Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'List Health BitLocker Card Web' = 'C:\cpirassuu\dprrlcsb.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Wired Diagnostic Problem Internet Distributed] 'ImagePath' = 'C:\cpirassuu\dprrlcsb.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Wired Diagnostic Problem Internet Distributed] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\cpirassuu\lpqlbhge.exe' "c:\cpirassuu\dprrlcsb.exe"
- 'C:\cpirassuu\dprrlcsb.exe'
- 'C:\cpirassuu\a034oumdomzi72dn.exe'
Modifies file system:
Creates the following files:
- C:\cpirassuu\dprrlcsb.exe
- C:\cpirassuu\lpqlbhge.exe
- C:\cpirassuu\a034oumdomzi72dn.exe
- %WINDIR%\cpirassuu\aelvmc
- C:\cpirassuu\aelvmc
Sets the 'hidden' attribute to the following files:
- C:\cpirassuu\lpqlbhge.exe
- C:\cpirassuu\dprrlcsb.exe
Deletes the following files:
- C:\cpirassuu\a034oumdomzi72dn.exe
- %WINDIR%\cpirassuu\aelvmc
Network activity:
Connects to:
- 'ri####easure.net':80
- 'wh####rmeasure.net':80
- 'wh####rdinner.net':80
- 'wh####rafraid.net':80
- 'ri###dinner.net':80
- 'fo####ncircle.net':80
- 'fo####ndinner.net':80
- 'su####dinner.net':80
- 'su####afraid.net':80
- 'su####circle.net':80
- 'fo####nafraid.net':80
- 'ri###afraid.net':80
- 'th####afraid.net':80
- 'fi####afraid.net':80
- 'fi####circle.net':80
- 'pi####emeasure.net':80
- 'th####circle.net':80
- 'th####dinner.net':80
- 'ri###circle.net':80
- 'wh####rcircle.net':80
- 'fi####measure.net':80
- 'fi####dinner.net':80
- 'th####measure.net':80
- 'ex####dinner.net':80
- 'be####emeasure.net':80
- 'be####edinner.net':80
- 'be####eafraid.net':80
- 'ex####afraid.net':80
- 'ex####measure.net':80
- 'ei###rbuilt.net':80
- 'en####happle.net':80
- 'en####hbuilt.net':80
- 'en####hcarry.net':80
- 'ei###rcarry.net':80
- 'ex####circle.net':80
- 'pe####circle.net':80
- 'ma####eafraid.net':80
- 'ma####ecircle.net':80
- 'fo####nmeasure.net':80
- 'su####measure.net':80
- 'pe####afraid.net':80
- 'pe####measure.net':80
- 'be####ecircle.net':80
- 'ma####emeasure.net':80
- 'ma####edinner.net':80
- 'pe####dinner.net':80
TCP:
HTTP GET requests:
- http://ri####easure.net/index.php
- http://wh####rmeasure.net/index.php
- http://wh####rdinner.net/index.php
- http://wh####rafraid.net/index.php
- http://ri###dinner.net/index.php
- http://fo####ncircle.net/index.php
- http://fo####ndinner.net/index.php
- http://su####dinner.net/index.php
- http://su####afraid.net/index.php
- http://su####circle.net/index.php
- http://fo####nafraid.net/index.php
- http://ri###afraid.net/index.php
- http://th####afraid.net/index.php
- http://fi####afraid.net/index.php
- http://fi####circle.net/index.php
- http://pi####emeasure.net/index.php
- http://th####circle.net/index.php
- http://th####dinner.net/index.php
- http://ri###circle.net/index.php
- http://wh####rcircle.net/index.php
- http://fi####measure.net/index.php
- http://fi####dinner.net/index.php
- http://th####measure.net/index.php
- http://ex####dinner.net/index.php
- http://be####emeasure.net/index.php
- http://be####edinner.net/index.php
- http://be####eafraid.net/index.php
- http://ex####afraid.net/index.php
- http://ex####measure.net/index.php
- http://ei###rbuilt.net/index.php
- http://en####happle.net/index.php
- http://en####hbuilt.net/index.php
- http://en####hcarry.net/index.php
- http://ei###rcarry.net/index.php
- http://ex####circle.net/index.php
- http://pe####circle.net/index.php
- http://ma####eafraid.net/index.php
- http://ma####ecircle.net/index.php
- http://fo####nmeasure.net/index.php
- http://su####measure.net/index.php
- http://pe####afraid.net/index.php
- http://pe####measure.net/index.php
- http://be####ecircle.net/index.php
- http://ma####emeasure.net/index.php
- http://ma####edinner.net/index.php
- http://pe####dinner.net/index.php
UDP:
- DNS ASK ri####easure.net
- DNS ASK wh####rmeasure.net
- DNS ASK wh####rdinner.net
- DNS ASK wh####rafraid.net
- DNS ASK ri###dinner.net
- DNS ASK fo####ncircle.net
- DNS ASK fo####ndinner.net
- DNS ASK su####dinner.net
- DNS ASK su####afraid.net
- DNS ASK su####circle.net
- DNS ASK fo####nafraid.net
- DNS ASK ri###afraid.net
- DNS ASK th####afraid.net
- DNS ASK fi####afraid.net
- DNS ASK fi####circle.net
- DNS ASK pi####emeasure.net
- DNS ASK th####circle.net
- DNS ASK th####dinner.net
- DNS ASK ri###circle.net
- DNS ASK wh####rcircle.net
- DNS ASK fi####measure.net
- DNS ASK fi####dinner.net
- DNS ASK th####measure.net
- DNS ASK ex####dinner.net
- DNS ASK be####emeasure.net
- DNS ASK be####edinner.net
- DNS ASK be####eafraid.net
- DNS ASK ex####afraid.net
- DNS ASK ex####measure.net
- DNS ASK ei###rbuilt.net
- DNS ASK en####happle.net
- DNS ASK en####hbuilt.net
- DNS ASK en####hcarry.net
- DNS ASK ei###rcarry.net
- DNS ASK ex####circle.net
- DNS ASK pe####circle.net
- DNS ASK ma####eafraid.net
- DNS ASK ma####ecircle.net
- DNS ASK fo####nmeasure.net
- DNS ASK su####measure.net
- DNS ASK pe####afraid.net
- DNS ASK pe####measure.net
- DNS ASK be####ecircle.net
- DNS ASK ma####emeasure.net
- DNS ASK ma####edinner.net
- DNS ASK pe####dinner.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
