Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Link Registrar Play Problem Shell Plug' = 'C:\rm2xcvhg\rqebvxeoad.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinHTTP Scheduler BitLocker] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinHTTP Scheduler BitLocker] 'ImagePath' = 'C:\rm2xcvhg\rqebvxeoad.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\rm2xcvhg\dshu1nf
- C:\rm2xcvhg\dshu1nf
- C:\rm2xcvhg\cwlghy3denfn5zbtlv5m.exe
- C:\rm2xcvhg\rqebvxeoad.exe
- C:\rm2xcvhg\vrgewqktogm.exe
- C:\rm2xcvhg\ynax2bd2usf
Sets the 'hidden' attribute to the following files:
- C:\rm2xcvhg\rqebvxeoad.exe
- C:\rm2xcvhg\vrgewqktogm.exe
Deletes the following files:
- %WINDIR%\rm2xcvhg\dshu1nf
- C:\rm2xcvhg\cwlghy3denfn5zbtlv5m.exe
Substitutes the following files:
- %WINDIR%\rm2xcvhg\dshu1nf
Network activity:
Connects to:
- 'gw#####rejermaine.net':80
- 'ch#####negabrielson.net':80
- 'sh#####legabrielson.net':80
- 'ch######ecollingwood.net':80
- 'sh######ecollingwood.net':80
- 'ch#####nestephenson.net':80
- 'sh#####lestephenson.net':80
- 'ar######dchristinsen.net':80
- 'za######hchristinsen.net':80
- 'ar#####ldgabrielson.net':80
- 'ma#####nagabrielson.net':80
- 'za#####ahgabrielson.net':80
- 'za######hcollingwood.net':80
- 'ar#####ldstephenson.net':80
- 'za#####ahstephenson.net':80
- 'ge######achristinsen.net':80
- 'ge#####nagabrielson.net':80
- 'ch#####legabrielson.net':80
- 'ge######acollingwood.net':80
- 'ge#####nastephenson.net':80
- 'ch#####lestephenson.net':80
- 'ch######echristinsen.net':80
- 'sh######echristinsen.net':80
- 'ce#####nestephenson.net':80
- 'am#####nestephenson.net':80
- 'ce######ecollingwood.net':80
- 'ka######echristinsen.net':80
- 'al######rchristinsen.net':80
- 'ka#####negabrielson.net':80
- 'al#####ergabrielson.net':80
- 'ka######ecollingwood.net':80
- 'al######rcollingwood.net':80
- 'ka#####nestephenson.net':80
- 'al#####erstephenson.net':80
- 'ma######achristinsen.net':80
- 'an######echristinsen.net':80
- 'ar######dcollingwood.net':80
- 'al######achristinsen.net':80
- 'ma######acollingwood.net':80
- 'al######acollingwood.net':80
- 'ma#####nastephenson.net':80
- 'al#####rastephenson.net':80
- 'am######echristinsen.net':80
- 'ce######echristinsen.net':80
- 'am#####negabrielson.net':80
- 'ce#####negabrielson.net':80
- 'am######ecollingwood.net':80
- 'ch#####anjermaine.net':80
- 'al#####ragabrielson.net':80
- 'gu######nchristinsen.net':80
TCP:
HTTP GET requests:
- http://gw#####rejermaine.net/index.php
- http://ch#####negabrielson.net/index.php
- http://sh#####legabrielson.net/index.php
- http://ch######ecollingwood.net/index.php
- http://sh######ecollingwood.net/index.php
- http://ch#####nestephenson.net/index.php
- http://sh#####lestephenson.net/index.php
- http://ar######dchristinsen.net/index.php
- http://za######hchristinsen.net/index.php
- http://ar#####ldgabrielson.net/index.php
- http://ma#####nagabrielson.net/index.php
- http://za#####ahgabrielson.net/index.php
- http://za######hcollingwood.net/index.php
- http://ar#####ldstephenson.net/index.php
- http://za#####ahstephenson.net/index.php
- http://ge######achristinsen.net/index.php
- http://ge#####nagabrielson.net/index.php
- http://ch#####legabrielson.net/index.php
- http://ge######acollingwood.net/index.php
