Boaxxe Trojan

First observed in 2011, Boaxxe (also known as Miuref) is an information stealing trojan and backdoor. First seen in 2011, it continues to be used by threat actors, as seen from its involvement in the 3ve large-scale advertisement fraud campaign.

Boaxxe is distributed via large spam emails or drive-by downloads.

Once installed, Boaxxe will scan compromised machines for system information, before transmitting it to a command and control server as encrypted registry strings. Boaxxe is also capable of acting as a proxy server and botnet.

Indicators of Compromise

Filepaths

  • %UserProfile%\AppData\Local\VirtualStore\lsass.aaa
  • %UserProfile%\AppData\Local\Temp\<RANDOM>.exe
  • %UserProfile%\AppData\Local\<Random eight-character folder name>\<original file name>.exe

This trojan may also download and execute files from the following remote locations:

  • a1info.net
  • aabody.com
  • aaqo.net
  • abashknight.com
  • abbhang.com
  • abbybruce.com
  • abcim.com
  • abcmed.biz
  • abqo.com
  • accorres.net
  • aceinsulators.com
  • acmeporn.biz
  • acorsunteses.com
  • actualdeals.com
  • adason.com
  • adcomunsub.com
  • adolphdplate.com
  • adultmoviemax.com
  • advertiseit.net
  • afjvoj.com
  • afraidrooster.com
  • aglobalcasino.com
  • ahq.biz
  • aia-inc.net
  • airelephant.com
  • airpixle.com
  • airplaneband.com
  • akinwale.net
  • allaforesta.com
  • allanalmovies.com
  • allbankturtle.com
  • allcialis.com
  • allcustomnews.com
  • alldayloans.com
  • allgirlsclub.com
  • allocvita.com
  • allotvisit.com
  • allrapid.com
  • allwebplus.info
  • altitudefever.com
  • alvarezbalbas.com
  • amberblazes.com
  • anokoto.com
  • anoreennf.com
  • answersubway.com
  • antismsicte.com
  • a-pills.net
  • apodus.com
  • appanagist.com
  • appleincsnack.com
  • apqo.net
  • aprilbud.com
  • aquadextrous.com
  • archlook.com
  • arevends.net
  • arihrz.com
  • arthover.com
  • artls.com
  • asfc.biz
  • asiaporno.com
  • asmort.net
  • atimesla.com
  • atroulette.com
  • audioapex.com
  • audiosenate.net
  • auroraday.com
  • auto-bt.net
  • autumnshore.com
  • avamailcheck.com
  • babe-planet.com
  • backedhorse.com
  • ballpin.net
  • ballsstar.com
  • baltidish.net
  • banishtreason.com
  • banktransfer.com
  • barbbituwitz.com
  • bargaindepot.net
  • barnstaples.com
  • batberryfrost.com
  • bcmfc.com
  • bdcscredit.com
  • beaamann.com
  • beachdoor.com
  • beauti-full.com
  • bedonerun.com
  • behalfmediate.com
  • berryblossom.com
  • berryoak.com
  • bestbelieveit.com
  • bestit2u.com
  • betterreplica.com
  • bfearless.net
  • bhampoker.com
  • bighitbuys.com
  • biginitiative.com
  • bigmikesa.com
  • bigstarchfire.com
  • bigstockx.com
  • big-success.com
  • bintincap.com
  • blablaonline.com
  • blacknac.com
  • blackword.net
  • blondburg.com
  • bloodineye.com
  • bluebeltway.com
  • bmtezine.com
  • boelondon.net
  • boiab.com
  • bons.biz
  • boothstable.com
  • borderlime.com
  • borntosoar.com
  • bossyourcut.com
  • boundafish.net
  • bowiefamily.net
  • brassviolins.com
  • breaksworks.com
  • breezedays.com
  • brightgame.com
  • browndye.com
  • brownnac.com
  • brownwaveline.com
  • bruisergunman.com
  • bubblemoon.net
  • bubbleurdream.com
  • bullrewards.net
  • buyeuro-gsm.com
  • cactuspring.com
  • caipirinia.com
  • campworm.com
  • candyocean.com
  • capemoss.com
  • cariussus.com
  • carlbreakdown.com
  • carpum.com
  • carrythebaby.com
  • cash4sure.com
  • castawayused.com
  • ceilingair.com
  • ceilingcarpet.com
  • cf-mail.com
  • cgi-vc.com
  • checkermill.com
  • chengsan.com
