Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WebClient Machine Brightness Call' = 'C:\edqdyrdejerdxr\nuszbup.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\WLAN Player Machine Mapper Propagation] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\edqdyrdejerdxr\tucktqxzsnnl.exe' "c:\edqdyrdejerdxr\nuszbup.exe"
- 'C:\edqdyrdejerdxr\nuszbup.exe'
- 'C:\edqdyrdejerdxr\ihbd3blkrnp4yladpl5uh.exe'
Modifies file system :
Creates the following files:
- C:\edqdyrdejerdxr\nuszbup.exe
- C:\edqdyrdejerdxr\tucktqxzsnnl.exe
- C:\edqdyrdejerdxr\jt5brf
- %WINDIR%\edqdyrdejerdxr\rr9kcv5wu
- C:\edqdyrdejerdxr\rr9kcv5wu
- C:\edqdyrdejerdxr\ihbd3blkrnp4yladpl5uh.exe
Sets the 'hidden' attribute to the following files:
- C:\edqdyrdejerdxr\tucktqxzsnnl.exe
- C:\edqdyrdejerdxr\nuszbup.exe
Deletes the following files:
- C:\edqdyrdejerdxr\ihbd3blkrnp4yladpl5uh.exe
- %WINDIR%\edqdyrdejerdxr\rr9kcv5wu
Network activity:
Connects to:
- 'tr####elight.net':80
- 'st####delight.net':80
- 'ga####borrow.net':80
- 'be####borrow.net':80
- 'tr###train.net':80
- 'st###ttrain.net':80
- 'tr#####ectricity.net':80
- 'st#####lectricity.net':80
- 'ga####delight.net':80
- 'be####delight.net':80
- 'br###borrow.net':80
- 'fl###borrow.net':80
- 'ga###rtrain.net':80
- 'be###rtrain.net':80
- 'ga#####lectricity.net':80
- 'be#####lectricity.net':80
- 'tr###borrow.net':80
- 'la####elight.net':80
- 'ca#####electricity.net':80
- 're####borrow.net':80
- 'ca####ndelight.net':80
- 'la###train.net':80
- 'la###borrow.net':80
- 'la#####ectricity.net':80
- 'ca####ntrain.net':80
- 're####delight.net':80
- 'el#####celectricity.net':80
- 'st####borrow.net':80
- 'el####icdelight.net':80
- 're###dtrain.net':80
- 'el####icborrow.net':80
- 're#####lectricity.net':80
- 'el####ictrain.net':80
TCP:
HTTP GET requests:
- http://tr####elight.net/index.php?me########
- http://st####delight.net/index.php?me########
- http://ga####borrow.net/index.php?me########
- http://be####borrow.net/index.php?me########
- http://tr###train.net/index.php?me########
- http://st###ttrain.net/index.php?me########
- http://tr#####ectricity.net/index.php?me########
- http://st#####lectricity.net/index.php?me########
- http://ga####delight.net/index.php?me########
- http://be####delight.net/index.php?me########
- http://br###borrow.net/index.php?me########
- http://fl###borrow.net/index.php?me########
- http://ga###rtrain.net/index.php?me########
- http://be###rtrain.net/index.php?me########
- http://ga#####lectricity.net/index.php?me########
- http://be#####lectricity.net/index.php?me########
- http://tr###borrow.net/index.php?me########
- http://la####elight.net/index.php?me########
- http://ca#####electricity.net/index.php?me########
- http://re####borrow.net/index.php?me########
- http://ca####ndelight.net/index.php?me########
- http://la###train.net/index.php?me########
- http://la###borrow.net/index.php?me########
- http://la#####ectricity.net/index.php?me########
- http://ca####ntrain.net/index.php?me########
- http://re####delight.net/index.php?me########
- http://el#####celectricity.net/index.php?me########
- http://st####borrow.net/index.php?me########
- http://el####icdelight.net/index.php?me########
- http://re###dtrain.net/index.php?me########
- http://el####icborrow.net/index.php?me########
- http://re#####lectricity.net/index.php?me########
- http://el####ictrain.net/index.php?me########
UDP:
- DNS ASK st####delight.net
- DNS ASK tr#####ectricity.net
- DNS ASK be####borrow.net
- DNS ASK tr####elight.net
- DNS ASK st###ttrain.net
- DNS ASK tr###borrow.net
- DNS ASK st#####lectricity.net
- DNS ASK tr###train.net
- DNS ASK ga####borrow.net
- DNS ASK ga####delight.net
- DNS ASK be####delight.net
- DNS ASK br###borrow.net
- DNS ASK fl###borrow.net
- DNS ASK ga###rtrain.net
- DNS ASK be###rtrain.net
- DNS ASK ga#####lectricity.net
- DNS ASK be#####lectricity.net
- DNS ASK ca#####electricity.net
- DNS ASK la#####ectricity.net
- DNS ASK ca####ndelight.net
- DNS ASK la####elight.net
- DNS ASK ca####nborrow.net
- DNS ASK la###borrow.net
- DNS ASK ca####ntrain.net
- DNS ASK la###train.net
- DNS ASK re####borrow.net
- DNS ASK re####delight.net
- DNS ASK el#####celectricity.net
- DNS ASK st####borrow.net
- DNS ASK el####icdelight.net
- DNS ASK re###dtrain.net
- DNS ASK el####icborrow.net
- DNS ASK re#####lectricity.net
- DNS ASK el####ictrain.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
