Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Tablet Power BitLocker ActiveX Information' = 'C:\pdudsuhzdy\rbrwlmua.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Defender Studio Access Acquisition Foundation] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\pdudsuhzdy\ufjjojygowem.exe' "c:\pdudsuhzdy\rbrwlmua.exe"
- 'C:\pdudsuhzdy\rbrwlmua.exe'
- 'C:\pdudsuhzdy\pg3bgskuronu7cyttc.exe'
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Modifies file system :
Creates the following files:
- C:\pdudsuhzdy\rbrwlmua.exe
- C:\pdudsuhzdy\ufjjojygowem.exe
- C:\pdudsuhzdy\jbxtfsm
- %WINDIR%\pdudsuhzdy\ykneofufuo
- C:\pdudsuhzdy\ykneofufuo
- C:\pdudsuhzdy\pg3bgskuronu7cyttc.exe
Sets the 'hidden' attribute to the following files:
- C:\pdudsuhzdy\ufjjojygowem.exe
- C:\pdudsuhzdy\rbrwlmua.exe
Deletes the following files:
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- <SYSTEM32>\PerfStringBackup.TMP
- %WINDIR%\pdudsuhzdy\ykneofufuo
- C:\pdudsuhzdy\pg3bgskuronu7cyttc.exe
Network activity:
Connects to:
- 'jo####ybetween.net':80
- 'hu####dbetween.net':80
- 'jo####ysucceed.net':80
- 'hu####dsucceed.net':80
- 'jo####yproduce.net':80
- 'hu####dstudent.net':80
- 'de####ysucceed.net':80
- 'hu####dproduce.net':80
- 'jo####ystudent.net':80
- 're####ernearly.net':80
- 'wo###happen.net':80
- 'in####seshare.net':80
- 'wo###nearly.net':80
- 're####erhappen.net':80
- 'wo###share.net':80
- 're####ershare.net':80
- 'wo###shake.net':80
- 're####ershake.net':80
- 'ri####produce.net':80
- 'be####produce.net':80
- 'ri####between.net':80
- 'be####between.net':80
- 'ri####student.net':80
- 'th####ucceed.net':80
- 'ch####etween.net':80
- 'be####student.net':80
- 'ch####ucceed.net':80
- 'li####between.net':80
- 'de####yproduce.net':80
- 'li####succeed.net':80
- 'de####ybetween.net':80
- 'li####produce.net':80
- 'ri####succeed.net':80
- 'be####succeed.net':80
- 'de####ystudent.net':80
- 'li####student.net':80
- 'fo###tshare.net':80
- 'th###shake.net':80
- 'ch###share.net':80
- 'th###happen.net':80
- 'ch###shake.net':80
- 'th###share.net':80
- 'wi####happen.net':80
- 'su####happen.net':80
- 'wi####nearly.net':80
- 'su####nearly.net':80
- 'ri###nshake.net':80
- 'be###gshake.net':80
- 'ri####happen.net':80
- 'be####happen.net':80
- 'ri###nshare.net':80
- 'th###nearly.net':80
- 'ch###happen.net':80
- 'be###gshare.net':80
- 'ch###nearly.net':80
- 'th####hshare.net':80
- 'fo####nearly.net':80
- 'th####hshake.net':80
- 'ef###tshare.net':80
- 'in####senearly.net':80
- 'fo###tshake.net':80
- 'in####seshake.net':80
- 'fo####happen.net':80
- 'in####sehappen.net':80
- 'wi###nshare.net':80
- 'su###rshare.net':80
- 'wi###nshake.net':80
- 'su###rshake.net':80
- 'ef####nearly.net':80
- 'th####hhappen.net':80
- 'ef###tshake.net':80
- 'th####hnearly.net':80
- 'ef####happen.net':80
TCP:
HTTP GET requests:
- http://jo####ybetween.net/index.php?me########
- http://hu####dbetween.net/index.php?me########
- http://jo####ysucceed.net/index.php?me########
- http://hu####dsucceed.net/index.php?me########
- http://jo####yproduce.net/index.php?me########
- http://hu####dstudent.net/index.php?me########
- http://de####ysucceed.net/index.php?me########
- http://hu####dproduce.net/index.php?me########
- http://jo####ystudent.net/index.php?me########
- http://re####ernearly.net/index.php?me########
- http://wo###happen.net/index.php?me########
- http://in####seshare.net/index.php?me########
- http://wo###nearly.net/index.php?me########
- http://re####erhappen.net/index.php?me########
- http://wo###share.net/index.php?me########
- http://re####ershare.net/index.php?me########
- http://wo###shake.net/index.php?me########
- http://re####ershake.net/index.php?me########
- http://ri####produce.net/index.php?me########
- http://be####produce.net/index.php?me########
- http://ri####between.net/index.php?me########
- http://be####between.net/index.php?me########
- http://ri####student.net/index.php?me########
- http://th####ucceed.net/index.php?me########
- http://ch####etween.net/index.php?me########
- http://be####student.net/index.php?me########
- http://ch####ucceed.net/index.php?me########
- http://li####between.net/index.php?me########
