Boaxxe Trojan

First observed in 2011, Boaxxe (also known as Miuref) is an information stealing trojan and backdoor. First seen in 2011, it continues to be used by threat actors, as seen from its involvement in the 3ve large-scale advertisement fraud campaign.

Boaxxe is distributed via large spam emails or drive-by downloads.

Once installed, Boaxxe will scan compromised machines for system information, before transmitting it to a command and control server as encrypted registry strings. Boaxxe is also capable of acting as a proxy server and botnet.

Indicators of Compromise

Filepaths

• %UserProfile%\AppData\Local\VirtualStore\lsass.aaa
• %UserProfile%\AppData\Local\Temp\<RANDOM>.exe
• %UserProfile%\AppData\Local\<Random eight-character folder name>\<original file name>.exe

This trojan may also download and execute files from the following remote locations:

• a1info.net
• aabody.com
• aaqo.net
• abashknight.com
• abbhang.com
• abbybruce.com
• abcim.com
• abcmed.biz
• abqo.com
• accorres.net
• aceinsulators.com
• acmeporn.biz
• acorsunteses.com
• actualdeals.com
• adason.com
• adcomunsub.com
• adolphdplate.com
• adultmoviemax.com
• advertiseit.net
• afjvoj.com
• afraidrooster.com
• aglobalcasino.com
• ahq.biz
• aia-inc.net
• airelephant.com
• airpixle.com
• airplaneband.com
• akinwale.net
• allaforesta.com
• allanalmovies.com
• allbankturtle.com
• allcialis.com
• allcustomnews.com
• alldayloans.com
• allgirlsclub.com
• allocvita.com
• allotvisit.com
• allrapid.com
• allwebplus.info
• altitudefever.com
• alvarezbalbas.com
• amberblazes.com
• anokoto.com
• anoreennf.com
• answersubway.com
• antismsicte.com
• a-pills.net
• apodus.com
• appanagist.com
• appleincsnack.com
• apqo.net
• aprilbud.com
• aquadextrous.com
• archlook.com
• arevends.net
• arihrz.com
• arthover.com
• artls.com
• asfc.biz
• asiaporno.com
• asmort.net
• atimesla.com
• atroulette.com
• audioapex.com
• audiosenate.net
• auroraday.com
• auto-bt.net
• autumnshore.com
• avamailcheck.com
• babe-planet.com
• backedhorse.com
• ballpin.net
• ballsstar.com
• baltidish.net
• banishtreason.com
• banktransfer.com
• barbbituwitz.com
• bargaindepot.net
• barnstaples.com
• batberryfrost.com
• bcmfc.com
• bdcscredit.com
• beaamann.com
• beachdoor.com
• beauti-full.com
• bedonerun.com
• behalfmediate.com
• berryblossom.com
• berryoak.com
• bestbelieveit.com
• bestit2u.com
• betterreplica.com
• bfearless.net
• bhampoker.com
• bighitbuys.com
• biginitiative.com
• bigmikesa.com
• bigstarchfire.com
• bigstockx.com
• big-success.com
• bintincap.com
• blablaonline.com
• blacknac.com
• blackword.net
• blondburg.com
• bloodineye.com
• bluebeltway.com
• bmtezine.com
• boelondon.net
• boiab.com
• bons.biz
• boothstable.com
• borderlime.com
• borntosoar.com
• bossyourcut.com
• boundafish.net
• bowiefamily.net
• brassviolins.com
• breaksworks.com
• breezedays.com
• brightgame.com
• browndye.com
• brownnac.com
• brownwaveline.com
• bruisergunman.com
• bubblemoon.net
• bubbleurdream.com
• bullrewards.net
• buyeuro-gsm.com
• cactuspring.com
• caipirinia.com
• campworm.com
• candyocean.com
• capemoss.com
• cariussus.com
• carlbreakdown.com