  • chilledge.com
  • chinabodi.com
  • china-lutong.net
  • ciaoletter.com
  • civildynamic.com
  • classworm.com
  • claydogpool.com
  • clayelephant.com
  • claymixmedia.com
  • click-4-gifts.com
  • clickformoney.biz
  • closeoutup.info
  • clubdave.com
  • cluberpencil.com
  • clubsuncradle.com
  • cmlversatel.com
  • cn-name.net
  • coffeeandwine.com
  • coldsmoothie.com
  • coletarapida.com
  • collarzone.com
  • columnsteak.com
  • commandoes.net
  • compsfind.com
  • compuzz.com
  • coolblueshoes.com
  • coolcatcash.com
  • coolpicks.net
  • copperblaze.com
  • corksoda.com
  • cornsandwitch.com
  • cornseagull.com
  • cornsoupspoon.com
  • cornswordfish.com
  • corntoes.com
  • costumegather.com
  • countermaker.info
  • cowboyshoot.com
  • createsure.com
  • crowntobacco.com
  • crystalplain.com
  • cum-paradise.net
  • curlyforce.com
  • curlykittens.com
  • customguru.com
  • d2info.biz
  • damageberry.net
  • damphippos.com
  • dandlyons.com
  • datjobs.com
  • dealzboom.com
  • deepseatosky.com
  • deliblanket.com
  • deliveryin.com
  • delta-space.info
  • denephew.com
  • designmap.info
  • desirehernow.com
  • destroyersred.com
  • dewopal.com
  • dicog.com
  • diefork.com
  • digiknowhow.net
  • dillhampton.com
  • dirare.com
  • divebarballet.com
  • divisionbyzer.com
  • dliver.com
  • dodma.com
  • dogate.net
  • domit.biz
  • domojp.net
  • doorplaned.com
  • dorisschutt.net
  • dreamslick.com
  • drivemind.com
  • drylakesoaked.com
  • dtransfers.biz
  • dubiouscowboy.com
  • easternhands.com
  • ebookidea.com
  • ecobanknig.net
  • egerbil.com
  • e-gold-invest.com
  • ejack-pots.net
  • ekiyaink.com
  • elenophorus.com
  • eleveniskey.com
  • elinkz.biz
  • embrates.com
  • endosimta.com
  • eniceview.com
  • enticelining.com
  • eprizenetwork.com
  • epsonlab.com
  • esitos.com
  • eu-casino.biz
  • eveningmist.com
  • excuria.net
  • execmoms.biz
  • exopicnite.com
  • expfsn.com
  • ezdland.info
  • ezuproject.info
  • fabrichina.net
  • fastflicker.com
  • fastmailfleet.net
  • fastsize.com
  • fast-valux.com
  • fathergeneral.com
  • fauxhauk.com
  • featherblue.com
  • ferndale-corp.com
  • fieldlight.com
  • fiercelynx.com
  • financeinvest.net
  • findselect.com
  • fine-poker.com
  • firelime.net
  • firerear.net
  • fishrover.com
  • fkkdatenbank.com
  • flashfort.com
  • flessepost.net
  • fogdirect.com
  • fortcharlie.com
  • fortherest.info
  • foundsurvey.net
  • fpfig.com
  • fpnp.net
  • free1up.com
  • freshnfreek.com
  • freshtextiles.com
  • frigsystems.com
  • frostharvest.com
  • fullfunda.com
  • funshoponline.net
  • fustilugs.com
  • fuzzywhirl.com
  • fvamedia.com
  • fzzo.com
  • gaingoodstuff.com
  • gamblemania.com
  • gatomt.com
  • gentlenet.com
  • geomobiles.net
  • gergv.info
  • getitforcall.info
  • getsomesite.com
  • gety.info
  • geuros.com
  • gifts-expo.com
  • gikkios.com
  • giksiks.com
  • globaliixxxx.net
  • globm.com
  • godipack.com
  • gogetcash.com
  • goldchalice.com
  • goodednessed.com
  • good-response.net
  • goodwatches.net
  • gootigloo.com
  • gorgehoof.com
  • gotechink.com
  • govgrantnews.com
  • grabnget.net
  • grabthebags.com
  • gratis-x.com
  • greatchoose.com
  • greatnetvalue.net
  • greatnewcars.com
  • greenripple.com
  • gregandtrisha.com
  • grimzsa.biz
  • grownews.com
  • gruj.com
  • gudadeal.com
  • guideofjungle.com
  • gulfcoasthap.com
  • gutrun.info
  • gvozd-a.net
  • gymsilo.net
  • h2hfinches.com
  • hairyonly.com
  • halzamora.info
  • harborbeaches.com
  • harethronng.com
  • hatsbutter.com
  • havesexs.com
