Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Cache Solutions PnP-X Resource Process' = 'C:\xuovsiv\luyjwevwv.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Bluetooth Store Interactive Launcher] 'ImagePath' = 'C:\xuovsiv\luyjwevwv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Bluetooth Store Interactive Launcher] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\xuovsiv\ddaitlbyv.exe' "c:\xuovsiv\luyjwevwv.exe"
- 'C:\xuovsiv\luyjwevwv.exe'
- 'C:\xuovsiv\rxj2frqyxrxqzfwg.exe'
Modifies file system:
Creates the following files:
- C:\xuovsiv\luyjwevwv.exe
- C:\xuovsiv\ddaitlbyv.exe
- C:\xuovsiv\rxj2frqyxrxqzfwg.exe
- %WINDIR%\xuovsiv\huqcluibo
- C:\xuovsiv\huqcluibo
Sets the 'hidden' attribute to the following files:
- C:\xuovsiv\ddaitlbyv.exe
- C:\xuovsiv\luyjwevwv.exe
Deletes the following files:
- C:\xuovsiv\rxj2frqyxrxqzfwg.exe
- %WINDIR%\xuovsiv\huqcluibo
Substitutes the following files:
- %WINDIR%\xuovsiv\huqcluibo
Network activity:
Connects to:
- 'le####animal.net':80
- 'he####animal.net':80
- 'le####problem.net':80
- 're####emodern.net':80
- 'le####escape.net':80
- 'he####escape.net':80
- 'he####problem.net':80
- 'ge####escape.net':80
- 'he###animal.net':80
- 'ge####animal.net':80
- 'le####modern.net':80
- 'he####modern.net':80
- 'he###escape.net':80
- 'ne#####ryproblem.net':80
- 'pl####ntmodern.net':80
- 'ne####arymodern.net':80
- 'pl####ntescape.net':80
- 'ne####aryescape.net':80
- 'pl####ntproblem.net':80
- 'or###escape.net':80
- 'or####roblem.net':80
- 're####eproblem.net':80
- 'or###modern.net':80
- 're####eescape.net':80
- 'or###animal.net':80
- 're####eanimal.net':80
TCP:
HTTP GET requests:
- http://le####animal.net/index.php
- http://he####animal.net/index.php
- http://le####problem.net/index.php
- http://re####emodern.net/index.php
- http://le####escape.net/index.php
- http://he####escape.net/index.php
- http://he####problem.net/index.php
- http://ge####escape.net/index.php
- http://he###animal.net/index.php
- http://ge####animal.net/index.php
- http://le####modern.net/index.php
- http://he####modern.net/index.php
- http://he###escape.net/index.php
- http://ne#####ryproblem.net/index.php
- http://pl####ntmodern.net/index.php
- http://ne####arymodern.net/index.php
- http://pl####ntescape.net/index.php
- http://ne####aryescape.net/index.php
- http://pl####ntproblem.net/index.php
- http://or###escape.net/index.php
- http://or####roblem.net/index.php
- http://re####eproblem.net/index.php
- http://or###modern.net/index.php
- http://re####eescape.net/index.php
- http://or###animal.net/index.php
- http://re####eanimal.net/index.php
UDP:
- DNS ASK he####animal.net
- DNS ASK le####problem.net
- DNS ASK he####problem.net
- DNS ASK le####animal.net
- DNS ASK re####emodern.net
- DNS ASK le####escape.net
- DNS ASK he####escape.net
- DNS ASK he###animal.net
- DNS ASK ge####animal.net
- DNS ASK he####roblem.net
- DNS ASK ge####escape.net
- DNS ASK le####modern.net
- DNS ASK he####modern.net
- DNS ASK he###escape.net
- DNS ASK or###modern.net
- DNS ASK pl####ntproblem.net
- DNS ASK ne#####ryproblem.net
- DNS ASK pl####ntmodern.net
- DNS ASK ne####aryanimal.net
- DNS ASK pl####ntescape.net
- DNS ASK ne####aryescape.net
- DNS ASK pl####ntanimal.net
- DNS ASK re####eanimal.net
- DNS ASK or####roblem.net
- DNS ASK re####eproblem.net
- DNS ASK or###animal.net
- DNS ASK ne####arymodern.net
- DNS ASK or###escape.net
- DNS ASK re####eescape.net
