Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Application WLAN Session Removal Bus Volume' = '<SYSTEM32>\nbxrbrz.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Debugger Files Cache Video Diagnostic] 'ImagePath' = '<SYSTEM32>\nbxrbrz.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Debugger Files Cache Video Diagnostic] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Executes the following:
- '<SYSTEM32>\ismarfls.exe' "<SYSTEM32>\nbxrbrz.exe"
- '%WINDIR%\Temp\vnegussv056uuxso.exe' -r 48697 tcp
- '%TEMP%\vnegussl5bdw2xsojixcsr.exe'
- '<SYSTEM32>\nbxrbrz.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\gyklkqauyrr\run
- <SYSTEM32>\gyklkqauyrr\rng
- %WINDIR%\Temp\vnegussv056uuxso.exe
- <SYSTEM32>\gyklkqauyrr\cfg
- %TEMP%\vnegussl5bdw2xsojixcsr.exe
- <SYSTEM32>\gyklkqauyrr\tst
- <SYSTEM32>\ismarfls.exe
- <SYSTEM32>\nbxrbrz.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\ismarfls.exe
- <SYSTEM32>\nbxrbrz.exe
Deletes the following files:
- %WINDIR%\Temp\vnegussv056uuxso.exe
- %TEMP%\vnegussl5bdw2xsojixcsr.exe
Network activity:
Connects to:
- 'gr###enjoy.net':80
- 'gr###world.net':80
- 'gl###orse.ru':80
- 'gr###enjoy.ru':80
- 'eq####ctover.net':80
- 'sp###enjoy.net':80
- 'vi###enjoy.net':80
- 'gr####ctover.net':80
- 'gr###horse.net':80
- 'ch###boris.ru':80
- 'ko###rpig.xyz':80
- 'lo####thepings.ru':80
- 'po###lols.ru':80
- 'la###aha.xyz':80
- 'bi###rfans.top':80
- 'ru##nds.top':80
- 'po###alal.site':80
- 'ri###nafap.site':80
TCP:
HTTP GET requests:
- http://gr###enjoy.net/index.php
- http://gr###world.net/index.php
- http://gl###orse.ru/index.php
- http://gr###enjoy.ru/index.php
- http://eq####ctover.net/index.php
- http://sp###enjoy.net/index.php
- http://vi###enjoy.net/index.php
- http://gr####ctover.net/index.php
- http://gr###horse.net/index.php
- http://ch###boris.ru/index.php
- http://ko###rpig.xyz/index.php
- http://lo####thepings.ru/index.php
- http://po###lols.ru/index.php
- http://la###aha.xyz/index.php
- http://bi###rfans.top/index.php
- http://ru##nds.top/index.php
- http://po###alal.site/index.php
- http://ri###nafap.site/index.php
UDP:
- DNS ASK wi###irst.net
- DNS ASK jo###irst.net
- DNS ASK jo###uess.net
- DNS ASK jo###uess.ru
- DNS ASK wi###ill.net
- DNS ASK wi###tood.ru
- DNS ASK jo###tood.net
- DNS ASK jo###ill.net
- DNS ASK wi###tood.net
- DNS ASK wi###uess.net
- DNS ASK ro###irst.net
- DNS ASK de###irst.net
- DNS ASK ro###uess.net
- DNS ASK de###uess.net
- DNS ASK ro###ill.net
- DNS ASK ro###tood.net
- DNS ASK de###tood.net
- DNS ASK ro##kill.ru
- DNS ASK de###ill.net
- DNS ASK se####berguess.net
- DNS ASK of###stood.net
- DNS ASK fr###stood.net
- DNS ASK fr###kill.net
- DNS ASK fr###kill.ru
- DNS ASK sp###guess.net
- DNS ASK sp###first.ru
- DNS ASK we###irst.net
- DNS ASK we###uess.net
- DNS ASK sp###first.net
- DNS ASK of###kill.net
- DNS ASK se####berkill.net
- DNS ASK se####berstood.net
- DNS ASK se####berfirst.net
- DNS ASK ha###irst.ru
- DNS ASK of###guess.net
