Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DHCP Procedure Cache Bus Adaptive Internet' = '<SYSTEM32>\xtyruyou.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Credential Port Search Accounts] 'ImagePath' = '<SYSTEM32>\xtyruyou.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Credential Port Search Accounts] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Executes the following:
- '<SYSTEM32>\eszfbdk.exe' "<SYSTEM32>\xtyruyou.exe"
- '%WINDIR%\Temp\wvdznm7bxylqjta.exe' -r 23300 tcp
- '%TEMP%\wvdznmgsfk16jtaxguxupxm.exe'
- '<SYSTEM32>\xtyruyou.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\luwvqtvra\run
- <SYSTEM32>\luwvqtvra\rng
- %WINDIR%\Temp\wvdznm7bxylqjta.exe
- <SYSTEM32>\luwvqtvra\cfg
- %TEMP%\wvdznmgsfk16jtaxguxupxm.exe
- <SYSTEM32>\luwvqtvra\tst
- <SYSTEM32>\eszfbdk.exe
- <SYSTEM32>\xtyruyou.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\eszfbdk.exe
- <SYSTEM32>\xtyruyou.exe
Deletes the following files:
- %WINDIR%\Temp\wvdznm7bxylqjta.exe
- %TEMP%\wvdznmgsfk16jtaxguxupxm.exe
Network activity:
Connects to:
- 'le###lower.net':80
- 'se###wide.net':80
- 'se###lower.net':80
- 'se###kiss.net':80
- 'le###wide.net':80
- '18#.#06.120.168':80
- '18#.#17.73.77':80
- 'ri###nstorm.net':80
- 'se####omorrow.net':80
- 'lo####thepings.ru':80
TCP:
HTTP GET requests:
- http://le###lower.net/index.php
- http://se###wide.net/index.php
- http://se###lower.net/index.php
- http://se###kiss.net/index.php
- http://le###wide.net/index.php
- http://18#.#06.120.168/index.php
- http://18#.#17.73.77/index.php
- http://ri###nstorm.net/index.php
- http://se####omorrow.net/index.php
- http://lo####thepings.ru/index.php
UDP:
- DNS ASK pl###nine.net
- DNS ASK fi###ever.net
- DNS ASK pl###never.net
- DNS ASK fi###ine.net
- DNS ASK fi###tart.net
- DNS ASK pl###start.net
- DNS ASK pl###start.ru
- DNS ASK lr###start.net
- DNS ASK vi###ine.net
- DNS ASK lr###nine.net
- DNS ASK vi###tart.net
- DNS ASK vi###ing.net
- DNS ASK vi##sing.ru
- DNS ASK lr###sing.net
- DNS ASK pl###sing.net
- DNS ASK se###sing.net
- DNS ASK se###sing.ru
- DNS ASK le###start.net
- DNS ASK le###sing.net
- DNS ASK to###ine.net
- DNS ASK fa###ever.net
- DNS ASK to###ever.net
- DNS ASK le###never.ru
- DNS ASK se###never.net
- DNS ASK fi###ing.net
- DNS ASK le###never.net
- DNS ASK se###start.net
- DNS ASK le###nine.net
- DNS ASK se###nine.net
- DNS ASK lr###nine.ru
- DNS ASK ta###bout.net
- DNS ASK wa###bout.net
- DNS ASK mu###lace.net
- DNS ASK wa###hild.net
- DNS ASK wa###nto.net
- DNS ASK ta###hild.net
- DNS ASK ta###hild.ru
- DNS ASK mu###hild.net
- DNS ASK pi###child.net
- DNS ASK mu###bout.net
- DNS ASK pi###into.net
- DNS ASK pi###place.net
- DNS ASK pi###place.ru
- DNS ASK mu###nto.net
- DNS ASK ta###nto.net
- DNS ASK yo###tart.net
- DNS ASK yo###tart.ru
- DNS ASK tr###start.net
- DNS ASK tr###sing.net
- DNS ASK vi###ever.net
- DNS ASK lr###never.net
- DNS ASK yo###ing.net
- DNS ASK tr###never.ru
- DNS ASK ta###lace.net
- DNS ASK wa###lace.net
- DNS ASK tr###never.net
- DNS ASK yo###ine.net
- DNS ASK tr###nine.net
- DNS ASK yo###ever.net
- DNS ASK yo###ook.net
- DNS ASK tr###cook.net
- DNS ASK yo###all.net
- DNS ASK tr###next.net
- DNS ASK tr###been.net
- DNS ASK tr###been.ru
- DNS ASK yo###ext.net
- DNS ASK ta###tart.net
- DNS ASK wa###tart.net
- DNS ASK wa###tart.ru
- DNS ASK wa###ing.net
- DNS ASK yo##tall.ru
- DNS ASK tr###tall.net
- DNS ASK ta###ing.net
- DNS ASK yo###een.net
- DNS ASK pl###tall.ru
- DNS ASK vi###een.net
- DNS ASK lr###been.net
- DNS ASK pl###tall.net
- DNS ASK fi###ook.net
- DNS ASK pl###cook.net
- DNS ASK fi###all.net
- DNS ASK lr###cook.net
- DNS ASK vi###all.net
- DNS ASK lr###tall.net
- DNS ASK vi##cook.ru
