Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Window Filtering Function Registry DNS Driver' = 'C:\bysosfornu\aobcrhnk.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Compatibility PC Health] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\bysosfornu\cywyrhkrdea.exe' "c:\bysosfornu\aobcrhnk.exe"
- 'C:\bysosfornu\aobcrhnk.exe'
- 'C:\bysosfornu\fjxhb4movtcdofsmvq.exe'
Modifies file system :
Creates the following files:
- C:\bysosfornu\aobcrhnk.exe
- C:\bysosfornu\cywyrhkrdea.exe
- C:\bysosfornu\yd6tpih
- %WINDIR%\bysosfornu\x0qxfwttjqf
- C:\bysosfornu\x0qxfwttjqf
- C:\bysosfornu\fjxhb4movtcdofsmvq.exe
Sets the 'hidden' attribute to the following files:
- C:\bysosfornu\cywyrhkrdea.exe
- C:\bysosfornu\aobcrhnk.exe
Deletes the following files:
- C:\bysosfornu\fjxhb4movtcdofsmvq.exe
- %WINDIR%\bysosfornu\x0qxfwttjqf
Network activity:
Connects to:
- 'of###catch.net':80
- 'co####edress.net':80
- 'ch###dress.net':80
- 'al###eearly.net':80
- 'of###eearly.net':80
- 'al###catch.net':80
- 'ch###eearly.net':80
- 'co####ecatch.net':80
- 'th###dress.net':80
- 'co####epublic.net':80
- 'ch###public.net':80
- 'co####eeearly.net':80
TCP:
HTTP GET requests:
- http://of###catch.net/index.php?me########
- http://co####edress.net/index.php?me########
- http://ch###dress.net/index.php?me########
- http://al###eearly.net/index.php?me########
- http://of###eearly.net/index.php?me########
- http://al###catch.net/index.php?me########
- http://ch###eearly.net/index.php?me########
- http://co####ecatch.net/index.php?me########
- http://th###dress.net/index.php?me########
- http://co####epublic.net/index.php?me########
- http://ch###public.net/index.php?me########
- http://co####eeearly.net/index.php?me########
UDP:
- DNS ASK of###catch.net
- DNS ASK co####edress.net
- DNS ASK ch###dress.net
- DNS ASK al###catch.net
- DNS ASK of###public.net
- DNS ASK al###eearly.net
- DNS ASK of###eearly.net
- DNS ASK co####epublic.net
- DNS ASK ch###catch.net
- DNS ASK pr####tdress.net
- DNS ASK th###dress.net
- DNS ASK co####ecatch.net
- DNS ASK ch###public.net
- DNS ASK co####eeearly.net
- DNS ASK ch###eearly.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