• carpum.com
• carrythebaby.com
• cash4sure.com
• castawayused.com
• ceilingair.com
• ceilingcarpet.com
• cf-mail.com
• cgi-vc.com
• checkermill.com
• chengsan.com
• chilledge.com
• chinabodi.com
• china-lutong.net
• ciaoletter.com
• civildynamic.com
• classworm.com
• claydogpool.com
• clayelephant.com
• claymixmedia.com
• click-4-gifts.com
• clickformoney.biz
• closeoutup.info
• clubdave.com
• cluberpencil.com
• clubsuncradle.com
• cmlversatel.com
• cn-name.net
• coffeeandwine.com
• coldsmoothie.com
• coletarapida.com
• collarzone.com
• columnsteak.com
• commandoes.net
• compsfind.com
• compuzz.com
• coolblueshoes.com
• coolcatcash.com
• coolpicks.net
• copperblaze.com
• corksoda.com
• cornsandwitch.com
• cornseagull.com
• cornsoupspoon.com
• cornswordfish.com
• corntoes.com
• costumegather.com
• countermaker.info
• cowboyshoot.com
• createsure.com
• crowntobacco.com
• crystalplain.com
• cum-paradise.net
• curlyforce.com
• curlykittens.com
• customguru.com
• d2info.biz
• damageberry.net
• damphippos.com
• dandlyons.com
• datjobs.com
• dealzboom.com
• deepseatosky.com
• deliblanket.com
• deliveryin.com
• delta-space.info
• denephew.com
• designmap.info
• desirehernow.com
• destroyersred.com
• dewopal.com
• dicog.com
• diefork.com
• digiknowhow.net
• dillhampton.com
• dirare.com
• divebarballet.com
• divisionbyzer.com
• dliver.com
• dodma.com
• dogate.net
• domit.biz
• domojp.net
• doorplaned.com
• dorisschutt.net
• dreamslick.com
• drivemind.com
• drylakesoaked.com
• dtransfers.biz
• dubiouscowboy.com
• easternhands.com
• ebookidea.com
• ecobanknig.net
• egerbil.com
• e-gold-invest.com
• ejack-pots.net
• ekiyaink.com
• elenophorus.com
• eleveniskey.com
• elinkz.biz
• embrates.com
• endosimta.com
• eniceview.com
• enticelining.com
• eprizenetwork.com
• epsonlab.com
• esitos.com
• eu-casino.biz
• eveningmist.com
• excuria.net
• execmoms.biz
• exopicnite.com
• expfsn.com
• ezdland.info
• ezuproject.info
• fabrichina.net
• fastflicker.com
• fastmailfleet.net
• fastsize.com
• fast-valux.com
• fathergeneral.com
• fauxhauk.com
• featherblue.com
• ferndale-corp.com
• fieldlight.com
• fiercelynx.com
• financeinvest.net
• findselect.com
• fine-poker.com
• firelime.net
• firerear.net
• fishrover.com
• fkkdatenbank.com
• flashfort.com
• flessepost.net
• fogdirect.com
• fortcharlie.com
• fortherest.info
• foundsurvey.net
• fpfig.com
• fpnp.net
• free1up.com
• freshnfreek.com
• freshtextiles.com
• frigsystems.com
• frostharvest.com
• fullfunda.com
• funshoponline.net
• fustilugs.com
• fuzzywhirl.com
• fvamedia.com
• fzzo.com
• gaingoodstuff.com
• gamblemania.com
• gatomt.com
• gentlenet.com
• geomobiles.net
• gergv.info
• getitforcall.info
• getsomesite.com
• gety.info
• geuros.com
• gifts-expo.com
• gikkios.com
• giksiks.com
• globaliixxxx.net
• globm.com
• godipack.com
• gogetcash.com
• goldchalice.com
• goodednessed.com
• good-response.net
• goodwatches.net
• gootigloo.com
• gorgehoof.com
• gotechink.com
• govgrantnews.com
• grabnget.net
• grabthebags.com
• gratis-x.com
• greatchoose.com
• greatnetvalue.net
• greatnewcars.com
• greenripple.com
• gregandtrisha.com
• grimzsa.biz
