Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Routing Endpoint Bluetooth DLL KtmRm Launcher' = 'C:\ixwqyb2em\wd64necnk.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Brightness Transfer SNMP AuthIP Trap Themes] 'ImagePath' = 'C:\ixwqyb2em\wd64necnk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Brightness Transfer SNMP AuthIP Trap Themes] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\ixwqyb2em\wxmro5efexds.exe' "c:\ixwqyb2em\wd64necnk.exe"
- 'C:\ixwqyb2em\wd64necnk.exe'
- 'C:\ixwqyb2em\lxou9f3t2q6avqdpvi5lxal.exe'
Modifies file system:
Creates the following files:
- C:\ixwqyb2em\wd64necnk.exe
- C:\ixwqyb2em\wxmro5efexds.exe
- C:\ixwqyb2em\bkvuoqcn
- %WINDIR%\ixwqyb2em\ougqwl
- C:\ixwqyb2em\ougqwl
- C:\ixwqyb2em\lxou9f3t2q6avqdpvi5lxal.exe
Sets the 'hidden' attribute to the following files:
- C:\ixwqyb2em\wxmro5efexds.exe
- C:\ixwqyb2em\wd64necnk.exe
Deletes the following files:
- C:\ixwqyb2em\lxou9f3t2q6avqdpvi5lxal.exe
- %WINDIR%\ixwqyb2em\ougqwl
Network activity:
Connects to:
- 'gu##155.cn':80
- 'sp##tnav.ru':80
- 'sa#####rellashleigh.net':80
- 'wi#####inaashleigh.net':80
- 'bu####rmansion.com':80
- 'si###ypeas.net':80
- 'do##bate.cn':80
- 'pr##card.ru':80
- 'to###tosales.ru':80
- 'ma#####lianchauncey.ru':80
- 'gw#####inecalanthe.net':80
- 'gw#####inecalanthe.ru':80
- 'ma#####lianashleigh.net':80
- 'ma#####llabotwright.ru':80
- 'ma#####liancalanthe.net':80
- 'ma#####lianchauncey.net':80
- 'gw#####inechauncey.net':80
- 'ma#####liangretchen.net':80
- 'gw#####inegretchen.net':80
- 'ag#####anabolics.com':80
- 'ca#####eeitinthecup.org':80
- 'ka#######ayajivayapriroda.ru':80
- 'cl#####ortswomen.com':80
- 'na##top.ru':80
- 'ga#####yundongyuan.cn':80
- 'sc####ainbow.net':80
- 'ta#####pielenreiten.org':80
- 'un###lgrain.org':80
- 'ga####liongrass.net':80
- 'ye####gdongwu.cn':80
- 'pr####anabolikov.ru':80
- 'gr###factory.cn':80
- 'ch####isportsmen.ru':80
- 'so####ryducks.com':80
- 'pi##asia.cn':80
- 'ha####nhalflion.net':80
- 'cl####portsmen.com':80
- 'sc#####epuzzlechess.org':80
TCP:
HTTP GET requests:
- http://gu##155.cn/index.php
- http://sp##tnav.ru/index.php
- http://sa#####rellashleigh.net/index.php
- http://wi#####inaashleigh.net/index.php
- http://bu####rmansion.com/index.php
- http://si###ypeas.net/index.php
- http://do##bate.cn/index.php
- http://pr##card.ru/index.php
- http://to###tosales.ru/index.php
- http://ma#####lianchauncey.ru/index.php
- http://gw#####inecalanthe.net/index.php
- http://gw#####inecalanthe.ru/index.php
- http://ma#####lianashleigh.net/index.php
- http://ma#####llabotwright.ru/index.php
- http://ma#####liancalanthe.net/index.php
- http://ma#####lianchauncey.net/index.php
- http://gw#####inechauncey.net/index.php
- http://ma#####liangretchen.net/index.php
- http://gw#####inegretchen.net/index.php
- http://ag#####anabolics.com/index.php
- http://ca#####eeitinthecup.org/index.php
- http://ka#######ayajivayapriroda.ru/index.php
- http://cl#####ortswomen.com/index.php
- http://na##top.ru/index.php
- http://ga#####yundongyuan.cn/index.php
- http://sc####ainbow.net/index.php
- http://ta#####pielenreiten.org/index.php
- http://un###lgrain.org/index.php
- http://ga####liongrass.net/index.php
- http://ye####gdongwu.cn/index.php
- http://pr####anabolikov.ru/index.php
- http://gr###factory.cn/index.php
- http://ch####isportsmen.ru/index.php
