Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,<LS_APPDATA>\jwaroevi\rarexsdb.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'RarExsdb' = '<LS_APPDATA>\jwaroevi\rarexsdb.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\rarexsdb.exe
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Creates and executes the following:
- '%TEMP%\byjjjqlf.exe'
Executes the following:
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\ybfcuwpc.log
- <LS_APPDATA>\lawhwilb.log
- <LS_APPDATA>\jwaroevi\rarexsdb.exe
- %TEMP%\byjjjqlf.exe
- %TEMP%\ifqydaby.exe
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\rarexsdb.exe
Network activity:
Connects to:
- 'it####xjghvvxa.com':443
- 'kn#####cwtlvgrdyhd.com':443
- 'jh###lufoh.com':443
- 'hu###fjq.com':443
- 'tq###ylf.com':443
- 'vr####rdrjoff.com':443
- 'an#####wcbnjopdd.com':443
- '74.##5.232.51':80
UDP:
- DNS ASK xr#####awtlmulghjj.com
- DNS ASK yc####vxdnlsa.com
- DNS ASK jm####wtcjev.com
- DNS ASK rr####fucjjylju.com
- DNS ASK fg####gcdomle.com
- DNS ASK re####njqssbrnf.com
- DNS ASK ea####aobohxb.com
- DNS ASK xb###sli.com
- DNS ASK jy####gwfhyns.com
- DNS ASK ib#####ochoyjidm.com
- DNS ASK vw####josuovul.com
- DNS ASK lv####bdtfapwev.com
- DNS ASK ri####otkuysyfh.com
- DNS ASK af###gddfi.com
- DNS ASK wn#####nwiugtvwyo.com
- DNS ASK im###kaudq.com
- DNS ASK tb#####iecloxihf.com
- DNS ASK xo###bqb.com
- DNS ASK dh###whoj.com
- DNS ASK ov#####jcnvwwooiamj.com
- DNS ASK uc#####ryboqwbmlxke.com
- DNS ASK qp###bstn.com
- DNS ASK ha#####qjkkaejwi.com
- DNS ASK nw#####auuwsyuppii.com
- DNS ASK if###anec.com
- DNS ASK gw###jueqme.com
- DNS ASK bing.com
- DNS ASK ok###clblpl.com
- DNS ASK to###nnhm.com
- DNS ASK nf####vxyssyda.com
- DNS ASK ll###gbqhv.com
- DNS ASK sc####lmfbgf.com
- DNS ASK em###yirx.com
- DNS ASK yo###axsana.com
- DNS ASK ex###gyv.com
- DNS ASK sh#####teeocltymxe.com
- DNS ASK qd#####uhwabhwik.com
- DNS ASK fs#####ychumrgrmhwo.com
- DNS ASK ec#####vvoydawmfni.com
- DNS ASK vb####wyurqem.com
- DNS ASK hg####eedieibxy.com
- DNS ASK pp###aohb.com
- DNS ASK je###rgatod.com
- DNS ASK kh###mpmare.com
- DNS ASK ri###ysk.com
- DNS ASK an###qyfy.com
- DNS ASK ck####lutybvcxv.com
- DNS ASK google.com
- DNS ASK an#####wcbnjopdd.com
- DNS ASK vr####rdrjoff.com
- DNS ASK tq###ylf.com
- DNS ASK kn#####cwtlvgrdyhd.com
- DNS ASK jh###lufoh.com
- DNS ASK nv###fua.com
- DNS ASK it####xjghvvxa.com
- DNS ASK hu###fjq.com
- DNS ASK vf####ablskkqrx.com
- DNS ASK uv#####fbeyvebqeb.com
- DNS ASK jm#####ktxvegsxid.com
- DNS ASK hj###duyebf.com
- DNS ASK eb###yrs.com
- DNS ASK my###puoh.com
- DNS ASK qt#####tfgmkxqjrik.com
- DNS ASK wx#####eacmrtdam.com
- DNS ASK vf####sgsfsodw.com
- DNS ASK sb#####tiavvtrkrn.com
- DNS ASK qy###vjwh.com
- DNS ASK wl###wlygck.com
- DNS ASK eg####frdsefc.com
- DNS ASK fy####uksgjfxy.com
- DNS ASK lc###ndroo.com
- DNS ASK eu####bkwahxxjn.com
- DNS ASK ty#####ijdcxtdxd.com
- DNS ASK ac#####dvnmhthwnlxv.com
- DNS ASK qv#####pofqsxdnr.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