• grownews.com
• gruj.com
• gudadeal.com
• guideofjungle.com
• gulfcoasthap.com
• gutrun.info
• gvozd-a.net
• gymsilo.net
• h2hfinches.com
• hairyonly.com
• halzamora.info
• harborbeaches.com
• harethronng.com
• hatsbutter.com
• havesexs.com
• healup.info
• henim.com
• higherrewards.net
• highwaydiner.net
• hihealthy.com
• hitecy.net
• holidayhot.info
• homeagainpets.com
• homett.com
• hooksup.net
• horizontune.com
• hotelbull.net
• hub4textiles.com
• humorousname.com
• hyperoutlet.com
• ibigvalue.net
• icedflower.com
• icetip.com
• icywinds.com
• idealightsite.com
• idolbright.com
• ikute.com
• iloveblackcum.com
• indianacast.com
• indomilis.com
• innovativeon.com
• insuranceqa.com
• interbiz.4t.com
• inter-euro.net
• inulation.com
• investaggie.com
• investorabcs.com
• investorspick.com
• ip01-hosting.net
• isgreatdirect.com
• i-tcare.com
• janroadclass.com
• jellomold.net
• jfqu.com
• jintonglecn.com
• jlctopu.com
• jnaviss.com
• jockysocks.com
• journalfaden.com
• jsvcd.com
• juicybimbos.com
• juratio.com
• justwes.net
• juzn.com
• karmiccash.biz
• kastaweys.com
• keyfell.com
• kingbuyer.net
• kitall.com
• kitho.info
• kolimbo.com
• koppswat.com
• l3arn.com
• lafaqueous.com
• lambada.biz
• largekingdom.com
• laughtotears.com
• legalmusic.info
• lemonicity.com
• lightsilk.com
• lilachush.com
• linedriveedge.com
• liondew.com
• lipfrown.com
• liulei.net
• liveinforum.com
• localcover.net
• lockunique.com
• lo-gall.com
• lojotiango.com
• lovelymails.com
• lulupen.com
• madcitymeds.com
• maikoiken.com
• mailzen.com
• makeupcreamie.com
• malwarewipe.com
• manylist.com
• maplesour.com
• maqla.com
• martivillas.com
• mawkys.com
• mediaperceive.com
• medivisor.com
• meds-reorder.com
• megabankforav.com
• megatex.info
• mentionup.com
• metoosoftware.com
• metrojumbo.com
• mikkai.com
• mimiyori.biz
• mindn.net
• minetaloro.com
• minjen.com
• miretan.info
• mistyjade.com
• mistyteaties.com
• mixlinks.info
• mixola.com
• mohamednabil.net
• molotok-b.net
• mommsen.info
• mongeri.com
• monlin.com
• morefunforyou.net
• morninglilly.com
• mortgage-live.net
• movetroop.net
• mucketymuck.net
• mundoliran.com
• music-on-cd.com
• mybigsuccess.com
• mycouponworld.com
• myfunnyfamily.com
• myredfactor.com
• naughtynews.info
• nbads.com
• neglecta.com
• neglusser.com
• nelokaweb.com
• neoncameleon.com
• netbuzz4you.com
• netlineuk.com
• net-whitelist.com
• netyi.net
• neverridge.com
• new-fields.com
• newgreatlife.info
• newlifefund.com
• newlooktoday.com
• newmommovie.com
• newsidewalks.com
• newsnewnet.com
• newstarting.com
• news-uplink.com
• nhsh9sist.com
• nickleflavors.com
• nimbleslipper.com
• ningbozhida.com
• nopretty.com
• noreel.com
• nourvect.com
• nukzeozh.info
• nyedju.com
• oakevens.com
• obprocess.com
• ocexclusives.com
• offers4golf.com
• offikinted.com
• oktw.net
• ominousbraid.com
• ontheskids.net
• orangenac.com
• orenaf.com
• ourdrugshop.com
• outic.com
• overtka-b.net
• overtka-d.net
• owindow.com
• oxeteegue.com
• oymap.com
• p1ck-this.com
• pagoduc.info
• palepear.com
• pamktlabs.net
• pantree.net
• paperhill.net
• passilistint.com
• passvipclub.com
• pastnowerty.com
