Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Group Copy Upgrade Device IPsec' = 'C:\refuvef\ujwldftbzjs.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Keying Endpoint Experience Studio Driver] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Keying Endpoint Experience Studio Driver] 'ImagePath' = 'C:\refuvef\ujwldftbzjs.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\refuvef\epqxtocun5a
- C:\refuvef\epqxtocun5a
- C:\refuvef\ojo2wilvledawbaw.exe
- C:\refuvef\ujwldftbzjs.exe
- C:\refuvef\ciiofmzyxx.exe
- C:\refuvef\idcsflpgcchj
Sets the 'hidden' attribute to the following files:
- C:\refuvef\ujwldftbzjs.exe
- C:\refuvef\ciiofmzyxx.exe
Deletes the following files:
- %WINDIR%\refuvef\epqxtocun5a
- C:\refuvef\ojo2wilvledawbaw.exe
Substitutes the following files:
- %WINDIR%\refuvef\epqxtocun5a
Network activity:
Connects to:
- 'he###nsmell.net':80
- 'de####separate.net':80
- 'fo####dseparate.net':80
- 'de####health.net':80
- 'fo####dhealth.net':80
- 'de####clothes.net':80
- 'fo####dclothes.net':80
- 'va####sfuture.net':80
- 're####future.net':80
- 'de####distant.net':80
- 'gl####eparate.net':80
- 'an####health.net':80
- 'gl###health.net':80
- 'an####clothes.net':80
- 'gl####lothes.net':80
- 'an####distant.net':80
- 'fo####ddistant.net':80
- 'an####separate.net':80
- 're####safety.net':80
- 'va####ssafety.net':80
- 're###nearly.net':80
- 'he###nearly.net':80
- 'le####safety.net':80
- 'he####safety.net':80
- 'le####future.net':80
- 'he####future.net':80
- 'he###smell.net':80
- 'ge###esmell.net':80
- 'le###rearly.net':80
- 'he###early.net':80
- 'he###safety.net':80
- 'ge####safety.net':80
- 'he###future.net':80
- 'ge####future.net':80
- 'va####ssmell.net':80
- 're###nsmell.net':80
- 'va####searly.net':80
- 'ge###eearly.net':80
- 'gl####istant.net':80
- 'di#####ltseparate.net':80
TCP:
HTTP GET requests:
- http://he###nsmell.net/index.php
- http://de####separate.net/index.php
- http://fo####dseparate.net/index.php
- http://de####health.net/index.php
- http://fo####dhealth.net/index.php
- http://de####clothes.net/index.php
- http://fo####dclothes.net/index.php
- http://va####sfuture.net/index.php
- http://re####future.net/index.php
- http://de####distant.net/index.php
- http://gl####eparate.net/index.php
- http://an####health.net/index.php
- http://gl###health.net/index.php
- http://an####clothes.net/index.php
- http://gl####lothes.net/index.php
- http://an####distant.net/index.php
- http://fo####ddistant.net/index.php
- http://an####separate.net/index.php
- http://re####safety.net/index.php
- http://va####ssafety.net/index.php
- http://re###nearly.net/index.php
- http://he###nearly.net/index.php
- http://le####safety.net/index.php
- http://he####safety.net/index.php
- http://le####future.net/index.php
- http://he####future.net/index.php
- http://he###smell.net/index.php
- http://ge###esmell.net/index.php
- http://le###rearly.net/index.php
- http://he###early.net/index.php
- http://he###safety.net/index.php
- http://ge####safety.net/index.php
- http://he###future.net/index.php
- http://ge####future.net/index.php
- http://va####ssmell.net/index.php
- http://re###nsmell.net/index.php
- http://va####searly.net/index.php
- http://ge###eearly.net/index.php
- http://gl####istant.net/index.php
- http://di#####ltseparate.net/index.php
UDP:
- DNS ASK he###nsmell.net
- DNS ASK re####future.net
- DNS ASK de####separate.net
- DNS ASK fo####dseparate.net
- DNS ASK de####health.net
- DNS ASK fo####dhealth.net
- DNS ASK de####clothes.net
- DNS ASK fo####dclothes.net
- DNS ASK de####distant.net
- DNS ASK fo####ddistant.net
- DNS ASK an####separate.net
- DNS ASK gl####eparate.net
- DNS ASK an####health.net
- DNS ASK gl###health.net
- DNS ASK an####clothes.net
- DNS ASK gl####lothes.net
- DNS ASK an####distant.net
- DNS ASK gl####istant.net
- DNS ASK va####sfuture.net
- DNS ASK di#####ltseparate.net
- DNS ASK re####safety.net
- DNS ASK re###nearly.net
- DNS ASK le###rearly.net
- DNS ASK he###nearly.net
- DNS ASK le####safety.net
- DNS ASK he####safety.net
- DNS ASK le####future.net
- DNS ASK he####future.net
- DNS ASK he###smell.net
- DNS ASK ge###esmell.net
- DNS ASK he###early.net
- DNS ASK ge###eearly.net
- DNS ASK he###safety.net
- DNS ASK ge####safety.net
- DNS ASK he###future.net
- DNS ASK ge####future.net
- DNS ASK va####ssmell.net
- DNS ASK re###nsmell.net
- DNS ASK va####searly.net
- DNS ASK va####ssafety.net
- DNS ASK he####eparate.net
Miscellaneous:
Creates and executes the following:
- 'C:\refuvef\ojo2wilvledawbaw.exe'
- 'C:\refuvef\ujwldftbzjs.exe'
- 'C:\refuvef\ciiofmzyxx.exe' "c:\refuvef\ujwldftbzjs.exe"