- DNS ASK of###first.net
- DNS ASK fr###first.net
- DNS ASK of###guess.ru
- DNS ASK fr###guess.net
- DNS ASK mu###allow.net
- DNS ASK ya###llow.net
- DNS ASK mu###gives.net
- DNS ASK ya###ives.net
- DNS ASK ya###llow.ru
- DNS ASK mu###taste.net
- DNS ASK ya###aste.net
- DNS ASK mu###earth.net
- DNS ASK ya###arth.net
- DNS ASK we###aste.net
- DNS ASK we###ives.ru
- DNS ASK sp###allow.net
- DNS ASK sp###gives.net
- DNS ASK we###ives.net
- DNS ASK we###llow.net
- DNS ASK sp###taste.net
- DNS ASK sp###taste.ru
- DNS ASK we###arth.net
- DNS ASK sp###earth.net
- DNS ASK ha###ives.net
- DNS ASK ma###irst.ru
- DNS ASK wr###first.net
- DNS ASK wr###guess.net
- DNS ASK ma###irst.net
- DNS ASK ma###ill.net
- DNS ASK wr###stood.net
- DNS ASK wr###stood.ru
- DNS ASK wr###kill.net
- DNS ASK ma###tood.net
- DNS ASK ma###uess.net
- DNS ASK ha###llow.net
- DNS ASK hu###allow.net
- DNS ASK ha###ives.ru
- DNS ASK hu###gives.net
- DNS ASK ha###arth.net
- DNS ASK ha###aste.net
- DNS ASK hu###taste.net
- DNS ASK hu###earth.net
- DNS ASK hu###earth.ru
- DNS ASK th###orld.net
- DNS ASK ta###horse.net
- DNS ASK wa###enjoy.net
- DNS ASK vi####ctover.net
- DNS ASK wa###world.net
- DNS ASK wa###enjoy.ru
- DNS ASK sp####ctover.net
- DNS ASK vi###horse.net
- DNS ASK ta####ctover.net
- DNS ASK gl###ctover.net
- DNS ASK dr###octover.ru
- DNS ASK eq###horse.net
- DNS ASK sp###world.ru
- DNS ASK wa###horse.net
- DNS ASK fa###orld.net
- DNS ASK vi###octover.ru
- DNS ASK fa###njoy.net
- DNS ASK eq###enjoy.net
- DNS ASK sp###horse.net
- DNS ASK ri###nafap.site
- DNS ASK po###alal.site
- DNS ASK ru##nds.top
- DNS ASK bi###rfans.top
- DNS ASK la###aha.xyz
- DNS ASK po###lols.ru
- DNS ASK lo####thepings.ru
- DNS ASK ko###rpig.xyz
- DNS ASK ch###boris.ru
- DNS ASK gl###orse.ru
- DNS ASK sp###enjoy.net
- DNS ASK gr###horse.net
- DNS ASK vi###world.net
- DNS ASK vi###enjoy.net
- DNS ASK gr####ctover.net
- DNS ASK gr###enjoy.net
- DNS ASK gr###enjoy.ru
- DNS ASK eq####ctover.net
- DNS ASK gr###world.net
- DNS ASK ta###enjoy.net
- DNS ASK ya###ill.net
- DNS ASK ya###tood.net
- DNS ASK mu###kill.ru
- DNS ASK mu###stood.net
- DNS ASK ha###uess.net
- DNS ASK ha###irst.net
- DNS ASK hu###first.net
- DNS ASK hu###guess.net
- DNS ASK hu###guess.ru
- DNS ASK mu###kill.net
- DNS ASK we###ill.net
- DNS ASK we###tood.net
- DNS ASK sp###kill.net
- DNS ASK sp###stood.net
- DNS ASK we###tood.ru
- DNS ASK mu###first.net
- DNS ASK ya###irst.net
- DNS ASK mu###guess.net
- DNS ASK ya###uess.net
- DNS ASK wa####ctover.net
- DNS ASK fa###orse.net
- DNS ASK dr###enjoy.net
- DNS ASK gl###orse.net
- DNS ASK sp###world.net
- DNS ASK dr###world.net
- DNS ASK fa###ctover.net
- DNS ASK eq###world.net
- DNS ASK fa###orse.ru
- DNS ASK th###njoy.net
- DNS ASK ha###tood.net
- DNS ASK ha###tood.ru
- DNS ASK ha###ill.net
- DNS ASK hu###kill.net
- DNS ASK hu###stood.net
- DNS ASK th###ctover.net
- DNS ASK dr####ctover.net
- DNS ASK th###orse.net
- DNS ASK dr###horse.net
- '23#.#55.255.250':1900