- http://ge#####nastephenson.net/index.php
- http://ch#####lestephenson.net/index.php
- http://ch######echristinsen.net/index.php
- http://sh######echristinsen.net/index.php
- http://ce#####nestephenson.net/index.php
- http://am#####nestephenson.net/index.php
- http://ce######ecollingwood.net/index.php
- http://ka######echristinsen.net/index.php
- http://al######rchristinsen.net/index.php
- http://ka#####negabrielson.net/index.php
- http://al#####ergabrielson.net/index.php
- http://ka######ecollingwood.net/index.php
- http://al######rcollingwood.net/index.php
- http://ka#####nestephenson.net/index.php
- http://al#####erstephenson.net/index.php
- http://ma######achristinsen.net/index.php
- http://an######echristinsen.net/index.php
- http://ar######dcollingwood.net/index.php
- http://al######achristinsen.net/index.php
- http://ma######acollingwood.net/index.php
- http://al######acollingwood.net/index.php
- http://ma#####nastephenson.net/index.php
- http://al#####rastephenson.net/index.php
- http://am######echristinsen.net/index.php
- http://ce######echristinsen.net/index.php
- http://am#####negabrielson.net/index.php
- http://ce#####negabrielson.net/index.php
- http://am######ecollingwood.net/index.php
- http://ch#####anjermaine.net/index.php
- http://al#####ragabrielson.net/index.php
- http://gu######nchristinsen.net/index.php
UDP:
- DNS ASK gw#####rejermaine.net
- DNS ASK ch#####negabrielson.net
- DNS ASK sh#####legabrielson.net
- DNS ASK ch######ecollingwood.net
- DNS ASK sh######ecollingwood.net
- DNS ASK ch#####nestephenson.net
- DNS ASK sh#####lestephenson.net
- DNS ASK ar######dchristinsen.net
- DNS ASK za######hchristinsen.net
- DNS ASK ar#####ldgabrielson.net
- DNS ASK ma#####nagabrielson.net
- DNS ASK za#####ahgabrielson.net
- DNS ASK za######hcollingwood.net
- DNS ASK ar#####ldstephenson.net
- DNS ASK za#####ahstephenson.net
- DNS ASK ge######achristinsen.net
- DNS ASK ge#####nagabrielson.net
- DNS ASK ch#####legabrielson.net
- DNS ASK ge######acollingwood.net
- DNS ASK ge#####nastephenson.net
- DNS ASK ch#####lestephenson.net
- DNS ASK ch######echristinsen.net
- DNS ASK sh######echristinsen.net
- DNS ASK ce#####nestephenson.net
- DNS ASK am#####nestephenson.net
- DNS ASK ce######ecollingwood.net
- DNS ASK ka######echristinsen.net
- DNS ASK al######rchristinsen.net
- DNS ASK ka#####negabrielson.net
- DNS ASK al#####ergabrielson.net
- DNS ASK ka######ecollingwood.net
- DNS ASK al######rcollingwood.net
- DNS ASK ka#####nestephenson.net
- DNS ASK al#####erstephenson.net
- DNS ASK ma######achristinsen.net
- DNS ASK an######echristinsen.net
- DNS ASK ar######dcollingwood.net
- DNS ASK al######achristinsen.net
- DNS ASK ma######acollingwood.net
- DNS ASK al######acollingwood.net
- DNS ASK ma#####nastephenson.net
- DNS ASK al#####rastephenson.net
- DNS ASK am######echristinsen.net
- DNS ASK ce######echristinsen.net
- DNS ASK am#####negabrielson.net
- DNS ASK ce#####negabrielson.net
- DNS ASK am######ecollingwood.net
- DNS ASK ch#####anjermaine.net
- DNS ASK al#####ragabrielson.net
- DNS ASK gu######nchristinsen.net
Miscellaneous:
Creates and executes the following:
- 'C:\rm2xcvhg\cwlghy3denfn5zbtlv5m.exe'
- 'C:\rm2xcvhg\rqebvxeoad.exe'
- 'C:\rm2xcvhg\vrgewqktogm.exe' "c:\rm2xcvhg\rqebvxeoad.exe"