  • healup.info
  • henim.com
  • higherrewards.net
  • highwaydiner.net
  • hihealthy.com
  • hitecy.net
  • holidayhot.info
  • homeagainpets.com
  • homett.com
  • hooksup.net
  • horizontune.com
  • hotelbull.net
  • hub4textiles.com
  • humorousname.com
  • hyperoutlet.com
  • ibigvalue.net
  • icedflower.com
  • icetip.com
  • icywinds.com
  • idealightsite.com
  • idolbright.com
  • ikute.com
  • iloveblackcum.com
  • indianacast.com
  • indomilis.com
  • innovativeon.com
  • insuranceqa.com
  • interbiz.4t.com
  • inter-euro.net
  • inulation.com
  • investaggie.com
  • investorabcs.com
  • investorspick.com
  • ip01-hosting.net
  • isgreatdirect.com
  • i-tcare.com
  • janroadclass.com
  • jellomold.net
  • jfqu.com
  • jintonglecn.com
  • jlctopu.com
  • jnaviss.com
  • jockysocks.com
  • journalfaden.com
  • jsvcd.com
  • juicybimbos.com
  • juratio.com
  • justwes.net
  • juzn.com
  • karmiccash.biz
  • kastaweys.com
  • keyfell.com
  • kingbuyer.net
  • kitall.com
  • kitho.info
  • kolimbo.com
  • koppswat.com
  • l3arn.com
  • lafaqueous.com
  • lambada.biz
  • largekingdom.com
  • laughtotears.com
  • legalmusic.info
  • lemonicity.com
  • lightsilk.com
  • lilachush.com
  • linedriveedge.com
  • liondew.com
  • lipfrown.com
  • liulei.net
  • liveinforum.com
  • localcover.net
  • lockunique.com
  • lo-gall.com
  • lojotiango.com
  • lovelymails.com
  • lulupen.com
  • madcitymeds.com
  • maikoiken.com
  • mailzen.com
  • makeupcreamie.com
  • malwarewipe.com
  • manylist.com
  • maplesour.com
  • maqla.com
  • martivillas.com
  • mawkys.com
  • mediaperceive.com
  • medivisor.com
  • meds-reorder.com
  • megabankforav.com
  • megatex.info
  • mentionup.com
  • metoosoftware.com
  • metrojumbo.com
  • mikkai.com
  • mimiyori.biz
  • mindn.net
  • minetaloro.com
  • minjen.com
  • miretan.info
  • mistyjade.com
  • mistyteaties.com
  • mixlinks.info
  • mixola.com
  • mohamednabil.net
  • molotok-b.net
  • mommsen.info
  • mongeri.com
  • monlin.com
  • morefunforyou.net
  • morninglilly.com
  • mortgage-live.net
  • movetroop.net
  • mucketymuck.net
  • mundoliran.com
  • music-on-cd.com
  • mybigsuccess.com
  • mycouponworld.com
  • myfunnyfamily.com
  • myredfactor.com
  • naughtynews.info
  • nbads.com
  • neglecta.com
  • neglusser.com
  • nelokaweb.com
  • neoncameleon.com
  • netbuzz4you.com
  • netlineuk.com
  • net-whitelist.com
  • netyi.net
  • neverridge.com
  • new-fields.com
  • newgreatlife.info
  • newlifefund.com
  • newlooktoday.com
  • newmommovie.com
  • newsidewalks.com
  • newsnewnet.com
  • newstarting.com
  • news-uplink.com
  • nhsh9sist.com
  • nickleflavors.com
  • nimbleslipper.com
  • ningbozhida.com
  • nopretty.com
  • noreel.com
  • nourvect.com
  • nukzeozh.info
  • nyedju.com
  • oakevens.com
  • obprocess.com
  • ocexclusives.com
  • offers4golf.com
  • offikinted.com
  • oktw.net
  • ominousbraid.com
  • ontheskids.net
  • orangenac.com
  • orenaf.com
  • ourdrugshop.com
  • outic.com
  • overtka-b.net
  • overtka-d.net
  • owindow.com
  • oxeteegue.com
  • oymap.com
  • p1ck-this.com
  • pagoduc.info
  • palepear.com
  • pamktlabs.net
  • pantree.net
  • paperhill.net
  • passilistint.com
  • passvipclub.com
  • pastnowerty.com
  • pctoptan.com
  • pdserv.com
  • pedadv.com
  • perfromisst.com
  • petalssky.com
  • phonefog.com
  • phydwood.com
  • pinecurly.com
  • pirtybird.com
  • plexclub.com
  • plosfor.info
  • pnc-bankk.info
  • pointerweb.com
  • polygifts.com
  • ponochka.com
  • ponpare.net
  • popularvalue.net
  • poqiwj.info
  • portpalm.com
  • postblogs.net
