Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Secure Interface Fax Windows] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Secure Interface Fax Windows] 'ImagePath' = 'C:\tzcqhbpmtiec\rfoarcawa.exe'
Creates the following services
- 'Secure Interface Fax Windows' C:\tzcqhbpmtiec\rfoarcawa.exe
Modifies file system
Creates the following files
- %WINDIR%\tzcqhbpmtiec\x5qqr1civf
- C:\tzcqhbpmtiec\x5qqr1civf
- C:\tzcqhbpmtiec\xlnfhomk2xxvysp5i.exe
- C:\tzcqhbpmtiec\rfoarcawa.exe
- C:\tzcqhbpmtiec\fyursoxw.exe
Sets the 'hidden' attribute to the following files
- C:\tzcqhbpmtiec\rfoarcawa.exe
- C:\tzcqhbpmtiec\fyursoxw.exe
Deletes the following files
- %WINDIR%\tzcqhbpmtiec\x5qqr1civf
- C:\tzcqhbpmtiec\xlnfhomk2xxvysp5i.exe
Substitutes the following files
- %WINDIR%\tzcqhbpmtiec\x5qqr1civf
Network activity
Connects to
- 'st###shout.net':80
- 'st###listen.net':80
- 'st####tation.net':80
- 'pr####childhood.net':80
- 'fe####object.net':80
- 'ou####espace.net':80
- 'bu####ngspace.net':80
- 'st###space.net':80
TCP
HTTP GET requests
- http://st###shout.net/index.php
- http://st###listen.net/index.php
- http://st####tation.net/index.php
- http://pr####childhood.net/index.php
- http://fe####object.net/index.php
- http://ou####espace.net/index.php
- http://bu####ngspace.net/index.php
- http://st###space.net/index.php
UDP
- DNS ASK ev####gbring.net
- DNS ASK re####object.net
- DNS ASK br####object.net
- DNS ASK re###tthird.net
- DNS ASK br###nthird.net
- DNS ASK re####station.net
- DNS ASK br####station.net
- DNS ASK fe####childhood.net
- DNS ASK fe####object.net
- DNS ASK do###ethird.net
- DNS ASK fe###wthird.net
- DNS ASK fe####station.net
- DNS ASK pr####childhood.net
- DNS ASK do####childhood.net
- DNS ASK pr####object.net
- DNS ASK do####object.net
- DNS ASK pr###ythird.net
- DNS ASK do###rthird.net
- DNS ASK pr####station.net
- DNS ASK do####station.net
- DNS ASK mi####hildhood.net
- DNS ASK st####hildhood.net
- DNS ASK mi###object.net
- DNS ASK st###object.net
- DNS ASK mi###third.net
- DNS ASK st###third.net
- DNS ASK mi####tation.net
- DNS ASK st####tation.net
- DNS ASK bu#####gchildhood.net
- DNS ASK ev#####childhood.net
- DNS ASK br####childhood.net
- DNS ASK re####childhood.net
- DNS ASK ev####gclose.net
- DNS ASK bu####ngclose.net
- DNS ASK ev####gyellow.net
- DNS ASK bu####ngyellow.net
- DNS ASK ev####gtravel.net
- DNS ASK bu####ngtravel.net
- DNS ASK ev####gspace.net
- DNS ASK bu####ngspace.net
- DNS ASK ou####eclose.net
- DNS ASK mo####ntclose.net
- DNS ASK ou####eyellow.net
- DNS ASK mo####ntyellow.net
- DNS ASK ou####etravel.net
- DNS ASK ou####espace.net
- DNS ASK st####thbring.net
- DNS ASK mo####ntspace.net
- DNS ASK st#####hchildhood.net
- DNS ASK st####thobject.net
- DNS ASK st####ththird.net
- DNS ASK st####thstation.net
- DNS ASK de####childhood.net
- DNS ASK pr#####childhood.net
- DNS ASK de####object.net
- DNS ASK pr####eobject.net
- DNS ASK de###ethird.net
- DNS ASK pr####ethird.net
- DNS ASK de####station.net
- DNS ASK pr####estation.net
- DNS ASK ev####gobject.net
- DNS ASK bu####ngobject.net
- DNS ASK ev####gthird.net
- DNS ASK fe####demand.net
- DNS ASK fe####listen.net
- DNS ASK do###ebring.net
- DNS ASK fe###wbring.net
- DNS ASK pr###yshout.net
- DNS ASK do###rshout.net
- DNS ASK pr####demand.net
- DNS ASK do####demand.net
- DNS ASK pr####listen.net
- DNS ASK do####listen.net
- DNS ASK pr###ybring.net
- DNS ASK do###rbring.net
- DNS ASK mi###shout.net
- DNS ASK st###shout.net
- DNS ASK mi###demand.net
- DNS ASK st###demand.net
- DNS ASK mi###listen.net
- DNS ASK st###listen.net
- DNS ASK mi###bring.net
- DNS ASK st###bring.net
- DNS ASK ev####gshout.net
- DNS ASK bu####ngshout.net
- DNS ASK ev####gdemand.net
- DNS ASK bu####ngdemand.net
- DNS ASK ev####glisten.net
- DNS ASK bu####nglisten.net
- DNS ASK do###eshout.net
- DNS ASK br###nbring.net
- DNS ASK fe###wshout.net
- DNS ASK re###tbring.net
- DNS ASK bu####ngthird.net
- DNS ASK br####listen.net
- DNS ASK ev####gstation.net
- DNS ASK bu####ngstation.net
- DNS ASK ou#####childhood.net
- DNS ASK mo#####tchildhood.net
- DNS ASK ou####eobject.net
- DNS ASK mo####ntobject.net
- DNS ASK ou####ethird.net
- DNS ASK mo####ntthird.net
- DNS ASK ou####estation.net
- DNS ASK mo####ntstation.net
- DNS ASK st####thshout.net
- DNS ASK st####thdemand.net
- DNS ASK mo####nttravel.net
- DNS ASK st###space.net
- DNS ASK de###eshout.net
- DNS ASK pr####eshout.net
- DNS ASK de####demand.net
- DNS ASK pr####edemand.net
- DNS ASK de####listen.net
- DNS ASK pr####elisten.net
- DNS ASK de###ebring.net
- DNS ASK pr####ebring.net
- DNS ASK re###tshout.net
- DNS ASK br###nshout.net
- DNS ASK re####demand.net
- DNS ASK br####demand.net
- DNS ASK re####listen.net
- DNS ASK st####thlisten.net
- DNS ASK mi###space.net
Miscellaneous
Creates and executes the following
- 'C:\tzcqhbpmtiec\xlnfhomk2xxvysp5i.exe'
- 'C:\tzcqhbpmtiec\rfoarcawa.exe'
- 'C:\tzcqhbpmtiec\fyursoxw.exe' "c:\tzcqhbpmtiec\rfoarcawa.exe"
