Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Human Net.Tcp System Connect Secure Virtual Block' = '<SYSTEM32>\vcbxtxcwwl.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Thread Services Name Security Shell] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\aunirwhpdrmf.exe' "<SYSTEM32>\vcbxtxcwwl.exe"
- '%WINDIR%\Temp\elramd2ro3tu.exe' -r 25573 tcp
- '%TEMP%\elramd2kahtuq15tyc.exe'
- '<SYSTEM32>\vcbxtxcwwl.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\pkbnsloyt\run
- <SYSTEM32>\pkbnsloyt\rng
- %WINDIR%\Temp\elramd2ro3tu.exe
- <SYSTEM32>\pkbnsloyt\cfg
- <SYSTEM32>\aunirwhpdrmf.exe
- %TEMP%\elramd2kahtuq15tyc.exe
- <SYSTEM32>\pkbnsloyt\tst
- <SYSTEM32>\vcbxtxcwwl.exe
- <SYSTEM32>\pkbnsloyt\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\aunirwhpdrmf.exe
- <SYSTEM32>\vcbxtxcwwl.exe
Deletes the following files:
- %WINDIR%\Temp\elramd2ro3tu.exe
- %TEMP%\elramd2kahtuq15tyc.exe
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'mo###ish.net':80
- 'su###yfish.net':80
- 'me###ing.net':80
- 'me###ast.net':80
- 'si###ing.net':80
- 'mo###ady.net':80
- 'mo###ing.net':80
- 'su###ywing.net':80
- 'su###ypast.net':80
- 'su###ylady.net':80
- 'mo###ast.net':80
- 'si###ast.net':80
- 'da###ast.net':80
- 'cl###past.net':80
- 'cl###lady.net':80
- 'cl###fish.net':80
- 'da###ady.net':80
- 'da###ing.net':80
- 'si###ady.net':80
- 'me###ady.net':80
- 'me###ish.net':80
- 'cl###wing.net':80
- 'si###ish.net':80
- 'li####appear.net':80
- 're####erpaint.net':80
- 'th####hcountry.net':80
- 'he###ast.net':80
- 'ca###ast.net':80
- 'ne####arydress.net':80
- 'mi####lossary.net':80
- 'st###march.net':80
- 're####eneither.net':80
- 'gl###health.net':80
- 'ge####friend.net':80
- 'ca###ady.net':80
- 'qu###lady.net':80
- 'th###ast.net':80
- 'th###ady.net':80
- 'th###ish.net':80
- 'qu###fish.net':80
- 'qu###past.net':80
- 'ca###ish.net':80
- 'he###ady.net':80
- 'he###ish.net':80
- 'th###ing.net':80
- 'qu###wing.net':80
TCP:
HTTP GET requests:
- http://mo###ish.net/forum/search.php?me#########################################
- http://su###yfish.net/forum/search.php?me#########################################
- http://me###ing.net/forum/search.php?me#########################################
- http://me###ast.net/forum/search.php?me#########################################
- http://si###ing.net/forum/search.php?me#########################################
- http://mo###ady.net/forum/search.php?me#########################################
- http://mo###ing.net/forum/search.php?me#########################################
- http://su###ywing.net/forum/search.php?me#########################################
- http://su###ypast.net/forum/search.php?me#########################################
- http://su###ylady.net/forum/search.php?me#########################################
- http://mo###ast.net/forum/search.php?me#########################################
- http://si###ast.net/forum/search.php?me#########################################
- http://da###ast.net/forum/search.php?me#########################################
- http://cl###past.net/forum/search.php?me#########################################
- http://cl###lady.net/forum/search.php?me#########################################
- http://cl###fish.net/forum/search.php?me#########################################
- http://da###ady.net/forum/search.php?me#########################################
- http://da###ing.net/forum/search.php?me#########################################
- http://si###ady.net/forum/search.php?me#########################################
- http://me###ady.net/forum/search.php?me#########################################
- http://me###ish.net/forum/search.php?me#########################################
- http://cl###wing.net/forum/search.php?me#########################################
- http://si###ish.net/forum/search.php?me#########################################
- http://li####appear.net/forum/search.php?me#########################################
- http://re####erpaint.net/forum/search.php?me#########################################
- http://th####hcountry.net/forum/search.php?me#########################################
- http://he###ast.net/forum/search.php?me#########################################
- http://ca###ast.net/forum/search.php?me#########################################
- http://ne####arydress.net/forum/search.php?me#########################################
- http://mi####lossary.net/forum/search.php?me#########################################
- http://st###march.net/forum/search.php?me#########################################
- http://re####eneither.net/forum/search.php?me#########################################
- http://gl###health.net/forum/search.php?me#########################################
- http://ge####friend.net/forum/search.php?me#########################################
- http://ca###ady.net/forum/search.php?me#########################################
- http://qu###lady.net/forum/search.php?me#########################################
- http://th###ast.net/forum/search.php?me#########################################
- http://th###ady.net/forum/search.php?me#########################################
- http://th###ish.net/forum/search.php?me#########################################
- http://qu###fish.net/forum/search.php?me#########################################
- http://qu###past.net/forum/search.php?me#########################################
- http://ca###ish.net/forum/search.php?me#########################################
- http://he###ady.net/forum/search.php?me#########################################
- http://he###ish.net/forum/search.php?me#########################################
- http://th###ing.net/forum/search.php?me#########################################
- http://qu###wing.net/forum/search.php?me#########################################
UDP:
- DNS ASK me###ing.net
- DNS ASK mo###ish.net
- DNS ASK su###yfish.net
- DNS ASK si###ast.net
- DNS ASK me###ast.net
- DNS ASK si###ing.net
- DNS ASK su###ypast.net
- DNS ASK mo###ing.net
- DNS ASK su###ywing.net
- DNS ASK mo###ady.net
- DNS ASK su###ylady.net
- DNS ASK mo###ast.net
- DNS ASK cl###lady.net
- DNS ASK da###ast.net
- DNS ASK cl###past.net
- DNS ASK da###ish.net
- DNS ASK cl###fish.net
- DNS ASK da###ady.net
- DNS ASK me###ish.net
- DNS ASK si###ady.net
- DNS ASK me###ady.net
- DNS ASK da###ing.net
- DNS ASK cl###wing.net
- DNS ASK si###ish.net
- DNS ASK th###ish.net
- DNS ASK re####erpaint.net
- DNS ASK ne####arydress.net
- DNS ASK li####appear.net
- DNS ASK ca###ast.net
- DNS ASK th####hcountry.net
- DNS ASK gl###health.net
- DNS ASK ta###fruit.net
- DNS ASK st###march.net
- DNS ASK mi####lossary.net
- DNS ASK ge####friend.net
- DNS ASK re####eneither.net
- DNS ASK he###ast.net
- DNS ASK th###ast.net
- DNS ASK qu###past.net
- DNS ASK qu###lady.net
- DNS ASK qu###fish.net
- DNS ASK th###ady.net
- DNS ASK th###ing.net
- DNS ASK he###ady.net
- DNS ASK ca###ady.net
- DNS ASK ca###ish.net
- DNS ASK qu###wing.net
- DNS ASK he###ish.net
- '23#.#55.255.250':1900