  • postplum.com
  • ppkkwuwiw.com
  • praznik-c.net
  • prlr8vrhy.com
  • promomex.com
  • prorowlike.com
  • prostarchfire.com
  • protectedway.com
  • p-software.info
  • ptwdnewline.com
  • pumpkingold.com
  • pvvf.com
  • qckjmp.com
  • qncg.net
  • qsyk.com
  • qualitytrue.com
  • quicksender.net
  • rabbitemblem.com
  • rabland.net
  • raceuntill.com
  • rareasian.net
  • readsilly.com
  • reasonflashy.com
  • redtagsoffers.com
  • reelslife.com
  • resptr.com
  • returnto.info
  • riches4l.com
  • rideangie.com
  • ringtonesdb.com
  • rmalibusc.com
  • roadstork.com
  • rockrend.com
  • rockysands.com
  • rodanta.com
  • roidealsdaily.com
  • rskillers.info
  • rushmonkey.com
  • rxdrugdeals.com
  • safeandhonest.com
  • sale-ps.com
  • saucybasket.com
  • savagefinding.com
  • scourgehammer.com
  • securenetsafe.com
  • seeallnews.net
  • seekfree.com
  • seinur.info
  • sertune.com
  • setmethods.com
  • seuiro.com
  • sevinslevin.com
  • sexy-chu.com
  • showtopics.net
  • shutalldoors.com
  • silverclaymix.com
  • simplemaker.com
  • simpletoget.com
  • simulacrumet.com
  • sitesilly.com
  • skypz.com
  • slamminvegies.com
  • sliceannetta.com
  • slugbum.com
  • smartsolution.biz
  • smdnow.com
  • smoothieday.com
  • snowlilac.com
  • sockdupe.com
  • solely4u.net
  • solidrockstar.com
  • spbting.com
  • spicebolt.com
  • spilldbeans.com
  • squirtlovers.net
  • stageanny.com
  • stampolives.com
  • standfuture.com
  • stefsdomain.com
  • stendevasi.com
  • stetsonpoker.com
  • stonedoorstop.com
  • stopovercall.com
  • strangefrosen.com
  • styleresource.net
  • sunremon.com
  • supermaonline.com
  • supliziolaw.biz
  • sweetmoney.com
  • switch4ever.com
  • syncmyworld.com
  • tallclaims.com
  • tatzyz.info
  • tealclove.com
  • teetimeisnoon.com
  • tenderhaze.com
  • terminalmice.com
  • thatchhouse.com
  • thehhn.com
  • theloftygoat.com
  • thepeakstate.com
  • theshinebox.com
  • thesomemore.com
  • thewiredtimes.com
  • thewoolrug.com
  • thornfreeze.com
  • thunderpitch.net
  • todosbatio.com
  • togogaga.com
  • tokeys.com
  • tonunderpin.com
  • topevids.com
  • tpznews.com
  • tracksecurity.com
  • treeboo.net
  • treeflats.com
  • triangleget.com
  • tripplealdo.com
  • tvbooth.net
  • txcsupport.com
  • ultraelegant.net
  • ultraezines.com
  • unitto.com
  • usmedsatcost.com
  • usteenvote.com
  • uvtrail.com
  • vanhfc.com
  • v-boom.com
  • vectolib.com
  • velimotor.com
  • vinenrose.com
  • violettrace.com
  • visionmedic.com
  • vvblast.net
  • waldostuff.com
  • wantsteamfor.com
  • watchwellow.com
  • waterjupiter.com
  • wayuse.com
  • webkt.com
  • weblj.com
  • webspace4free.biz
  • webspec.net
  • westernquests.com
  • whisperhappy.com
  • whitepickets.com
  • wholetime.net
  • wintersetting.com
  • wiredfrogtell.com
  • wisesoft.info
  • wnpdesign.com
  • wonderthought.com
  • woodwalking.com
  • world4uall.com
  • worldrewards.net
  • worryfreezone.com
  • xbbshop.com
  • x-bola.com
  • xmailingslist.com
  • xxxproposal.com
  • xzfsdr.com
  • yaotouyy.com
  • yiland.net
  • yourconsider.com
  • yoursomemore.com
  • yourstormdoor.com
  • yourwhole.com

Duncan is a technology professional with over 20 years experience of working in various IT roles. He also has a wide range of other skills in radio, electronics and telecommunications.

Duncan Newell

Duncan is a technology professional with over 20 years experience of working in various IT roles. He also has a wide range of other skills in radio, electronics and telecommunications.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: