Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Transfer Media Solutions Quality] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Transfer Media Solutions Quality] 'ImagePath' = 'C:\asiqrquwud\pcrzkjpee.exe'
Creates the following services
- 'Transfer Media Solutions Quality' C:\asiqrquwud\pcrzkjpee.exe
Modifies file system
Creates the following files
- %WINDIR%\asiqrquwud\wazyuyg7um
- C:\asiqrquwud\wazyuyg7um
- C:\asiqrquwud\b9mnparcaciqk9ox.exe
- C:\asiqrquwud\pcrzkjpee.exe
- C:\asiqrquwud\ftacxxjkqhk.exe
Sets the 'hidden' attribute to the following files
- C:\asiqrquwud\pcrzkjpee.exe
- C:\asiqrquwud\ftacxxjkqhk.exe
Deletes the following files
- %WINDIR%\asiqrquwud\wazyuyg7um
- C:\asiqrquwud\b9mnparcaciqk9ox.exe
Substitutes the following files
- %WINDIR%\asiqrquwud\wazyuyg7um
Network activity
Connects to
- 'he###charge.net':80
- 'ge####charge.net':80
- 'la###should.net':80
- 'be####opinion.net':80
- 'fl####pinion.net':80
- 'ag####tdistance.net':80
- 'ni###office.net':80
- 'la###office.net':80
- 'el####icsupply.net':80
- 're####office.net':80
- 'el####icoffice.net':80
- 'tr###supply.net':80
TCP
HTTP GET requests
- http://he###charge.net/index.php
- http://ge####charge.net/index.php
- http://la###should.net/index.php
- http://be####opinion.net/index.php
- http://fl####pinion.net/index.php
- http://ag####tdistance.net/index.php
- http://ni###office.net/index.php
- http://la###office.net/index.php
- http://el####icsupply.net/index.php
- http://re####office.net/index.php
- http://el####icoffice.net/index.php
- http://tr###supply.net/index.php
UDP
- DNS ASK pl####ntsingle.net
- DNS ASK fl###short.net
- DNS ASK br###short.net
- DNS ASK fl####pinion.net
- DNS ASK br####pinion.net
- DNS ASK fl####romise.net
- DNS ASK br####romise.net
- DNS ASK se####should.net
- DNS ASK fl###should.net
- DNS ASK qu###short.net
- DNS ASK se###nshort.net
- DNS ASK qu####pinion.net
- DNS ASK se####opinion.net
- DNS ASK qu####romise.net
- DNS ASK se####promise.net
- DNS ASK br###should.net
- DNS ASK ga####promise.net
- DNS ASK do###supply.net
- DNS ASK tr###short.net
- DNS ASK st####opinion.net
- DNS ASK tr####pinion.net
- DNS ASK st####promise.net
- DNS ASK ag####tsupply.net
- DNS ASK tr###should.net
- DNS ASK qu###should.net
- DNS ASK tr####romise.net
- DNS ASK ga###rshort.net
- DNS ASK be####opinion.net
- DNS ASK ga####opinion.net
- DNS ASK be####promise.net
- DNS ASK be####should.net
- DNS ASK ga####should.net
- DNS ASK be###rshort.net
- DNS ASK ag####topinion.net
- DNS ASK ag####tdistance.net
- DNS ASK la###arrive.net
- DNS ASK ca####narrive.net
- DNS ASK re####supply.net
- DNS ASK el####icsupply.net
- DNS ASK re####distance.net
- DNS ASK el#####cdistance.net
- DNS ASK ca####noffice.net
- DNS ASK st####should.net
- DNS ASK la###office.net
- DNS ASK el####icarrive.net
- DNS ASK st####supply.net
- DNS ASK tr###supply.net
- DNS ASK st####distance.net
- DNS ASK tr####istance.net
- DNS ASK el####icoffice.net
- DNS ASK re####office.net
- DNS ASK st###tshort.net
- DNS ASK la####istance.net
- DNS ASK ni###office.net
- DNS ASK do###office.net
- DNS ASK ag####tarrive.net
- DNS ASK do###arrive.net
- DNS ASK ni###supply.net
- DNS ASK de####supply.net
- DNS ASK ca####ndistance.net
- DNS ASK do####istance.net
- DNS ASK ag####toffice.net
- DNS ASK de####office.net
- DNS ASK ni###arrive.net
- DNS ASK de####arrive.net
- DNS ASK la###supply.net
- DNS ASK ca####nsupply.net
- DNS ASK de####distance.net
- DNS ASK ni####istance.net
- DNS ASK el####icpromise.net
- DNS ASK re####promise.net
- DNS ASK el####icopinion.net
- DNS ASK he#####ifference.net
- DNS ASK le###revery.net
- DNS ASK he###nevery.net
- DNS ASK he###single.net
- DNS ASK le####charge.net
- DNS ASK or###single.net
- DNS ASK le#####ifference.net
- DNS ASK ge####single.net
- DNS ASK ge#####ifference.net
- DNS ASK he###every.net
- DNS ASK ge###eevery.net
- DNS ASK va####ssingle.net
- DNS ASK he###charge.net
- DNS ASK ge####charge.net
- DNS ASK he####ifference.net
- DNS ASK st####office.net
- DNS ASK re####single.net
- DNS ASK re####eevery.net
- DNS ASK or###every.net
- DNS ASK re#####difference.net
- DNS ASK or####ifference.net
- DNS ASK re####echarge.net
- DNS ASK or###charge.net
- DNS ASK re####esingle.net
- DNS ASK he####single.net
- DNS ASK ne####aryevery.net
- DNS ASK pl####ntevery.net
- DNS ASK ne#####rydifference.net
- DNS ASK pl#####tdifference.net
- DNS ASK ne####arycharge.net
- DNS ASK pl####ntcharge.net
- DNS ASK ne####arysingle.net
- DNS ASK le####single.net
- DNS ASK re####arrive.net
- DNS ASK va####scharge.net
- DNS ASK re#####ifference.net
- DNS ASK la###should.net
- DNS ASK ca####nshould.net
- DNS ASK la###short.net
- DNS ASK ca####nshort.net
- DNS ASK la####pinion.net
- DNS ASK re####charge.net
- DNS ASK de####promise.net
- DNS ASK ni####romise.net
- DNS ASK re####should.net
- DNS ASK el####icshould.net
- DNS ASK re###dshort.net
- DNS ASK el####icshort.net
- DNS ASK re####opinion.net
- DNS ASK ca####nopinion.net
- DNS ASK ca####npromise.net
- DNS ASK va#####difference.net
- DNS ASK la####romise.net
- DNS ASK he####charge.net
- DNS ASK va####severy.net
- DNS ASK re###nevery.net
- DNS ASK ag####tshould.net
- DNS ASK do###should.net
- DNS ASK ag####tshort.net
- DNS ASK de###eshort.net
- DNS ASK de####opinion.net
- DNS ASK ni####pinion.net
- DNS ASK ag####tpromise.net
- DNS ASK do####romise.net
- DNS ASK ni###should.net
- DNS ASK de####should.net
- DNS ASK ni###short.net
- DNS ASK do###short.net
- DNS ASK do####pinion.net
- DNS ASK tr###office.net
Miscellaneous
Creates and executes the following
- 'C:\asiqrquwud\b9mnparcaciqk9ox.exe'
- 'C:\asiqrquwud\pcrzkjpee.exe'
- 'C:\asiqrquwud\ftacxxjkqhk.exe' "c:\asiqrquwud\pcrzkjpee.exe"
