Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Search ActiveX Framework Power Reporting] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Search ActiveX Framework Power Reporting] 'ImagePath' = 'C:\aaguldglefisq\mdbbsvze.exe'
Creates the following services
- 'Search ActiveX Framework Power Reporting' C:\aaguldglefisq\mdbbsvze.exe
Modifies file system
Creates the following files
- %WINDIR%\aaguldglefisq\wam4gzody
- C:\aaguldglefisq\wam4gzody
- C:\aaguldglefisq\xqivhskrihomkymbkfj.exe
- C:\aaguldglefisq\mdbbsvze.exe
- C:\aaguldglefisq\hfxzpnrahgh.exe
- C:\aaguldglefisq\rlcuqlqicg
Sets the 'hidden' attribute to the following files
- C:\aaguldglefisq\mdbbsvze.exe
- C:\aaguldglefisq\hfxzpnrahgh.exe
Deletes the following files
- %WINDIR%\aaguldglefisq\wam4gzody
- C:\aaguldglefisq\xqivhskrihomkymbkfj.exe
Substitutes the following files
- %WINDIR%\aaguldglefisq\wam4gzody
Network activity
Connects to
- 'do####butter.net':80
- 'st####nderstand.net':80
- 'mo####ntfifteen.net':80
- 'pr####edried.net':80
- 'st####rticle.net':80
- 'bu####ngservice.net':80
- 'st###river.net':80
- 'de####service.net':80
TCP
HTTP GET requests
- http://do####butter.net/index.php
- http://st####nderstand.net/index.php
- http://mo####ntfifteen.net/index.php
- http://st####rticle.net/index.php
- http://bu####ngservice.net/index.php
- http://st###river.net/index.php
- http://de####service.net/index.php
UDP
- DNS ASK do####butter.net
- DNS ASK st####uppose.net
- DNS ASK mi####uppose.net
- DNS ASK st####ervice.net
- DNS ASK mi####ervice.net
- DNS ASK st###river.net
- DNS ASK mi###river.net
- DNS ASK ou####eservice.net
- DNS ASK do####mister.net
- DNS ASK do####suppose.net
- DNS ASK pr####suppose.net
- DNS ASK do####service.net
- DNS ASK pr####service.net
- DNS ASK do###rriver.net
- DNS ASK pr###yriver.net
- DNS ASK st###mister.net
- DNS ASK mi###mister.net
- DNS ASK ev####griver.net
- DNS ASK bu####ngriver.net
- DNS ASK ev####gservice.net
- DNS ASK st####thangry.net
- DNS ASK st####tharticle.net
- DNS ASK mo####ntmister.net
- DNS ASK ou####emister.net
- DNS ASK mo####ntsuppose.net
- DNS ASK ou####esuppose.net
- DNS ASK fe####mister.net
- DNS ASK pr####mister.net
- DNS ASK mo####ntservice.net
- DNS ASK ou####eriver.net
- DNS ASK bu####ngmister.net
- DNS ASK ev####gmister.net
- DNS ASK bu####ngsuppose.net
- DNS ASK ev####gsuppose.net
- DNS ASK bu####ngservice.net
- DNS ASK st####thfifteen.net
- DNS ASK mo####ntriver.net
- DNS ASK fe####suppose.net
- DNS ASK fe####service.net
- DNS ASK fe###wriver.net
- DNS ASK st####thriver.net
- DNS ASK mo####ntnearly.net
- DNS ASK ou####enearly.net
- DNS ASK mo####nthappen.net
- DNS ASK ou####ehappen.net
- DNS ASK mo####ntshake.net
- DNS ASK ou####eshake.net
- DNS ASK ou####eshare.net
- DNS ASK st####thdried.net
- DNS ASK bu####ngnearly.net
- DNS ASK ev####gnearly.net
- DNS ASK bu####nghappen.net
- DNS ASK ev####ghappen.net
- DNS ASK bu####ngshake.net
- DNS ASK ev####gshake.net
- DNS ASK bu####ngshare.net