- DNS ASK vi###ext.net
- DNS ASK lr###next.net
- DNS ASK vi###ook.net
- DNS ASK ta###ine.net
- DNS ASK we###ine.net
- DNS ASK ve###ever.net
- DNS ASK we###ever.net
- DNS ASK ve###ine.net
- DNS ASK ve###tart.net
- DNS ASK ve###tart.ru
- DNS ASK we###tart.net
- DNS ASK to###tart.net
- DNS ASK fa###ine.net
- DNS ASK fa##nine.ru
- DNS ASK fa###tart.net
- DNS ASK we###ever.ru
- DNS ASK fa###ing.net
- DNS ASK to###ing.net
- DNS ASK we###ing.net
- DNS ASK mu##sing.ru
- DNS ASK pi###sing.net
- DNS ASK mu###tart.net
- DNS ASK mu###ing.net
- DNS ASK wa###ine.net
- DNS ASK ta###ever.net
- DNS ASK wa###ever.net
- DNS ASK mu###ever.net
- DNS ASK pi###never.net
- DNS ASK ve###ing.net
- DNS ASK pi###nine.ru
- DNS ASK pi###start.net
- DNS ASK mu###ine.net
- DNS ASK pi###nine.net
- DNS ASK pl###next.net
- DNS ASK pi###lower.ru
- DNS ASK fa###iss.net
- DNS ASK pi###lower.net
- DNS ASK fa###ower.ru
- DNS ASK pi####omorrow.net
- DNS ASK fa###ower.net
- DNS ASK le###kiss.net
- DNS ASK ve###ower.net
- DNS ASK ve####morrow.net
- DNS ASK we####morrow.net
- DNS ASK mu###ower.net
- DNS ASK we###ower.net
- DNS ASK to####morrow.net
- DNS ASK ve###omorrow.ru
- DNS ASK mu####morrow.net
- DNS ASK ta####morrow.net
- DNS ASK wa####morrow.net
- DNS ASK wa###omorrow.ru
- DNS ASK ta###ide.net
- DNS ASK ta##kiss.ru
- DNS ASK wa###iss.net
- DNS ASK wa###ide.net
- DNS ASK mu###ide.net
- DNS ASK mu##wide.ru
- DNS ASK pi###wide.net
- DNS ASK pi###kiss.net
- DNS ASK ta###ower.net
- DNS ASK wa###ower.net
- DNS ASK mu###iss.net
- DNS ASK ve###iss.net
- DNS ASK se###wide.ru
- DNS ASK se###kiss.net
- DNS ASK le###wide.net
- DNS ASK le####omorrow.net
- DNS ASK pl###wide.net
- DNS ASK fi##kiss.ru
- DNS ASK fi###iss.net
- DNS ASK lo####thepings.ru
- DNS ASK ri###nstorm.net
- DNS ASK mu###bout.ru
- DNS ASK se####omorrow.net
- DNS ASK se###lower.net
- DNS ASK le###lower.net
- DNS ASK se###wide.net
- DNS ASK pl####omorrow.ru
- DNS ASK pl####omorrow.net
- DNS ASK we###ide.net
- DNS ASK ve###ide.net
- DNS ASK fa####morrow.net
- DNS ASK fi###ide.net
- DNS ASK to###ower.net
- DNS ASK we###iss.net
- DNS ASK pl###kiss.net
- DNS ASK to##kiss.ru
- DNS ASK fi####morrow.net
- DNS ASK to###iss.net
- DNS ASK to###ide.net
- DNS ASK fi###ower.net
- DNS ASK fa###ide.net
- DNS ASK to###bout.net
- DNS ASK le###place.net
- DNS ASK se###place.net
- DNS ASK fa###bout.net
- DNS ASK fa###hild.net
- DNS ASK to###hild.net
- DNS ASK to###hild.ru
- DNS ASK se###child.net
- DNS ASK le###about.net
- DNS ASK se###about.net
- DNS ASK le###child.net
- DNS ASK le###into.net
- DNS ASK le###into.ru
- DNS ASK se###into.net
- DNS ASK to###nto.net
- DNS ASK we###nto.net
- DNS ASK we##into.ru
- DNS ASK ve###hild.net
- DNS ASK ve###nto.net
- DNS ASK pi###about.net
- DNS ASK ve###lace.net
- DNS ASK we###lace.net
- DNS ASK fa###lace.ru
- DNS ASK to###lace.net
- DNS ASK fa###nto.net
- DNS ASK we###bout.net
- DNS ASK we###hild.net
- DNS ASK ve###bout.net
- DNS ASK fa###lace.net
- DNS ASK se###about.ru
- DNS ASK yo###lace.net
- DNS ASK yo###nto.net
- DNS ASK tr###place.net
- DNS ASK lr###about.net
- DNS ASK lr###child.net
- DNS ASK vi###bout.net
- DNS ASK vi###bout.ru
- DNS ASK yo###bout.net
- DNS ASK tr###about.net
- DNS ASK ta###iss.net
- DNS ASK tr###child.net
- DNS ASK tr###into.net
- DNS ASK tr###into.ru
- DNS ASK yo###hild.net
- DNS ASK vi###hild.net
- DNS ASK fi###hild.net
- DNS ASK fi###hild.ru
- DNS ASK pl###child.net
- DNS ASK pl###into.net
- DNS ASK fi###lace.net
- DNS ASK pl###place.net
- DNS ASK fi###nto.net
- DNS ASK lr###place.ru
- DNS ASK vi###nto.net
- DNS ASK lr###into.net
- DNS ASK lr###place.net
- DNS ASK fi###bout.net
- DNS ASK pl###about.net
- DNS ASK vi###lace.net
- '23#.#55.255.250':1900