Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Extender Collector Authentication] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Extender Collector Authentication] 'ImagePath' = 'C:\fximvdrb\rtkxaovf.exe'
Creates the following services
- 'Extender Collector Authentication' C:\fximvdrb\rtkxaovf.exe
Modifies file system
Creates the following files
- %WINDIR%\fximvdrb\mu0mon
- C:\fximvdrb\mu0mon
- C:\fximvdrb\bjrjxxrdywgar3gdkz.exe
- C:\fximvdrb\rtkxaovf.exe
- C:\fximvdrb\vcckzocup.exe
Sets the 'hidden' attribute to the following files
- C:\fximvdrb\rtkxaovf.exe
- C:\fximvdrb\vcckzocup.exe
Deletes the following files
- %WINDIR%\fximvdrb\mu0mon
- C:\fximvdrb\bjrjxxrdywgar3gdkz.exe
Substitutes the following files
- %WINDIR%\fximvdrb\mu0mon
Network activity
Connects to
- 'ou####eescape.net':80
- 'bu####ngmodern.net':80
- 'st###modern.net':80
- 'pr####problem.net':80
- 'pr####modern.net':80
- 'st####roblem.net':80
- 'ev####gsister.net':80
- 'bu####nglabor.net':80
- 'st###valley.net':80
- 'pr####silver.net':80
- 'pr####valley.net':80
TCP
HTTP GET requests
- http://ou####eescape.net/index.php
- http://bu####ngmodern.net/index.php
- http://pr####problem.net/index.php
- http://pr####modern.net/index.php
- http://st####roblem.net/index.php
- http://st###modern.net/index.php
- http://ev####gsister.net/index.php
- http://bu####nglabor.net/index.php
- http://pr####silver.net/index.php
- http://pr####valley.net/index.php
UDP
- DNS ASK st####tranger.net
- DNS ASK bu####ngsilver.net
- DNS ASK ou####elabor.net
- DNS ASK mo####ntlabor.net
- DNS ASK ou####evalley.net
- DNS ASK mo####ntvalley.net
- DNS ASK ou####esister.net
- DNS ASK mo####ntsister.net
- DNS ASK ou####esilver.net
- DNS ASK mo####ntsilver.net
- DNS ASK ev####gsilver.net
- DNS ASK st####thmodern.net
- DNS ASK st####thanimal.net
- DNS ASK st####thescape.net
- DNS ASK de####modern.net
- DNS ASK pr####emodern.net
- DNS ASK de####problem.net
- DNS ASK pr####eproblem.net
- DNS ASK de####animal.net
- DNS ASK pr####eanimal.net
- DNS ASK de####escape.net
- DNS ASK st####thproblem.net
- DNS ASK bu####ngsister.net
- DNS ASK ev####gsister.net
- DNS ASK bu####ngvalley.net
- DNS ASK fe####sister.net
- DNS ASK fe####silver.net
- DNS ASK pr###ylabor.net
- DNS ASK do###rlabor.net
- DNS ASK pr####valley.net
- DNS ASK do####valley.net
- DNS ASK pr####sister.net
- DNS ASK do####sister.net
- DNS ASK pr####silver.net
- DNS ASK do####silver.net
- DNS ASK mi###labor.net
- DNS ASK st###labor.net
- DNS ASK mi###valley.net
- DNS ASK st###valley.net
- DNS ASK mi###sister.net
- DNS ASK st###sister.net
- DNS ASK mi###silver.net
- DNS ASK st###silver.net
- DNS ASK ev####glabor.net
- DNS ASK bu####nglabor.net
- DNS ASK ev####gvalley.net
- DNS ASK pr####eescape.net
- DNS ASK fe####valley.net
- DNS ASK re####modern.net
- DNS ASK re####problem.net
- DNS ASK ev####gmodern.net
- DNS ASK bu####ngmodern.net
- DNS ASK ev####gproblem.net
- DNS ASK bu####ngproblem.net
- DNS ASK ev####ganimal.net
- DNS ASK bu####nganimal.net
- DNS ASK ev####gescape.net
- DNS ASK bu####ngescape.net
- DNS ASK ou####emodern.net
- DNS ASK st###escape.net
- DNS ASK mo####ntmodern.net
- DNS ASK mo####ntproblem.net
- DNS ASK ou####eanimal.net
- DNS ASK mo####ntanimal.net
- DNS ASK ou####eescape.net
- DNS ASK mo####ntescape.net
- DNS ASK st####ortieth.net
- DNS ASK st#####hfortieth.net
- DNS ASK st####oodbye.net
- DNS ASK st####thgoodbye.net
- DNS ASK ou####eproblem.net
- DNS ASK mi###escape.net
- DNS ASK st###animal.net
- DNS ASK mi###animal.net
- DNS ASK br####problem.net
- DNS ASK re####animal.net
- DNS ASK br####animal.net
- DNS ASK re####escape.net
- DNS ASK br####escape.net
- DNS ASK fe####modern.net
- DNS ASK fe####problem.net
- DNS ASK fe####animal.net
- DNS ASK fe####escape.net
- DNS ASK pr####modern.net
- DNS ASK do####modern.net
- DNS ASK pr####problem.net
- DNS ASK do####problem.net
- DNS ASK pr####animal.net
- DNS ASK do####animal.net
- DNS ASK pr####escape.net
- DNS ASK do####escape.net
- DNS ASK mi###modern.net
- DNS ASK st###modern.net
- DNS ASK mi####roblem.net
- DNS ASK st####roblem.net
- DNS ASK br####modern.net
- DNS ASK fe###wlabor.net
Miscellaneous
Creates and executes the following
- 'C:\fximvdrb\bjrjxxrdywgar3gdkz.exe'
- 'C:\fximvdrb\rtkxaovf.exe'
- 'C:\fximvdrb\vcckzocup.exe' "c:\fximvdrb\rtkxaovf.exe"
