PE_BOBAX.AK

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This file infector adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
INTV = "%System%\qltiuealbhe.exe"

Other System Modifications

This file infector adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run\
4FD682E9

Other Details

This file infector connects to the following possibly malicious URL:

• http://yutunrz.{BLOCKED}b.com/reg?{random characters}
• http://mcduii.{BLOCKED}a.net/reg?{random characters}
• http://jdjsloy.{BLOCKED}v.com/reg?{random characters}
• http://wyqggvow.{BLOCKED}d.org/reg?{random characters}
• http://nttstziinpa.{BLOCKED}n.org/reg?{random characters}
• http://fcnhysydw.{BLOCKED}i.org/reg?{random characters}
• http://dlivmg.{BLOCKED}b.com/reg?{random characters}
• http://neytteybbo.{BLOCKED}a.net/reg?{random characters}
• http://fzzdik.{BLOCKED}v.com/reg?{random characters}
• http://pkvgzaecagx.{BLOCKED}d.org/reg?{random characters}
• http://yraqztt.{BLOCKED}n.org/reg?{random characters}
• http://kpxvrvdefs.{BLOCKED}i.org/reg?{random characters}
• http://qeqfsvxousx.{BLOCKED}b.com/reg?{random characters}
• http://imtoey.{BLOCKED}a.net/reg?{random characters}
• http://jrscqsshxs.{BLOCKED}v.com/reg?{random characters}
• http://yjjtuvsro.{BLOCKED}d.org/reg?{random characters}
• http://firradbqzku.{BLOCKED}n.org/reg?{random characters}
• http://dgwigom.{BLOCKED}i.org/reg?{random characters}
• http://mfltoqgqt.{BLOCKED}b.com/reg?{random characters}
• http://ksfvgfrf.{BLOCKED}a.net/reg?{random characters}
• http://uhqoyjlu.{BLOCKED}v.com/reg?{random characters}
• http://bdtjkffl.{BLOCKED}d.org/reg?{random characters}
• http://ipurfbqpsdj.{BLOCKED}n.org/reg?{random characters}
• http://orugtuapnzu.{BLOCKED}i.org/reg?{random characters}
• http://gyssafafiq.{BLOCKED}b.com/reg?{random characters}
• http://ihhyzby.{BLOCKED}a.net/reg?{random characters}
• http://pvxkideqlen.{BLOCKED}v.com/reg?{random characters}
• http://bhlnklify.{BLOCKED}d.org/reg?{random characters}
• http://tsyunetwmi.{BLOCKED}n.org/reg?{random characters}
• http://exrjbk.{BLOCKED}i.org/reg?{random characters}
• http://fndvrix.{BLOCKED}b.com/reg?{random characters}
• http://ryhszzinxss.{BLOCKED}a.net/reg?{random characters}
• http://ooyvsk.{BLOCKED}v.com/reg?{random characters}
• http://qujuvukbvbq.{BLOCKED}d.org/reg?{random characters}
• http://ichyig.{BLOCKED}n.org/reg?{random characters}
• http://gtyeywobh.{BLOCKED}i.org/reg?{random characters}
• http://vfpqyv.{BLOCKED}b.com/reg?{random characters}
• http://cnntzas.{BLOCKED}a.net/reg?{random characters}
• http://lslpcl.{BLOCKED}v.com/reg?{random characters}
• http://qqycilcd.{BLOCKED}d.org/reg?{random characters}
• http://aflnxlpko.{BLOCKED}n.org/reg?{random characters}
• http://yeaigapqs.{BLOCKED}i.org/reg?{random characters}
• http://eivysjix.{BLOCKED}b.com/reg?{random characters}
• http://aazuxmmqqkq.{BLOCKED}a.net/reg?{random characters}
• http://rzstdrbnzs.{BLOCKED}v.com/reg?{random characters}
• http://jqevnl.{BLOCKED}d.org/reg?{random characters}
• http://yrztpzjou.{BLOCKED}n.org/reg?{random characters}
• http://rdjqleu.{BLOCKED}i.org/reg?{random characters}
• http://yldgjpojof.{BLOCKED}b.com/reg?{random characters}
• http://qjdvlkr.{BLOCKED}a.net/reg?{random characters}
• http://yxnhwhmrckk.{BLOCKED}v.com/reg?{random characters}
• http://idgucupep.{BLOCKED}d.org/reg?{random characters}
• http://dkpkkvkvdzm.{BLOCKED}n.org/reg?{random characters}
• http://lvzxlhmjfje.{BLOCKED}i.org/reg?{random characters}
• http://sfowpix.{BLOCKED}b.com/reg?{random characters}
• http://fuyofzgrbdj.{BLOCKED}a.net/reg?{random characters}
• http://rjzjxmnvxcu.{BLOCKED}v.com/reg?{random characters}
• http://njpwrj.{BLOCKED}d.org/reg?{random characters}
• http://kkqsox.{BLOCKED}n.org/reg?{random characters}
• http://wrompw.{BLOCKED}i.org/reg?{random characters}
• http://tnwuaqh.{BLOCKED}b.com/reg?{random characters}
• http://xypvxdnurje.{BLOCKED}a.net/reg?{random characters}
• http://ajfgffpjh.{BLOCKED}v.com/reg?{random characters}
• http://bxffhm.{BLOCKED}d.org/reg?{random characters}
• http://opdyes.{BLOCKED}n.org/reg?{random characters}
• http://ddujmhzyhlg.{BLOCKED}i.org/reg?{random characters}
• http://wovygce.{BLOCKED}b.com/reg?{random characters}
• http://druuvb.{BLOCKED}a.net/reg?{random characters}
• http://yleamly.{BLOCKED}v.com/reg?{random characters}
• http://cludphxadw.{BLOCKED}d.org/reg?{random characters}
• http://xeulvjqoyup.{BLOCKED}n.org/reg?{random characters}

This report is generated via an automated analysis system.