Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Disk Shadow Brightness Firewall Socket Detection' = '<SYSTEM32>\sicerohjxbya.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\sicerohjxbya.exe
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\BitLocker Extender IKE Acquisition Cache] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- <SYSTEM32>\czmwcmw.exe "<SYSTEM32>\sicerohjxbya.exe"
- %WINDIR%\Temp\sxfsoo2wcyxc.exe -r 47071 tcp
- %TEMP%\sxfsoo2u5yxusa6kk.exe
- <SYSTEM32>\sicerohjxbya.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\cdysvra\run
- <SYSTEM32>\cdysvra\rng
- <SYSTEM32>\cdysvra\cfg
- <SYSTEM32>\cdysvra\por
- %WINDIR%\Temp\sxfsoo2wcyxc.exe
- %TEMP%\sxfsoo2u5yxusa6kk.exe
- <SYSTEM32>\cdysvra\tst
- <SYSTEM32>\cdysvra\etc
- <SYSTEM32>\czmwcmw.exe
- <SYSTEM32>\sicerohjxbya.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\czmwcmw.exe
- <SYSTEM32>\sicerohjxbya.exe
Deletes the following files:
- %WINDIR%\Temp\sxfsoo2wcyxc.exe
- %TEMP%\sxfsoo2u5yxusa6kk.exe
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'le###hear.net':80
- 'to###how.net':80
- 'se###hear.net':80
- 'se###rule.net':80
- 'le###rule.net':80
- 'fa###how.net':80
- 'fa###ule.net':80
- 'to###ear.net':80
- 'to###ule.net':80
- 'to###unt.net':80
- 'fa###unt.net':80
- 'le###hunt.net':80
- 'fi###unt.net':80
- 'pl###rule.net':80
- 'pl###hunt.net':80
- 'pl###show.net':80
- 'fi###how.net':80
- 'fi###ule.net':80
- 'le###show.net':80
- 'se###hunt.net':80
- 'se###show.net':80
- 'pl###hear.net':80
- 'fi###ear.net':80
- 'pi###hear.net':80
- 'mu###ear.net':80
- 'mu###ule.net':80
- 'mu###unt.net':80
- 'pi###rule.net':80
- 'wa###how.net':80
- 'wa###ule.net':80
- 'ta###ule.net':80
- 'ta###unt.net':80
- 'ta###how.net':80
- 'wa###unt.net':80
- 'pi###hunt.net':80
- 'we###unt.net':80
- 've###unt.net':80
- 've###how.net':80
- 'fa###ear.net':80
- 'we###how.net':80
- 'we###ule.net':80
- 'pi###show.net':80
- 'mu###how.net':80
- 've###ear.net':80
- 've###ule.net':80
- 'we###ear.net':80
- 'mu###hoe.net':80
- 'pi####ctober.net':80
- 'pi###shoe.net':80
- 'we###uter.net':80
- 've###uter.net':80
- 'mu###ctober.net':80
- 'mu###uter.net':80
- 'wa###hoe.net':80
- 'pi###outer.net':80
- 'pi###moon.net':80
- 'mu###oon.net':80
- 've###oon.net':80
- 'el#####arimagine.com':80
- 'go#####everytime.com':80
- 'do####club-grup.com':80
- 'ga########all-talk-community.com':80
- 'sp###aguga.com':80
- 'ja###uter.com':80
- 've###ctober.net':80
- 'we###oon.net':80
- 'we###ctober.net':80
- 'we###hoe.net':80
- 've###hoe.net':80
- 'lr###show.net':80
- 'vi###how.net':80
- 'yo###ear.net':80
- 'yo###ule.net':80
- 'tr###hear.net':80
- 'lr###hunt.net':80
- 'lr###hear.net':80
- 'vi###ear.net':80
- 'vi###ule.net':80
- 'vi###unt.net':80
- 'lr###rule.net':80
- 'tr###rule.net':80
- 'wa###oon.net':80
- 'ta###oon.net':80
- 'ta###ctober.net':80
- 'ta###hoe.net':80
- 'wa###ctober.net':80
- 'wa###uter.net':80
- 'tr###hunt.net':80
- 'yo###unt.net':80
- 'yo###how.net':80
- 'ta###uter.net':80
- 'tr###show.net':80
TCP:
HTTP GET requests:
- le###hear.net/forum/search.php?me############################################
- to###how.net/forum/search.php?me############################################
- se###hear.net/forum/search.php?me############################################
- se###rule.net/forum/search.php?me############################################
- le###rule.net/forum/search.php?me############################################
- fa###how.net/forum/search.php?me############################################
- fa###ule.net/forum/search.php?me############################################
- to###ear.net/forum/search.php?me############################################
- to###ule.net/forum/search.php?me############################################
- to###unt.net/forum/search.php?me############################################
- fa###unt.net/forum/search.php?me############################################
- le###hunt.net/forum/search.php?me############################################
- fi###unt.net/forum/search.php?me############################################
- pl###rule.net/forum/search.php?me############################################
- pl###hunt.net/forum/search.php?me############################################
