Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Auto-Discovery Controls Device Connection' = 'C:\yzrwhekolhcpiy\ymnfstpyebbw.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Locator Defragmenter Log Discovery] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Locator Defragmenter Log Discovery] 'ImagePath' = 'C:\yzrwhekolhcpiy\ymnfstpyebbw.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\yzrwhekolhcpiy\haklktwnmr6
- C:\yzrwhekolhcpiy\haklktwnmr6
- C:\yzrwhekolhcpiy\ixx0a2xquvkd2u8oipq.exe
- C:\yzrwhekolhcpiy\ymnfstpyebbw.exe
- C:\yzrwhekolhcpiy\ykshmdwynr.exe
Sets the 'hidden' attribute to the following files:
- C:\yzrwhekolhcpiy\ymnfstpyebbw.exe
- C:\yzrwhekolhcpiy\ykshmdwynr.exe
Deletes the following files:
- %WINDIR%\yzrwhekolhcpiy\haklktwnmr6
- C:\yzrwhekolhcpiy\ixx0a2xquvkd2u8oipq.exe
Substitutes the following files:
- %WINDIR%\yzrwhekolhcpiy\haklktwnmr6
Network activity:
Connects to:
- 'ra####settle.net':80
- 'th###settle.net':80
- 'cl###settle.net':80
- 'th####anguage.net':80
- 'cl####anguage.net':80
- 'th###device.net':80
- 'cl###device.net':80
- 'th###before.net':80
- 'cl###before.net':80
- 'th###found.net':80
- 'pr####tfound.net':80
- 'th###spring.net':80
- 'pr####tspring.net':80
- 'th####uccess.net':80
- 'pr####tsuccess.net':80
- 'th###banker.net':80
- 'pr####tbanker.net':80
- 'ch###found.net':80
- 'co####efound.net':80
- 'ch###spring.net':80
- 'we####rbefore.net':80
- 'co####espring.net':80
- 'am####before.net':80
- 'am####device.net':80
- 'mo####gsettle.net':80
- 'ra####language.net':80
- 'mo####glanguage.net':80
- 'ra####device.net':80
- 'mo####gdevice.net':80
- 'ra####before.net':80
- 'mo####gbefore.net':80
- 'st####esettle.net':80
- 'hi####ysettle.net':80
- 'st####elanguage.net':80
- 'hi####ylanguage.net':80
- 'st####edevice.net':80
- 'hi####ydevice.net':80
- 'st####ebefore.net':80
- 'hi####ybefore.net':80
- 'am####settle.net':80
- 'we####rsettle.net':80
- 'am####language.net':80
- 'we####rlanguage.net':80
- 'we####rdevice.net':80
- 'ch####uccess.net':80
TCP:
HTTP GET requests:
- http://ra####settle.net/index.php
- http://th###settle.net/index.php
- http://cl###settle.net/index.php
- http://th####anguage.net/index.php
- http://cl####anguage.net/index.php
- http://th###device.net/index.php
- http://cl###device.net/index.php
- http://th###before.net/index.php
- http://cl###before.net/index.php
- http://th###found.net/index.php
- http://pr####tfound.net/index.php
- http://th###spring.net/index.php
- http://pr####tspring.net/index.php
- http://th####uccess.net/index.php
- http://pr####tsuccess.net/index.php
- http://th###banker.net/index.php
- http://pr####tbanker.net/index.php
- http://ch###found.net/index.php
- http://co####efound.net/index.php
- http://ch###spring.net/index.php
- http://we####rbefore.net/index.php
- http://co####espring.net/index.php
- http://am####before.net/index.php
- http://am####device.net/index.php
- http://mo####gsettle.net/index.php
- http://ra####language.net/index.php
- http://mo####glanguage.net/index.php
- http://ra####device.net/index.php
- http://mo####gdevice.net/index.php
- http://ra####before.net/index.php
- http://mo####gbefore.net/index.php
- http://st####esettle.net/index.php
- http://hi####ysettle.net/index.php
- http://st####elanguage.net/index.php
- http://hi####ylanguage.net/index.php
- http://st####edevice.net/index.php
- http://hi####ydevice.net/index.php
- http://st####ebefore.net/index.php
- http://hi####ybefore.net/index.php
- http://am####settle.net/index.php
- http://we####rsettle.net/index.php
- http://am####language.net/index.php
- http://we####rlanguage.net/index.php
- http://we####rdevice.net/index.php
- http://ch####uccess.net/index.php
UDP:
- DNS ASK ra####settle.net
- DNS ASK th####anguage.net
- DNS ASK cl####anguage.net
- DNS ASK th###device.net
- DNS ASK cl###device.net
- DNS ASK th###before.net
- DNS ASK cl###before.net
- DNS ASK th###found.net
- DNS ASK pr####tfound.net
- DNS ASK hi####ylanguage.net
- DNS ASK th###spring.net
- DNS ASK th####uccess.net
- DNS ASK pr####tsuccess.net
- DNS ASK th###banker.net
- DNS ASK pr####tbanker.net
- DNS ASK ch###found.net
- DNS ASK co####efound.net
- DNS ASK ch###spring.net
- DNS ASK co####espring.net
- DNS ASK th###settle.net
- DNS ASK cl###settle.net
- DNS ASK we####rbefore.net
- DNS ASK am####before.net
- DNS ASK we####rdevice.net
- DNS ASK ra####language.net
- DNS ASK mo####glanguage.net
- DNS ASK ra####device.net
- DNS ASK mo####gdevice.net
- DNS ASK ra####before.net
- DNS ASK mo####gbefore.net
- DNS ASK st####esettle.net
- DNS ASK hi####ysettle.net
- DNS ASK ch####uccess.net
- DNS ASK pr####tspring.net
- DNS ASK st####elanguage.net
- DNS ASK hi####ydevice.net
- DNS ASK st####ebefore.net
- DNS ASK hi####ybefore.net
- DNS ASK am####settle.net
- DNS ASK we####rsettle.net
- DNS ASK am####language.net
- DNS ASK we####rlanguage.net
- DNS ASK am####device.net
- DNS ASK mo####gsettle.net
- DNS ASK st####edevice.net
- DNS ASK co####esuccess.net
Miscellaneous:
Creates and executes the following:
- 'C:\yzrwhekolhcpiy\ixx0a2xquvkd2u8oipq.exe'
- 'C:\yzrwhekolhcpiy\ymnfstpyebbw.exe'
- 'C:\yzrwhekolhcpiy\ykshmdwynr.exe' "c:\yzrwhekolhcpiy\ymnfstpyebbw.exe"