- http://de####yproduce.net/index.php?me########
- http://li####succeed.net/index.php?me########
- http://de####ybetween.net/index.php?me########
- http://li####produce.net/index.php?me########
- http://ri####succeed.net/index.php?me########
- http://be####succeed.net/index.php?me########
- http://de####ystudent.net/index.php?me########
- http://li####student.net/index.php?me########
- http://fo###tshare.net/index.php?me########
- http://th###shake.net/index.php?me########
- http://ch###share.net/index.php?me########
- http://th###happen.net/index.php?me########
- http://ch###shake.net/index.php?me########
- http://th###share.net/index.php?me########
- http://wi####happen.net/index.php?me########
- http://su####happen.net/index.php?me########
- http://wi####nearly.net/index.php?me########
- http://su####nearly.net/index.php?me########
- http://ri###nshake.net/index.php?me########
- http://be###gshake.net/index.php?me########
- http://ri####happen.net/index.php?me########
- http://be####happen.net/index.php?me########
- http://ri###nshare.net/index.php?me########
- http://th###nearly.net/index.php?me########
- http://ch###happen.net/index.php?me########
- http://be###gshare.net/index.php?me########
- http://ch###nearly.net/index.php?me########
- http://th####hshare.net/index.php?me########
- http://fo####nearly.net/index.php?me########
- http://th####hshake.net/index.php?me########
- http://ef###tshare.net/index.php?me########
- http://in####senearly.net/index.php?me########
- http://fo###tshake.net/index.php?me########
- http://in####seshake.net/index.php?me########
- http://fo####happen.net/index.php?me########
- http://in####sehappen.net/index.php?me########
- http://wi###nshare.net/index.php?me########
- http://su###rshare.net/index.php?me########
- http://wi###nshake.net/index.php?me########
- http://su###rshake.net/index.php?me########
- http://ef####nearly.net/index.php?me########
- http://th####hhappen.net/index.php?me########
- http://ef###tshake.net/index.php?me########
- http://th####hnearly.net/index.php?me########
- http://ef####happen.net/index.php?me########
UDP:
- DNS ASK jo####ybetween.net
- DNS ASK hu####dbetween.net
- DNS ASK jo####ysucceed.net
- DNS ASK hu####dsucceed.net
- DNS ASK jo####yproduce.net
- DNS ASK hu####dstudent.net
- DNS ASK de####ysucceed.net
- DNS ASK hu####dproduce.net
- DNS ASK jo####ystudent.net
- DNS ASK re####ernearly.net
- DNS ASK wo###happen.net
- DNS ASK in####seshare.net
- DNS ASK wo###nearly.net
- DNS ASK re####erhappen.net
- DNS ASK wo###share.net
- DNS ASK re####ershare.net
- DNS ASK wo###shake.net
- DNS ASK re####ershake.net
- DNS ASK li####succeed.net
- DNS ASK be####produce.net
- DNS ASK ri####student.net
- DNS ASK be####between.net
- DNS ASK ri####produce.net
- DNS ASK be####student.net
- DNS ASK ch####etween.net
- DNS ASK th####etween.net
- DNS ASK ch####ucceed.net
- DNS ASK th####ucceed.net
- DNS ASK de####yproduce.net
- DNS ASK li####produce.net
- DNS ASK de####ybetween.net
- DNS ASK li####between.net
- DNS ASK de####ystudent.net
- DNS ASK be####succeed.net
- DNS ASK ri####between.net
- DNS ASK li####student.net
- DNS ASK ri####succeed.net
- DNS ASK th###shake.net
- DNS ASK ch###share.net
- DNS ASK th###happen.net
- DNS ASK ch###shake.net
- DNS ASK th###share.net
- DNS ASK wi####happen.net
- DNS ASK su####happen.net
- DNS ASK wi####nearly.net
- DNS ASK su####nearly.net
- DNS ASK ri###nshake.net
- DNS ASK be###gshake.net
- DNS ASK ri####happen.net
- DNS ASK be####happen.net
- DNS ASK ri###nshare.net
- DNS ASK th###nearly.net
- DNS ASK ch###happen.net
- DNS ASK be###gshare.net
- DNS ASK ch###nearly.net
- DNS ASK wi###nshake.net
- DNS ASK fo####nearly.net
- DNS ASK in####senearly.net
- DNS ASK ef###tshare.net
- DNS ASK th####hshare.net
- DNS ASK fo####happen.net
- DNS ASK in####seshake.net
- DNS ASK fo###tshare.net
- DNS ASK in####sehappen.net
- DNS ASK fo###tshake.net
- DNS ASK su###rshare.net
- DNS ASK ef####nearly.net
- DNS ASK su###rshake.net
- DNS ASK wi###nshare.net
- DNS ASK th####hnearly.net
- DNS ASK ef###tshake.net
- DNS ASK th####hshake.net
- DNS ASK ef####happen.net
- DNS ASK th####hhappen.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