- pl###show.net/forum/search.php?me############################################
- fi###how.net/forum/search.php?me############################################
- fi###ule.net/forum/search.php?me############################################
- le###show.net/forum/search.php?me############################################
- se###hunt.net/forum/search.php?me############################################
- se###show.net/forum/search.php?me############################################
- pl###hear.net/forum/search.php?me############################################
- fi###ear.net/forum/search.php?me############################################
- pi###hear.net/forum/search.php?me############################################
- mu###ear.net/forum/search.php?me############################################
- mu###ule.net/forum/search.php?me############################################
- mu###unt.net/forum/search.php?me############################################
- pi###rule.net/forum/search.php?me############################################
- wa###how.net/forum/search.php?me############################################
- wa###ule.net/forum/search.php?me############################################
- ta###ule.net/forum/search.php?me############################################
- ta###unt.net/forum/search.php?me############################################
- ta###how.net/forum/search.php?me############################################
- wa###unt.net/forum/search.php?me############################################
- pi###hunt.net/forum/search.php?me############################################
- we###unt.net/forum/search.php?me############################################
- ve###unt.net/forum/search.php?me############################################
- ve###how.net/forum/search.php?me############################################
- fa###ear.net/forum/search.php?me############################################
- we###how.net/forum/search.php?me############################################
- we###ule.net/forum/search.php?me############################################
- pi###show.net/forum/search.php?me############################################
- mu###how.net/forum/search.php?me############################################
- ve###ear.net/forum/search.php?me############################################
- ve###ule.net/forum/search.php?me############################################
- we###ear.net/forum/search.php?me############################################
- mu###hoe.net/forum/search.php?me############################################
- pi####ctober.net/forum/search.php?me############################################
- pi###shoe.net/forum/search.php?me############################################
- we###uter.net/forum/search.php?me############################################
- ve###uter.net/forum/search.php?me############################################
- mu###ctober.net/forum/search.php?me############################################
- mu###uter.net/forum/search.php?me############################################
- wa###hoe.net/forum/search.php?me############################################
- pi###outer.net/forum/search.php?me############################################
- pi###moon.net/forum/search.php?me############################################
- mu###oon.net/forum/search.php?me############################################
- ve###oon.net/forum/search.php?me############################################
- el#####arimagine.com/forum/search.php?me############################################
- go#####everytime.com/forum/search.php?me############################################
- do####club-grup.com/forum/search.php?me############################################
- ga########all-talk-community.com/forum/search.php?me############################################
- sp###aguga.com/forum/search.php?me############################################
- ja###uter.com/forum/search.php?me############################################
- ve###ctober.net/forum/search.php?me############################################
- we###oon.net/forum/search.php?me############################################
- we###ctober.net/forum/search.php?me############################################