- DNS ASK st####thservice.net
- DNS ASK re###triver.net
- DNS ASK st####thsuppose.net
- DNS ASK br###nriver.net
- DNS ASK do###eriver.net
- DNS ASK br####mister.net
- DNS ASK re####mister.net
- DNS ASK br####suppose.net
- DNS ASK re####suppose.net
- DNS ASK br####service.net
- DNS ASK re####service.net
- DNS ASK ev####gshare.net
- DNS ASK de###eriver.net
- DNS ASK pr####emister.net
- DNS ASK de####mister.net
- DNS ASK pr####esuppose.net
- DNS ASK de####suppose.net
- DNS ASK pr####eservice.net
- DNS ASK de####service.net
- DNS ASK pr####eriver.net
- DNS ASK st####thmister.net
- DNS ASK mo####ntshare.net
- DNS ASK de####article.net
- DNS ASK br###nangry.net
- DNS ASK st###behind.net
- DNS ASK st####thbutter.net
- DNS ASK st###butter.net
- DNS ASK mo####ntdried.net
- DNS ASK ou####edried.net
- DNS ASK mo####ntfifteen.net
- DNS ASK pr#####understand.net
- DNS ASK ou####efifteen.net
- DNS ASK ou####eangry.net
- DNS ASK mo####ntarticle.net
- DNS ASK ou####earticle.net
- DNS ASK bu####ngdried.net
- DNS ASK ev####gdried.net
- DNS ASK bu####ngfifteen.net
- DNS ASK st###broad.net
- DNS ASK st####thbehind.net
- DNS ASK st####thbroad.net
- DNS ASK st####nderstand.net
- DNS ASK st#####hunderstand.net
- DNS ASK re#####nderstand.net
- DNS ASK br###nbroad.net
- DNS ASK re###tbroad.net
- DNS ASK br####behind.net
- DNS ASK re####behind.net
- DNS ASK br####butter.net
- DNS ASK ev####gfifteen.net
- DNS ASK mo####ntangry.net
- DNS ASK re####butter.net
- DNS ASK pr####ebroad.net
- DNS ASK de###ebroad.net
- DNS ASK pr####ebehind.net
- DNS ASK de####behind.net
- DNS ASK pr####ebutter.net
- DNS ASK de####butter.net
- DNS ASK br#####nderstand.net
- DNS ASK de#####nderstand.net
- DNS ASK bu####ngangry.net
- DNS ASK ev####gangry.net
- DNS ASK bu####ngarticle.net
- DNS ASK fe###wangry.net
- DNS ASK do###eangry.net
- DNS ASK fe####article.net
- DNS ASK br###ndried.net
- DNS ASK re###tdried.net
- DNS ASK br####fifteen.net
- DNS ASK re####fifteen.net
- DNS ASK re###tangry.net
- DNS ASK pr####earticle.net
- DNS ASK br####article.net
- DNS ASK re####article.net
- DNS ASK pr####edried.net
- DNS ASK de###edried.net
- DNS ASK pr####efifteen.net
- DNS ASK de####fifteen.net
- DNS ASK pr####eangry.net
- DNS ASK fe####fifteen.net
- DNS ASK mi####rticle.net
- DNS ASK do###edried.net
- DNS ASK st####rticle.net
- DNS ASK ev####garticle.net
- DNS ASK st###dried.net
- DNS ASK mi###dried.net
- DNS ASK st####ifteen.net
- DNS ASK mi####ifteen.net
- DNS ASK st###angry.net
- DNS ASK mi###angry.net
- DNS ASK de###eangry.net
- DNS ASK pr####article.net
- DNS ASK do###rdried.net
- DNS ASK pr###ydried.net
- DNS ASK do####fifteen.net
- DNS ASK pr####fifteen.net
- DNS ASK do###rangry.net
- DNS ASK pr###yangry.net
- DNS ASK do####article.net
- DNS ASK fe###wdried.net
- DNS ASK st###nearly.net
Miscellaneous
Creates and executes the following
- 'C:\aaguldglefisq\xqivhskrihomkymbkfj.exe'
- 'C:\aaguldglefisq\mdbbsvze.exe'
- 'C:\aaguldglefisq\hfxzpnrahgh.exe' "c:\aaguldglefisq\mdbbsvze.exe"