- http://so####ryducks.com/index.php
- http://pi##asia.cn/index.php
- http://ha####nhalflion.net/index.php
- http://cl####portsmen.com/index.php
- http://sc#####epuzzlechess.org/index.php
UDP:
- DNS ASK ev#####ineellsworth.ru
- DNS ASK ri#####ineellsworth.net
- DNS ASK ev#####inehuddleson.net
- DNS ASK ev#####inealbertson.net
- DNS ASK ri#####inealbertson.net
- DNS ASK ev#####ineellsworth.net
- DNS ASK ri#####inebotwright.ru
- DNS ASK ev#####inaalbertson.net
- DNS ASK be#####ardalbertson.net
- DNS ASK ri#####inehuddleson.net
- DNS ASK ev#####inebotwright.net
- DNS ASK ri#####inebotwright.net
- DNS ASK ma#####llaseabrooke.ru
- DNS ASK al######inaseabrooke.net
- DNS ASK ma#####llanathanson.net
- DNS ASK wi#####hbyjosephson.net
- DNS ASK ba######mewjosephson.net
- DNS ASK ma#####llaseabrooke.net
- DNS ASK al#####rinavictorson.ru
- DNS ASK ma#####llajosephson.net
- DNS ASK al######inajosephson.net
- DNS ASK al######inanathanson.net
- DNS ASK ma#####llavictorson.net
- DNS ASK al######inavictorson.net
- DNS ASK gw#####inebotwright.ru
- DNS ASK ma######ianbotwright.net
- DNS ASK wi#####inaalbertson.net
- DNS ASK gw#####inehuddleson.net
- DNS ASK ma######ianhuddleson.net
- DNS ASK gw#####inebotwright.net
- DNS ASK sa#####rellellsworth.ru
- DNS ASK wi#####inahuddleson.net
- DNS ASK sa######ellhuddleson.net
- DNS ASK sa######ellalbertson.net
- DNS ASK wi#####inaellsworth.net
- DNS ASK sa######ellellsworth.net
- DNS ASK ev#####inahuddleson.ru
- DNS ASK be#####ardhuddleson.net
- DNS ASK ev#####inabotwright.net
- DNS ASK ev#####inaellsworth.net
- DNS ASK be#####ardellsworth.net
- DNS ASK ev#####inahuddleson.net
- DNS ASK ma#####lianalbertson.ru
- DNS ASK gw#####ineellsworth.net
- DNS ASK ma######ianellsworth.net
- DNS ASK be#####ardbotwright.net
- DNS ASK gw#####inealbertson.net
- DNS ASK ma######ianalbertson.net
- DNS ASK ba######mewvictorson.net
- DNS ASK wi#####inanathanson.net
- DNS ASK wi#####inanathanson.ru
- DNS ASK wi#####inavictorson.net
- DNS ASK ma######ianjosephson.net
- DNS ASK wi#####inaseabrooke.net
- DNS ASK sa######ellseabrooke.net
- DNS ASK sa######elljosephson.net
- DNS ASK sa#####relljosephson.ru
- DNS ASK ea#####ineseabrooke.net
- DNS ASK sa######ellnathanson.net
- DNS ASK sa######ellvictorson.net
- DNS ASK wi#####inajosephson.net
- DNS ASK gw#####ineseabrooke.net
- DNS ASK gw#####ineseabrooke.ru
- DNS ASK ma######ianseabrooke.net
- DNS ASK be#####ardvictorson.net
- DNS ASK ev#####inajosephson.net
- DNS ASK be#####ardjosephson.net
- DNS ASK ma######ianvictorson.net
- DNS ASK ma#####lianvictorson.ru
- DNS ASK gw#####inejosephson.net
- DNS ASK gw#####inenathanson.net
- DNS ASK ma######iannathanson.net
- DNS ASK gw#####inevictorson.net
- DNS ASK du#####llajosephson.net
- DNS ASK du#####llajosephson.ru
- DNS ASK ch#####anajosephson.net
- DNS ASK ch#####ananathanson.net
- DNS ASK du#####llavictorson.net
- DNS ASK ch#####anavictorson.net
- DNS ASK ba######mewnathanson.net
- DNS ASK ba#####omewnathanson.ru
- DNS ASK wi#####hbyvictorson.net
- DNS ASK wi#####hbyseabrooke.net
- DNS ASK ba######mewseabrooke.net
- DNS ASK wi#####hbynathanson.net
- DNS ASK ea#####inevictorson.net
- DNS ASK ea#####inevictorson.ru
- DNS ASK wa#####tonvictorson.net
- DNS ASK wa#####tonseabrooke.net
- DNS ASK ea#####inenathanson.net
- DNS ASK wa#####tonnathanson.net
- DNS ASK ch#####anaseabrooke.net