• pctoptan.com
• pdserv.com
• pedadv.com
• perfromisst.com
• petalssky.com
• phonefog.com
• phydwood.com
• pinecurly.com
• pirtybird.com
• plexclub.com
• plosfor.info
• pnc-bankk.info
• pointerweb.com
• polygifts.com
• ponochka.com
• ponpare.net
• popularvalue.net
• poqiwj.info
• portpalm.com
• postblogs.net
• postplum.com
• ppkkwuwiw.com
• praznik-c.net
• prlr8vrhy.com
• promomex.com
• prorowlike.com
• prostarchfire.com
• protectedway.com
• p-software.info
• ptwdnewline.com
• pumpkingold.com
• pvvf.com
• qckjmp.com
• qncg.net
• qsyk.com
• qualitytrue.com
• quicksender.net
• rabbitemblem.com
• rabland.net
• raceuntill.com
• rareasian.net
• readsilly.com
• reasonflashy.com
• redtagsoffers.com
• reelslife.com
• resptr.com
• returnto.info
• riches4l.com
• rideangie.com
• ringtonesdb.com
• rmalibusc.com
• roadstork.com
• rockrend.com
• rockysands.com
• rodanta.com
• roidealsdaily.com
• rskillers.info
• rushmonkey.com
• rxdrugdeals.com
• safeandhonest.com
• sale-ps.com
• saucybasket.com
• savagefinding.com
• scourgehammer.com
• securenetsafe.com
• seeallnews.net
• seekfree.com
• seinur.info
• sertune.com
• setmethods.com
• seuiro.com
• sevinslevin.com
• sexy-chu.com
• showtopics.net
• shutalldoors.com
• silverclaymix.com
• simplemaker.com
• simpletoget.com
• simulacrumet.com
• sitesilly.com
• skypz.com
• slamminvegies.com
• sliceannetta.com
• slugbum.com
• smartsolution.biz
• smdnow.com
• smoothieday.com
• snowlilac.com
• sockdupe.com
• solely4u.net
• solidrockstar.com
• spbting.com
• spicebolt.com
• spilldbeans.com
• squirtlovers.net
• stageanny.com
• stampolives.com
• standfuture.com
• stefsdomain.com
• stendevasi.com
• stetsonpoker.com
• stonedoorstop.com
• stopovercall.com
• strangefrosen.com
• styleresource.net
• sunremon.com
• supermaonline.com
• supliziolaw.biz
• sweetmoney.com
• switch4ever.com
• syncmyworld.com
• tallclaims.com
• tatzyz.info
• tealclove.com
• teetimeisnoon.com
• tenderhaze.com
• terminalmice.com
• thatchhouse.com
• thehhn.com
• theloftygoat.com
• thepeakstate.com
• theshinebox.com
• thesomemore.com
• thewiredtimes.com
• thewoolrug.com
• thornfreeze.com
• thunderpitch.net
• todosbatio.com
• togogaga.com
• tokeys.com
• tonunderpin.com
• topevids.com
• tpznews.com
• tracksecurity.com
• treeboo.net
• treeflats.com
• triangleget.com
• tripplealdo.com
• tvbooth.net
• txcsupport.com
• ultraelegant.net
• ultraezines.com
• unitto.com
• usmedsatcost.com
• usteenvote.com
• uvtrail.com
• vanhfc.com
• v-boom.com
• vectolib.com
• velimotor.com
• vinenrose.com
• violettrace.com
• visionmedic.com
• vvblast.net
• waldostuff.com
• wantsteamfor.com
• watchwellow.com
• waterjupiter.com
• wayuse.com
• webkt.com
• weblj.com
• webspace4free.biz
• webspec.net
• westernquests.com
• whisperhappy.com
• whitepickets.com
• wholetime.net
• wintersetting.com
• wiredfrogtell.com
• wisesoft.info
• wnpdesign.com
• wonderthought.com
• woodwalking.com
• world4uall.com
• worldrewards.net
• worryfreezone.com
• xbbshop.com
• x-bola.com
• xmailingslist.com
• xxxproposal.com
• xzfsdr.com
• yaotouyy.com
• yiland.net
• yourconsider.com
• yoursomemore.com
• yourstormdoor.com
• yourwhole.com