Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Base Proxy AuthIP Routing Notification Machine' = 'C:\xshkfluxascip\hdsdylxb.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Bluetooth Endpoint Receiver] 'ImagePath' = 'C:\xshkfluxascip\hdsdylxb.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Bluetooth Endpoint Receiver] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\xshkfluxascip\ebovjqgvsix.exe' "c:\xshkfluxascip\hdsdylxb.exe"
- 'C:\xshkfluxascip\hdsdylxb.exe'
- 'C:\xshkfluxascip\ixiy2m2iorvpwvvwnydeerg.exe'
Modifies file system:
Creates the following files:
- C:\xshkfluxascip\hdsdylxb.exe
- C:\xshkfluxascip\ebovjqgvsix.exe
- C:\xshkfluxascip\jvupycd
- %WINDIR%\xshkfluxascip\x7v5wu7xosj
- C:\xshkfluxascip\x7v5wu7xosj
- C:\xshkfluxascip\ixiy2m2iorvpwvvwnydeerg.exe
Sets the 'hidden' attribute to the following files:
- C:\xshkfluxascip\ebovjqgvsix.exe
- C:\xshkfluxascip\hdsdylxb.exe
Deletes the following files:
- C:\xshkfluxascip\ixiy2m2iorvpwvvwnydeerg.exe
- %WINDIR%\xshkfluxascip\x7v5wu7xosj
Substitutes the following files:
- %WINDIR%\xshkfluxascip\x7v5wu7xosj
Network activity:
Connects to:
- 'ag#####anabolics.com':80
- 'so####ryducks.com':80
- 'un###lgrain.org':80
- 'ca#####eeitinthecup.org':80
- 'ga#####yundongyuan.cn':80
- 'ga####liongrass.net':80
- 'do##bate.cn':80
- 'pi##asia.cn':80
- 'ka#######ayajivayapriroda.ru':80
- 'ja#####ineanabella.net':80
- 'ch#####belsharlene.net':80
- 'ge#####nnaanabella.ru':80
- 'ge#####nnaanabella.net':80
- 'ge#####nnaferdinand.net':80
- 'ja#####inejosephina.net':80
- 're#####nnesharlene.net':80
- 'ge#####nnajosephina.net':80
- 'ha####nhalflion.net':80
- 'sc#####epuzzlechess.org':80
- 'sc####ainbow.net':80
- 'ta#####pielenreiten.org':80
- 'ch####isportsmen.ru':80
- 'sp##tnav.ru':80
- 'gu##155.cn':80
- 'pr####anabolikov.ru':80
- 'pr##card.ru':80
- 'cl####portsmen.com':80
- 'na##top.ru':80
- 'bu####rmansion.com':80
- 'gr###factory.cn':80
- 'cl#####ortswomen.com':80
- 'si###ypeas.net':80
- 'to###tosales.ru':80
- 'ye####gdongwu.cn':80
TCP:
HTTP GET requests:
- http://ag#####anabolics.com/index.php
- http://so####ryducks.com/index.php
- http://un###lgrain.org/index.php
- http://ca#####eeitinthecup.org/index.php
- http://ga#####yundongyuan.cn/index.php
- http://ga####liongrass.net/index.php
- http://do##bate.cn/index.php
- http://pi##asia.cn/index.php
- http://ka#######ayajivayapriroda.ru/index.php
- http://ja#####ineanabella.net/index.php
- http://ch#####belsharlene.net/index.php
- http://ge#####nnaanabella.ru/index.php
- http://ge#####nnaanabella.net/index.php
- http://ge#####nnaferdinand.net/index.php
- http://ja#####inejosephina.net/index.php
- http://re#####nnesharlene.net/index.php
- http://ge#####nnajosephina.net/index.php
- http://ha####nhalflion.net/index.php
- http://sc#####epuzzlechess.org/index.php
- http://sc####ainbow.net/index.php
- http://ta#####pielenreiten.org/index.php
- http://ch####isportsmen.ru/index.php
- http://sp##tnav.ru/index.php
- http://gu##155.cn/index.php
- http://pr####anabolikov.ru/index.php
- http://pr##card.ru/index.php
- http://cl####portsmen.com/index.php
- http://na##top.ru/index.php
- http://bu####rmansion.com/index.php
- http://gr###factory.cn/index.php
- http://cl#####ortswomen.com/index.php
- http://si###ypeas.net/index.php
- http://to###tosales.ru/index.php
- http://ye####gdongwu.cn/index.php
UDP:
- DNS ASK ch######ellerichardson.net
- DNS ASK al######iapatrickson.net
- DNS ASK ch######ellepatrickson.net
- DNS ASK al#####riarichardson.ru
- DNS ASK al######iaatterberry.net
- DNS ASK ch######elleatterberry.net
- DNS ASK al######iarichardson.net
- DNS ASK al######eashakesheave.net
- DNS ASK er######detimberlake.net
