Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinHTTP Bluetooth Manager WLAN' = 'C:\rkbbshcm\utvviovbucbqv.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Defragmenter UPnP Connect Video Key] 'ImagePath' = 'C:\rkbbshcm\utvviovbucbqv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Defragmenter UPnP Connect Video Key] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\rkbbshcm\a5t0vguspefv.exe' "c:\rkbbshcm\utvviovbucbqv.exe"
- 'C:\rkbbshcm\utvviovbucbqv.exe'
- 'C:\rkbbshcm\ozljex2hw4nfflm4wj.exe'
Modifies file system:
Creates the following files:
- C:\rkbbshcm\utvviovbucbqv.exe
- C:\rkbbshcm\a5t0vguspefv.exe
- C:\rkbbshcm\fryupn76xboj
- %WINDIR%\rkbbshcm\aojuhzdpqjcc
- C:\rkbbshcm\aojuhzdpqjcc
- C:\rkbbshcm\ozljex2hw4nfflm4wj.exe
Sets the 'hidden' attribute to the following files:
- C:\rkbbshcm\a5t0vguspefv.exe
- C:\rkbbshcm\utvviovbucbqv.exe
Deletes the following files:
- C:\rkbbshcm\ozljex2hw4nfflm4wj.exe
- %WINDIR%\rkbbshcm\aojuhzdpqjcc
Substitutes the following files:
- %WINDIR%\rkbbshcm\aojuhzdpqjcc
Network activity:
Connects to:
- 'ch######aswindlehurst.net':80
- 'se#####anbloodworth.net':80
- 'ch#####nabloodworth.net':80
- 'se#####anabrahamson.net':80
- 'ch#####naabrahamson.net':80
- 'se######nswindlehurst.net':80
- 'se######nchristopherson.net':80
- 'la#####iaelisabeth.net':80
- 'de#####stelisabeth.net':80
- 'la#####iagloriana.net':80
- 'ch######achristopherson.net':80
- 'la#####iacheyanne.net':80
- 'de#####stcheyanne.net':80
- 'ja######nchristopherson.net':80
- 'cr######nchristopherson.net':80
- 'cl#####ndabrahamson.net':80
- 'cr######nswindlehurst.net':80
- 'ja#####ynbloodworth.net':80
- 'cr#####onbloodworth.net':80
- 'ch#####neabrahamson.net':80
- 'ch#####nebloodworth.net':80
- 'cl######dchristopherson.net':80
- 'ch######echristopherson.net':80
- 'cl######dswindlehurst.net':80
- 'ch######eswindlehurst.net':80
- 'cl#####ndbloodworth.net':80
- 'ch#####tagloriana.net':80
- 'ka#####raeglantine.net':80
- 'ch#####taeglantine.net':80
- 'ka#####raelisabeth.net':80
- 'ch#####taelisabeth.net':80
- 'ka#####ragloriana.net':80
- 'co#####cecheyanne.net':80
- 'co#####cegloriana.net':80
- 'ha#####tagloriana.net':80
- 'co#####ceeglantine.net':80
- 'ha#####tacheyanne.net':80
- 'co#####ceelisabeth.net':80
- 'ha#####taelisabeth.net':80
- 'pr#####lacheyanne.net':80
- 'ma#####ancheyanne.net':80
- 'pr#####laelisabeth.net':80
- 'de#####stgloriana.net':80
- 'la#####iaeglantine.net':80
- 'de#####steglantine.net':80
- 'ma#####anelisabeth.net':80
- 'ma#####aneglantine.net':80
- 'ka#####racheyanne.net':80
- 'ch#####tacheyanne.net':80
- 'pr#####lagloriana.net':80
- 'ma#####angloriana.net':80
- 'pr#####laeglantine.net':80
TCP:
HTTP GET requests:
- http://ch######aswindlehurst.net/index.php
- http://se#####anbloodworth.net/index.php
- http://ch#####nabloodworth.net/index.php
- http://se#####anabrahamson.net/index.php
- http://ch#####naabrahamson.net/index.php
- http://se######nswindlehurst.net/index.php
- http://se######nchristopherson.net/index.php
- http://la#####iaelisabeth.net/index.php
- http://de#####stelisabeth.net/index.php
- http://la#####iagloriana.net/index.php
- http://ch######achristopherson.net/index.php
- http://la#####iacheyanne.net/index.php
- http://de#####stcheyanne.net/index.php
- http://ja######nchristopherson.net/index.php
- http://cr######nchristopherson.net/index.php