- we###hoe.net/forum/search.php?me############################################
- ve###hoe.net/forum/search.php?me############################################
- lr###show.net/forum/search.php?me############################################
- vi###how.net/forum/search.php?me############################################
- yo###ear.net/forum/search.php?me############################################
- yo###ule.net/forum/search.php?me############################################
- tr###hear.net/forum/search.php?me############################################
- lr###hunt.net/forum/search.php?me############################################
- lr###hear.net/forum/search.php?me############################################
- vi###ear.net/forum/search.php?me############################################
- vi###ule.net/forum/search.php?me############################################
- vi###unt.net/forum/search.php?me############################################
- lr###rule.net/forum/search.php?me############################################
- tr###rule.net/forum/search.php?me############################################
- wa###oon.net/forum/search.php?me############################################
- ta###oon.net/forum/search.php?me############################################
- ta###ctober.net/forum/search.php?me############################################
- ta###hoe.net/forum/search.php?me############################################
- wa###ctober.net/forum/search.php?me############################################
- wa###uter.net/forum/search.php?me############################################
- tr###hunt.net/forum/search.php?me############################################
- yo###unt.net/forum/search.php?me############################################
- yo###how.net/forum/search.php?me############################################
- ta###uter.net/forum/search.php?me############################################
- tr###show.net/forum/search.php?me############################################
UDP:
- DNS ASK le###hear.net
- DNS ASK to###how.net
- DNS ASK se###hear.net
- DNS ASK se###rule.net
- DNS ASK le###rule.net
- DNS ASK fa###how.net
- DNS ASK fa###ule.net
- DNS ASK to###ear.net
- DNS ASK to###ule.net
- DNS ASK to###unt.net
- DNS ASK fa###unt.net
- DNS ASK le###hunt.net
- DNS ASK fi###unt.net
- DNS ASK pl###rule.net
- DNS ASK pl###hunt.net
- DNS ASK pl###show.net
- DNS ASK fi###how.net
- DNS ASK fi###ule.net
- DNS ASK le###show.net
- DNS ASK se###hunt.net
- DNS ASK se###show.net
- DNS ASK pl###hear.net
- DNS ASK fi###ear.net
- DNS ASK pi###hear.net
- DNS ASK mu###ear.net
- DNS ASK mu###ule.net
- DNS ASK mu###unt.net
- DNS ASK pi###rule.net
- DNS ASK wa###how.net
- DNS ASK wa###ule.net
- DNS ASK ta###ule.net
- DNS ASK ta###unt.net
- DNS ASK ta###how.net
- DNS ASK wa###unt.net
- DNS ASK pi###hunt.net
- DNS ASK we###unt.net
- DNS ASK ve###unt.net
- DNS ASK ve###how.net
- DNS ASK fa###ear.net
- DNS ASK we###how.net
- DNS ASK we###ule.net
- DNS ASK pi###show.net
- DNS ASK mu###how.net
- DNS ASK ve###ear.net
- DNS ASK ve###ule.net
- DNS ASK we###ear.net
- DNS ASK vi###ear.net
- DNS ASK pi###shoe.net
- DNS ASK mu###hoe.net
- DNS ASK ve###uter.net
- DNS ASK ve###oon.net
- DNS ASK we###uter.net
- DNS ASK pi####ctober.net
- DNS ASK pi###outer.net
- DNS ASK mu###uter.net
- DNS ASK mu###oon.net
- DNS ASK mu###ctober.net
- DNS ASK pi###moon.net
- DNS ASK el#####arimagine.com
- DNS ASK go#####everytime.com
- DNS ASK do####club-grup.com
- DNS ASK ga########all-talk-community.com
- DNS ASK sp###aguga.com
- DNS ASK ja###uter.com
- DNS ASK ve###ctober.net
- DNS ASK we###oon.net
- DNS ASK we###ctober.net
- DNS ASK we###hoe.net
- DNS ASK ve###hoe.net
- DNS ASK wa###hoe.net
- DNS ASK yo###ear.net
- DNS ASK lr###show.net
- DNS ASK tr###hear.net
- DNS ASK tr###rule.net
- DNS ASK yo###ule.net
- DNS ASK vi###how.net
- DNS ASK vi###ule.net
- DNS ASK lr###hear.net
- DNS ASK lr###rule.net
- DNS ASK lr###hunt.net
- DNS ASK vi###unt.net
- DNS ASK wa###oon.net
- DNS ASK ta###oon.net
- DNS ASK ta###ctober.net
- DNS ASK ta###hoe.net
- DNS ASK wa###ctober.net
- DNS ASK wa###uter.net
- DNS ASK tr###hunt.net
- DNS ASK yo###unt.net
- DNS ASK yo###how.net
- DNS ASK ta###uter.net
- DNS ASK tr###show.net
- '23#.#55.255.250':1900