes/toommoreltheme/_pH5Ck.php?f=###############
- http://pa########tsgroomingacademy.co.uk/wp-content/plugins/slideshow-jquery-image-gallery/7sinRu.php?j=###########
- http://di####trailer.us/wp-content/plugins/advanced-excerpt/1VtP3W.php?t=###############
- http://bo#o.by/wp-content/plugins/akismet/4BWtIF.php?u=############
- http://di###emodels.ru/tmp/install_534f08d496bdb/tinymce/js/tinymce/plugins/b<Auxiliary name>/GAwCYO.php?y=############
- http://be###tv.com.tr/wp-content/plugins/newsletter/4dMplH.php?e=############
- http://vo####rbrendan.mobi/wp-content/plugins/contact-form-7/t1TrNk.php?k=############
- http://ro###iznesa.ru/wp-content/plugins/tw-recent-posts-widget/d30UGa.php?k=############
- http://z-#n.ru/wp-content/plugins/wp-lightbox-2/107iNE.php?n=############
- http://sh###media.com/wp-content/uploads/2015/09/9rjMyJ.php?d=############
- http://vo####rbrendan.us/wp-content/plugins/wordpress-importer/NyUkLc.php?x=############
- http://ma####elacasse.ca/wp-content/plugins/symple-shortcodes/EmATUG.php?h=############
- http://ne###nsult.by/wp-content/plugins/all-in-one-seo-pack/JqT9Ls.php?q=############
- http://el###rosim.ro/wp-content/plugins/contact-form-7/CwR04H.php?t=############
- http://xn######ckeg1db2a.xn--p1ai/wp-content/plugins/shortcodes-ultimate/hntNzB.php?l=############
- http://ro###iznesa.ru/wp-content/plugins/tw-recent-posts-widget/ILEKUM.php?d=############
- http://pe##as.ru/wp-content/themes/twentytwelve/6x_nV5.php?r=############
- http://pa########tsgroomingacademy.co.uk/wp-content/plugins/slideshow-jquery-image-gallery/7sinRu.php?c=############
- http://bo#o.by/wp-content/plugins/akismet/O_xjRv.php?h=############
- http://pr####tprovider.nl/wp-content/uploads/genesis-extender/plugin/images/HaryfG.php?r=############
- http://ga###nddeli.com/media/editors/tinymce/jscripts/tiny_mce/plugins/paste/GbWzVt.php?h=############
- http://ob####vografico.es/wp-content/themes/book-store%20backup/BhRfIp.php?p=############
- http://if###esti.ro/wp-content/plugins/navayan-subscribe/SYbJT9.php?s=############
- http://dk##rma.ru/wp-content/themes/dk/Sp6u0B.php?f=############
- http://di####trailer.us/wp-content/plugins/advanced-excerpt/1VtP3W.php?h=############
- http://be####yourtown.info/wp-content/themes/toommoreltheme/_pH5Ck.php?x=############
- http://pa########tsgroomingacademy.co.uk/wp-content/plugins/slideshow-jquery-image-gallery/7sinRu.php?d=###############
- http://bu#####gulamaoteli.com/wp-content/themes/welcome_inn-parent/framework/extensions/contactform/static/VNtDfl.php?v=############
- http://vo####rbrendan.biz/wp-content/themes/twentyfifteen/pLXtNm.php?s=############
- http://ay##zee.biz/wp-content/plugins/max-banner-ads-pro/5Yfhdr.php?r=############
- http://bo#o.by/wp-content/plugins/akismet/O_xjRv.php?a=###############
- http://pr####tprovider.nl/wp-content/uploads/genesis-extender/plugin/images/HaryfG.php?e=###############
- http://dk##rma.ru/wp-content/themes/dk/Sp6u0B.php?h=###############
- http://ro###iznesa.ru/wp-content/plugins/tw-recent-posts-widget/ILEKUM.php?x=###############
- http://pe##as.ru/wp-content/themes/twentytwelve/6x_nV5.php?l=###############
- http://xn######ckeg1db2a.xn--p1ai/wp-content/plugins/shortcodes-ultimate/hntNzB.php?s=###############
- http://op####unitycup.com/media/editors/tinymce/jscripts/tiny_mce/plugins/contextmenu/InyfWv.php?l=############
- http://ca###imonte.ua/wp-content/plugins/cherry-plugin/D3sOjY.php?z=############
- http://vo####rbrendan.me/wp-content/themes/twentyfourteen/pYE7yW.php?f=############
- http://qr#p.us/wp-content/themes/twentyfifteen/Bamzho.php?i=############
- http://so####re-select.nl/wp-content/themes/genesis/qMfFUp.php?u=############
- http://pe##as.ru/wp-content/themes/twentytwelve/uQYbdq.php?u=############
- http://at#####cequine.org.nz/wp-content/themes/poloraytheme/functions/HdIC_W.php?o=############
- http://po#####efxstudio.co.uk/wp-content/themes/spacious/DiJv3L.php?p=############
- http://vo####rbrendan.info/wp-content/themes/genesis/t58Esq.php?k=############
- http://me###loto.ru/wp-content/themes/Velluce/IzOSnD.php?s=############
- http://ca###imonte.ua/wp-content/plugins/cherry-plugin/PLlfEN.php?l=############
UDP:
- DNS ASK so####re-select.nl
- DNS ASK qr#p.us
- DNS ASK op####unitycup.com
- DNS ASK vo####rbrendan.me
- DNS ASK vo####rbrendan.us
- DNS ASK el###rosim.ro
- DNS ASK ne###nsult.by
- DNS ASK sh###media.com
- DNS ASK ma####elacasse.ca
- DNS ASK ay##zee.biz
- DNS ASK vo####rbrendan.biz
- DNS ASK be####yourtown.info
- DNS ASK bu#####gulamaoteli.com
- DNS ASK po#####efxstudio.co.uk
- DNS ASK me###loto.ru
- DNS ASK ca###imonte.ua
- DNS ASK at#####cequine.org.nz
- DNS ASK vo####rbrendan.info
- DNS ASK xn######ckeg1db2a.xn--p1ai
- DNS ASK pe##as.ru
- DNS ASK pr####tprovider.nl
- DNS ASK ro###iznesa.ru
- DNS ASK bo#o.by
- DNS ASK my####rnalip.com
- DNS ASK ip##ddr.es
- DNS ASK pa########tsgroomingacademy.co.uk
- DNS ASK cu###yip.com
- DNS ASK be###tv.com.tr
- DNS ASK vo####rbrendan.mobi
- DNS ASK z-#n.ru
- DNS ASK di###emodels.ru
- DNS ASK ob####vografico.es
- DNS ASK di####trailer.us
- DNS ASK dk##rma.ru
- DNS ASK ga###nddeli.com
- DNS ASK if###esti.ro