- DNS ASK al######eatimberlake.net
- DNS ASK er######deshakesheave.net
- DNS ASK er######dechristians.net
- DNS ASK al######eachristians.net
- DNS ASK al#####reachristians.ru
- DNS ASK be#####tteatterberry.ru
- DNS ASK be######teatterberry.net
- DNS ASK ki######ighatterberry.net
- DNS ASK ki######ighunderwood.net
- DNS ASK re######nepatrickson.net
- DNS ASK ch######elpatrickson.net
- DNS ASK be#####tteunderwood.net
- DNS ASK ki######ighpatrickson.ru
- DNS ASK al#####riaunderwood.net
- DNS ASK ch######elleunderwood.net
- DNS ASK ki######ighpatrickson.net
- DNS ASK be######terichardson.net
- DNS ASK ki######ighrichardson.net
- DNS ASK be######tepatrickson.net
- DNS ASK ma######tachristians.net
- DNS ASK ch######nnechristians.net
- DNS ASK ma######tashakesheave.net
- DNS ASK ch######herstainthorpe.net
- DNS ASK ch######hertimberlake.net
- DNS ASK ch######hertimberlake.ru
- DNS ASK te######cestainthorpe.net
- DNS ASK ma######tastainthorpe.net
- DNS ASK ch######nnestainthorpe.net
- DNS ASK ch######nnestainthorpe.ru
- DNS ASK ch######nnetimberlake.net
- DNS ASK ma######tashakesheave.ru
- DNS ASK ch######nneshakesheave.net
- DNS ASK ma######tatimberlake.net
- DNS ASK mo######ryshakesheave.net
- DNS ASK ch######elshakesheave.ru
- DNS ASK mo######rytimberlake.net
- DNS ASK mo######rychristians.net
- DNS ASK er######destainthorpe.net
- DNS ASK er######destainthorpe.ru
- DNS ASK al######eastainthorpe.net
- DNS ASK te######ceshakesheave.net
- DNS ASK ch######hershakesheave.net
- DNS ASK te######cetimberlake.net
- DNS ASK ch######herchristians.net
- DNS ASK mo######rystainthorpe.net
- DNS ASK te######cechristians.net
- DNS ASK te#####ncechristians.ru
- DNS ASK mo######rypatrickson.net
- DNS ASK ch#####belpatrickson.ru
- DNS ASK te#####nceunderwood.net
- DNS ASK mo######ryrichardson.net
- DNS ASK mo#####eryunderwood.net
- DNS ASK mo######ryatterberry.net
- DNS ASK mo#####eryatterberry.ru
- DNS ASK te######cerichardson.net
- DNS ASK ch######herrichardson.net
- DNS ASK te######cepatrickson.net
- DNS ASK te#####ncerichardson.ru
- DNS ASK ch######herunderwood.net
- DNS ASK te######ceatterberry.net
- DNS ASK ch######heratterberry.net
- DNS ASK er#####udeunderwood.net
- DNS ASK er#####udeunderwood.ru
- DNS ASK al#####reaunderwood.net
- DNS ASK me#####herernestine.net
- DNS ASK ca#####nechastity.net
- DNS ASK me#####herchastity.net
- DNS ASK ca#####neernestine.net
- DNS ASK al#####rearichardson.ru
- DNS ASK er######depatrickson.net
- DNS ASK al######eapatrickson.net
- DNS ASK al######earichardson.net
- DNS ASK er######deatterberry.net
- DNS ASK al######eaatterberry.net
- DNS ASK er######derichardson.net
- DNS ASK ja######nepatrickson.net
- DNS ASK ge######napatrickson.net
- DNS ASK re#####nneunderwood.net
- DNS ASK ge######narichardson.net
- DNS ASK ge######naatterberry.net
- DNS ASK ge#####nnaatterberry.ru
- DNS ASK ja######nerichardson.net
- DNS ASK re######nerichardson.net
- DNS ASK ch######elrichardson.net
- DNS ASK ch#####belrichardson.ru
- DNS ASK ch######elatterberry.net
- DNS ASK re#####nneunderwood.ru
- DNS ASK ch#####belunderwood.net
- DNS ASK re######neatterberry.net
- DNS ASK ma######taatterberry.net
- DNS ASK ch######nneatterberry.net
- DNS ASK ma######tarichardson.net
- DNS ASK ch#####anneunderwood.ru
- DNS ASK ma#####ttaunderwood.net
- DNS ASK ch######herpatrickson.net
- DNS ASK ch######nneunderwood.net
- DNS ASK ja#####ineunderwood.net
- DNS ASK ge#####nnaunderwood.net
- DNS ASK ja######neatterberry.net
- DNS ASK ch######nnepatrickson.net
- DNS ASK ch######nnerichardson.net
- DNS ASK ma######tapatrickson.net
- DNS ASK ma#####ttapatrickson.ru
- DNS ASK ja######nechristians.net
- DNS ASK ch#####annesharlene.net
