Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Protected Trap Error Biometric' = 'C:\miyorfbwyxhoks\mubmlxr.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Image Propagation Receiver Drive Connect Call] 'ImagePath' = 'C:\miyorfbwyxhoks\mubmlxr.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Image Propagation Receiver Drive Connect Call] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\miyorfbwyxhoks\xfshrqcegwd.exe' "c:\miyorfbwyxhoks\mubmlxr.exe"
- 'C:\miyorfbwyxhoks\mubmlxr.exe'
- 'C:\miyorfbwyxhoks\vko2icltimsye05vx.exe'
Modifies file system:
Creates the following files:
- C:\miyorfbwyxhoks\mubmlxr.exe
- C:\miyorfbwyxhoks\xfshrqcegwd.exe
- C:\miyorfbwyxhoks\vko2icltimsye05vx.exe
- %WINDIR%\miyorfbwyxhoks\dseejz
- C:\miyorfbwyxhoks\dseejz
Sets the 'hidden' attribute to the following files:
- C:\miyorfbwyxhoks\xfshrqcegwd.exe
- C:\miyorfbwyxhoks\mubmlxr.exe
Deletes the following files:
- C:\miyorfbwyxhoks\vko2icltimsye05vx.exe
- %WINDIR%\miyorfbwyxhoks\dseejz
Substitutes the following files:
- %WINDIR%\miyorfbwyxhoks\dseejz
Network activity:
Connects to:
- 'sw####eighbor.net':80
- 'pr####lysquare.net':80
- 'pr#####yneighbor.net':80
- 'pr####lyspread.net':80
- 'sw###spread.net':80
- 'le###spread.net':80
- 'fi####spread.net':80
- 'sw####ttempt.net':80
- 'sw###square.net':80
- 'pr####lyattempt.net':80
- 'se####lattempt.net':80
- 'ma####alspread.net':80
- 'se####lspread.net':80
- 'se####market.net':80
- 'se####report.net':80
- 'la###market.net':80
- 'se####lsquare.net':80
- 'ma####alattempt.net':80
- 'ma####alsquare.net':80
- 'ma#####lneighbor.net':80
- 'se####lneighbor.net':80
- 'wi####square.net':80
- 'pe####ssquare.net':80
- 'pe####sneighbor.net':80
- 'pe####sspread.net':80
- 'wi####neighbor.net':80
- 'mo####inspread.net':80
- 'po#####eneighbor.net':80
- 'po####lespread.net':80
- 'wi####attempt.net':80
- 'pe####sattempt.net':80
- 'wi####spread.net':80
- 'fi####square.net':80
- 'le####ttempt.net':80
- 'le###square.net':80
- 'le####eighbor.net':80
- 'fi####neighbor.net':80
- 'su####tsquare.net':80
- 'su####tattempt.net':80
- 'su####tneighbor.net':80
- 'fi####attempt.net':80
- 'su####tspread.net':80
TCP:
HTTP GET requests:
- http://sw####eighbor.net/index.php
- http://pr####lysquare.net/index.php
- http://pr#####yneighbor.net/index.php
- http://pr####lyspread.net/index.php
- http://sw###spread.net/index.php
- http://le###spread.net/index.php
- http://fi####spread.net/index.php
- http://sw####ttempt.net/index.php
- http://sw###square.net/index.php
- http://pr####lyattempt.net/index.php
- http://se####lattempt.net/index.php
- http://ma####alspread.net/index.php
- http://se####lspread.net/index.php
- http://se####market.net/index.php
- http://se####report.net/index.php
- http://la###market.net/index.php
- http://se####lsquare.net/index.php
- http://ma####alattempt.net/index.php
- http://ma####alsquare.net/index.php
- http://ma#####lneighbor.net/index.php
- http://se####lneighbor.net/index.php
- http://wi####square.net/index.php
- http://pe####ssquare.net/index.php
- http://pe####sneighbor.net/index.php
- http://pe####sspread.net/index.php
- http://wi####neighbor.net/index.php
- http://mo####inspread.net/index.php
- http://po#####eneighbor.net/index.php
- http://po####lespread.net/index.php
- http://wi####attempt.net/index.php
- http://pe####sattempt.net/index.php
- http://wi####spread.net/index.php
- http://fi####square.net/index.php
- http://le####ttempt.net/index.php
- http://le###square.net/index.php
- http://le####eighbor.net/index.php
- http://fi####neighbor.net/index.php
- http://su####tsquare.net/index.php
- http://su####tattempt.net/index.php
- http://su####tneighbor.net/index.php
- http://fi####attempt.net/index.php
- http://su####tspread.net/index.php
UDP:
- DNS ASK pr#####yneighbor.net
- DNS ASK sw####eighbor.net
- DNS ASK sw###spread.net
- DNS ASK se####lattempt.net
- DNS ASK pr####lyspread.net
- DNS ASK sw####ttempt.net
- DNS ASK le###spread.net
- DNS ASK pr####lyattempt.net
- DNS ASK pr####lysquare.net
- DNS ASK sw###square.net
- DNS ASK ma####alattempt.net
- DNS ASK se####market.net
- DNS ASK ma####alspread.net
- DNS ASK la###market.net
- DNS ASK la###report.net
- DNS ASK se####report.net
- DNS ASK ma####alsquare.net
- DNS ASK se####lsquare.net
- DNS ASK se####lneighbor.net
- DNS ASK se####lspread.net
- DNS ASK ma#####lneighbor.net
- DNS ASK fi####spread.net
- DNS ASK wi####square.net
- DNS ASK pe####ssquare.net
- DNS ASK pe####sneighbor.net
- DNS ASK pe####sspread.net
- DNS ASK wi####neighbor.net
- DNS ASK mo####inspread.net
- DNS ASK po#####eneighbor.net
- DNS ASK po####lespread.net
- DNS ASK wi####attempt.net
- DNS ASK pe####sattempt.net
- DNS ASK wi####spread.net
- DNS ASK fi####square.net
- DNS ASK le####ttempt.net
- DNS ASK le###square.net
- DNS ASK le####eighbor.net
- DNS ASK fi####neighbor.net
- DNS ASK su####tsquare.net
- DNS ASK su####tattempt.net
- DNS ASK su####tneighbor.net
- DNS ASK fi####attempt.net
- DNS ASK su####tspread.net