- http://cl#####ndabrahamson.net/index.php
- http://cr######nswindlehurst.net/index.php
- http://ja#####ynbloodworth.net/index.php
- http://cr#####onbloodworth.net/index.php
- http://ch#####neabrahamson.net/index.php
- http://ch#####nebloodworth.net/index.php
- http://cl######dchristopherson.net/index.php
- http://ch######echristopherson.net/index.php
- http://cl######dswindlehurst.net/index.php
- http://ch######eswindlehurst.net/index.php
- http://cl#####ndbloodworth.net/index.php
- http://ch#####tagloriana.net/index.php
- http://ka#####raeglantine.net/index.php
- http://ch#####taeglantine.net/index.php
- http://ka#####raelisabeth.net/index.php
- http://ch#####taelisabeth.net/index.php
- http://ka#####ragloriana.net/index.php
- http://co#####cecheyanne.net/index.php
- http://co#####cegloriana.net/index.php
- http://ha#####tagloriana.net/index.php
- http://co#####ceeglantine.net/index.php
- http://ha#####tacheyanne.net/index.php
- http://co#####ceelisabeth.net/index.php
- http://ha#####taelisabeth.net/index.php
- http://pr#####lacheyanne.net/index.php
- http://ma#####ancheyanne.net/index.php
- http://pr#####laelisabeth.net/index.php
- http://de#####stgloriana.net/index.php
- http://la#####iaeglantine.net/index.php
- http://de#####steglantine.net/index.php
- http://ma#####anelisabeth.net/index.php
- http://ma#####aneglantine.net/index.php
- http://ka#####racheyanne.net/index.php
- http://ch#####tacheyanne.net/index.php
- http://pr#####lagloriana.net/index.php
- http://ma#####angloriana.net/index.php
- http://pr#####laeglantine.net/index.php
UDP:
- DNS ASK se######nswindlehurst.net
- DNS ASK ch######aswindlehurst.net
- DNS ASK se#####anbloodworth.net
- DNS ASK ch######echristopherson.net
- DNS ASK se#####anabrahamson.net
- DNS ASK ch#####naabrahamson.net
- DNS ASK ch#####nabloodworth.net
- DNS ASK de#####stcheyanne.net
- DNS ASK la#####iaelisabeth.net
- DNS ASK de#####stelisabeth.net
- DNS ASK se######nchristopherson.net
- DNS ASK ch######achristopherson.net
- DNS ASK la#####iacheyanne.net
- DNS ASK cr#####onbloodworth.net
- DNS ASK ja######nchristopherson.net
- DNS ASK cr######nchristopherson.net
- DNS ASK ja######nswindlehurst.net
- DNS ASK cr######nswindlehurst.net
- DNS ASK ja#####ynbloodworth.net
- DNS ASK cl#####ndabrahamson.net
- DNS ASK cl#####ndbloodworth.net
- DNS ASK ch#####nebloodworth.net
- DNS ASK cl######dchristopherson.net
- DNS ASK ch#####neabrahamson.net
- DNS ASK cl######dswindlehurst.net
- DNS ASK ch######eswindlehurst.net
- DNS ASK la#####iagloriana.net
- DNS ASK ch#####tagloriana.net
- DNS ASK ka#####raeglantine.net
- DNS ASK ch#####taeglantine.net
- DNS ASK ka#####raelisabeth.net
- DNS ASK ch#####taelisabeth.net
- DNS ASK ka#####ragloriana.net
- DNS ASK co#####cecheyanne.net
- DNS ASK co#####cegloriana.net
- DNS ASK ha#####tagloriana.net
- DNS ASK co#####ceeglantine.net
- DNS ASK ha#####tacheyanne.net
- DNS ASK co#####ceelisabeth.net
- DNS ASK ha#####taelisabeth.net
- DNS ASK pr#####lacheyanne.net
- DNS ASK ma#####ancheyanne.net
- DNS ASK pr#####laelisabeth.net
- DNS ASK de#####stgloriana.net
- DNS ASK la#####iaeglantine.net
- DNS ASK de#####steglantine.net
- DNS ASK ma#####anelisabeth.net
- DNS ASK ma#####aneglantine.net
- DNS ASK ka#####racheyanne.net
- DNS ASK ch#####tacheyanne.net
- DNS ASK pr#####lagloriana.net
- DNS ASK ma#####angloriana.net
- DNS ASK pr#####laeglantine.net