- DNS ASK ch######herferdinand.net
- DNS ASK ge#####nnasharlene.net
- DNS ASK ch######nnejosephina.net
- DNS ASK ch######herjosephina.net
- DNS ASK te#####nceanabella.net
- DNS ASK ch#####belferdinand.net
- DNS ASK ch#####belsharlene.net
- DNS ASK re#####nnesharlene.net
- DNS ASK ge#####nnajosephina.net
- DNS ASK ja#####ineanabella.net
- DNS ASK ja#####ineferdinand.net
- DNS ASK ge#####nnaanabella.ru
- DNS ASK ge#####nnaanabella.net
- DNS ASK te#####ncejosephina.net
- DNS ASK mo#####eryanabella.ru
- DNS ASK mo#####eryanabella.net
- DNS ASK ch#####phersharlene.ru
- DNS ASK te#####ncejosephina.ru
- DNS ASK ja#####inesharlene.ru
- DNS ASK ch#####anneanabella.net
- DNS ASK ch#####phersharlene.net
- DNS ASK ma#####ttasharlene.net
- DNS ASK ma#####ttaanabella.net
- DNS ASK ch#####anneferdinand.ru
- DNS ASK ma#####ttajosephina.net
- DNS ASK ja#####inesharlene.net
- DNS ASK ch#####belanabella.net
- DNS ASK si###ypeas.net
- DNS ASK pr##card.ru
- DNS ASK sc####ainbow.net
- DNS ASK cl#####ortswomen.com
- DNS ASK na##top.ru
- DNS ASK to###tosales.ru
- DNS ASK ye####gdongwu.cn
- DNS ASK pr####anabolikov.ru
- DNS ASK ch####isportsmen.ru
- DNS ASK sp##tnav.ru
- DNS ASK gu##155.cn
- DNS ASK ta#####pielenreiten.org
- DNS ASK ha####nhalflion.net
- DNS ASK sc#####epuzzlechess.org
- DNS ASK ca#####eeitinthecup.org
- DNS ASK ag#####anabolics.com
- DNS ASK so####ryducks.com
- DNS ASK un###lgrain.org
- DNS ASK ge#####nnaferdinand.net
- DNS ASK ja#####inejosephina.net
- DNS ASK ka#######ayajivayapriroda.ru
- DNS ASK bu####rmansion.com
- DNS ASK gr###factory.cn
- DNS ASK cl####portsmen.com
- DNS ASK ga####liongrass.net
- DNS ASK do##bate.cn
- DNS ASK pi##asia.cn
- DNS ASK ga#####yundongyuan.cn
- DNS ASK be######techristians.net
- DNS ASK ki######ighchristians.net
- DNS ASK be######teshakesheave.net
- DNS ASK ch######elstainthorpe.net
- DNS ASK ch######eltimberlake.net
- DNS ASK re######nestainthorpe.net
- DNS ASK re######nestainthorpe.ru
- DNS ASK be######testainthorpe.net
- DNS ASK ki######ighstainthorpe.net
- DNS ASK ch######elletimberlake.net
- DNS ASK ki######ightimberlake.net
- DNS ASK ki######ighshakesheave.net
- DNS ASK ki######ighshakesheave.ru
- DNS ASK be######tetimberlake.net
- DNS ASK ja#####inetimberlake.ru
- DNS ASK ge######natimberlake.net
- DNS ASK ja######nestainthorpe.net
- DNS ASK ja######netimberlake.net
- DNS ASK ge######nachristians.net
- DNS ASK ja######neshakesheave.net
- DNS ASK ge######nashakesheave.net
- DNS ASK re######neshakesheave.net
- DNS ASK ch######elshakesheave.net
- DNS ASK re######netimberlake.net
- DNS ASK ch#####belchristians.ru
- DNS ASK ge######nastainthorpe.net
- DNS ASK re######nechristians.net
- DNS ASK ch######elchristians.net
- DNS ASK al#####reajosephina.ru
- DNS ASK mo#####eryferdinand.net
- DNS ASK te#####ncesharlene.net
- DNS ASK al#####reajosephina.net
- DNS ASK er#####udeanabella.net
- DNS ASK al#####reaanabella.net
- DNS ASK er#####udejosephina.net
- DNS ASK ch#####beljosephina.net
- DNS ASK te#####nceferdinand.net
- DNS ASK ch#####pheranabella.net
- DNS ASK ch######nneferdinand.net
- DNS ASK ma#####ttaferdinand.net
- DNS ASK mo#####erysharlene.net
- DNS ASK mo#####eryjosephina.net
- DNS ASK ch######ellechristians.net
- DNS ASK al######iatimberlake.net
- DNS ASK al######iashakesheave.net
- DNS ASK al#####riachristians.ru
- DNS ASK ch######ellestainthorpe.net
- DNS ASK al######iachristians.net
- DNS ASK ch######elletimberlake.ru
- DNS ASK er#####udeferdinand.net
- DNS ASK er#####udeferdinand.ru
- DNS ASK al#####reaferdinand.net
- DNS ASK al#####reasharlene.net
- DNS ASK ch######elleshakesheave.net
- DNS ASK al######iastainthorpe.net
- DNS ASK er#####udesharlene.net