- DNS ASK ch#####anaseabrooke.ru
- DNS ASK du#####llanathanson.net
- DNS ASK ea#####inejosephson.net
- DNS ASK wa#####tonjosephson.net
- DNS ASK du#####llaseabrooke.net
- DNS ASK sa######ellbotwright.net
- DNS ASK ma#####liangretchen.net
- DNS ASK gw#####inegretchen.net
- DNS ASK ma#####lianchauncey.net
- DNS ASK gw#####inecalanthe.net
- DNS ASK gw#####inecalanthe.ru
- DNS ASK ma#####liancalanthe.net
- DNS ASK wi#####inaashleigh.net
- DNS ASK gu##155.cn
- DNS ASK sp##tnav.ru
- DNS ASK gw#####inechauncey.net
- DNS ASK ma#####lianchauncey.ru
- DNS ASK sa#####rellashleigh.net
- DNS ASK be#####ardashleigh.net
- DNS ASK ri#####inecalanthe.ru
- DNS ASK be#####ardcalanthe.net
- DNS ASK ma#####llabotwright.net
- DNS ASK ri#####inechauncey.net
- DNS ASK ev#####inachauncey.net
- DNS ASK ma#####llaellsworth.net
- DNS ASK ma#####lianashleigh.net
- DNS ASK ma#####llabotwright.ru
- DNS ASK gw#####ineashleigh.net
- DNS ASK al######inahuddleson.net
- DNS ASK be#####ardgretchen.net
- DNS ASK ka#######ayajivayapriroda.ru
- DNS ASK cl#####ortswomen.com
- DNS ASK ag#####anabolics.com
- DNS ASK pi##asia.cn
- DNS ASK ha####nhalflion.net
- DNS ASK ga####liongrass.net
- DNS ASK un###lgrain.org
- DNS ASK ga#####yundongyuan.cn
- DNS ASK sc####ainbow.net
- DNS ASK ca#####eeitinthecup.org
- DNS ASK na##top.ru
- DNS ASK ta#####pielenreiten.org
- DNS ASK si###ypeas.net
- DNS ASK do##bate.cn
- DNS ASK gr###factory.cn
- DNS ASK bu####rmansion.com
- DNS ASK pr##card.ru
- DNS ASK to###tosales.ru
- DNS ASK so####ryducks.com
- DNS ASK cl####portsmen.com
- DNS ASK sc#####epuzzlechess.org
- DNS ASK ch####isportsmen.ru
- DNS ASK ye####gdongwu.cn
- DNS ASK pr####anabolikov.ru
- DNS ASK ma#####llahuddleson.net
- DNS ASK ch#####anaellsworth.net
- DNS ASK du#####llahuddleson.net
- DNS ASK ch#####anahuddleson.net
- DNS ASK ch#####anaalbertson.net
- DNS ASK du#####llaellsworth.net
- DNS ASK du#####llaellsworth.ru
- DNS ASK wi#####hbyalbertson.net
- DNS ASK ba######mewalbertson.net
- DNS ASK wi#####hbyellsworth.net
- DNS ASK du#####llabotwright.net
- DNS ASK ch#####anabotwright.net
- DNS ASK ch#####anabotwright.ru
- DNS ASK wa#####tonalbertson.net
- DNS ASK ea#####ineellsworth.net
- DNS ASK wa#####tonellsworth.net
- DNS ASK wi#####inabotwright.net
- DNS ASK ea#####inealbertson.net
- DNS ASK ea#####inealbertson.ru
- DNS ASK ea#####inebotwright.net
- DNS ASK wa#####tonbotwright.net
- DNS ASK du#####llaalbertson.net
- DNS ASK ea#####inehuddleson.net
- DNS ASK wa#####tonhuddleson.net
- DNS ASK wa#####tonhuddleson.ru
- DNS ASK ri#####ineashleigh.net
- DNS ASK ri#####inecalanthe.net
- DNS ASK ev#####inegretchen.net
- DNS ASK al#####rinaalbertson.ru
- DNS ASK ev#####inacalanthe.net
- DNS ASK ev#####inaashleigh.net
- DNS ASK al######inaellsworth.net
- DNS ASK be#####ardchauncey.net
- DNS ASK be#####ardgretchen.ru
- DNS ASK ev#####inagretchen.net
- DNS ASK al######inabotwright.net
- DNS ASK al######inaalbertson.net
- DNS ASK ba######mewhuddleson.net
- DNS ASK wi#####hbybotwright.net
- DNS ASK ba######mewbotwright.net
- DNS ASK ba######mewellsworth.net
- DNS ASK wi#####hbyhuddleson.net
- DNS ASK wi#####hbyhuddleson.ru
- DNS ASK ev#####inechauncey.net
- DNS ASK ev#####inecalanthe.net
- DNS ASK ma#####llaalbertson.net
- DNS ASK ev#####ineashleigh.net
- DNS ASK ri#####inegretchen.net
- DNS ASK ev#####inaashleigh.ru