Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Collector Shadow Video Panel COM] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Collector Shadow Video Panel COM] 'ImagePath' = 'C:\acuigiz\afoxzfazkc9y.exe'
Creates the following services
- 'Collector Shadow Video Panel COM' C:\acuigiz\afoxzfazkc9y.exe
Modifies file system
Creates the following files
- %WINDIR%\acuigiz\ufhbjabj
- C:\acuigiz\ufhbjabj
- C:\acuigiz\wm2fudoxu3gjhkposl0.exe
- C:\acuigiz\afoxzfazkc9y.exe
- C:\acuigiz\nvnnwczblz.exe
- C:\acuigiz\tffii3fvz
Sets the 'hidden' attribute to the following files
- C:\acuigiz\afoxzfazkc9y.exe
- C:\acuigiz\nvnnwczblz.exe
Deletes the following files
- %WINDIR%\acuigiz\ufhbjabj
- C:\acuigiz\wm2fudoxu3gjhkposl0.exe
Substitutes the following files
- %WINDIR%\acuigiz\ufhbjabj
Network activity
Connects to
- 'he#####ontittensor.net':80
- 'th#####natittensor.net':80
TCP
HTTP GET requests
- http://he#####ontittensor.net/index.php
- http://th#####natittensor.net/index.php
UDP
- DNS ASK kr#####lemillhouse.net
- DNS ASK gr#####lecarpenter.net
- DNS ASK si#####ercarpenter.net
- DNS ASK gr#####lerupertson.net
- DNS ASK si#####errupertson.net
- DNS ASK gr#####legranville.net
- DNS ASK si#####ergranville.net
- DNS ASK ga#####lecotterill.net
- DNS ASK an#####lacotterill.net
- DNS ASK ga#####letittensor.net
- DNS ASK an#####latittensor.net
- DNS ASK ga#####lelongstaff.net
- DNS ASK an#####lalongstaff.net
- DNS ASK ga#####lemillhouse.net
- DNS ASK an#####lamillhouse.net
- DNS ASK ga#####lacotterill.net
- DNS ASK br#####iacotterill.net
- DNS ASK ga#####latittensor.net
- DNS ASK si#####errowbottom.net
- DNS ASK gr#####lerowbottom.net
- DNS ASK he#####ongranville.net
- DNS ASK kr#####legranville.net
- DNS ASK br#####terupertson.net
- DNS ASK je#####onrupertson.net
- DNS ASK br#####tegranville.net
- DNS ASK je#####ongranville.net
- DNS ASK ce#####nerowbottom.net
- DNS ASK th#####narowbottom.net
- DNS ASK ce#####necarpenter.net
- DNS ASK th#####nacarpenter.net
- DNS ASK th#####narupertson.net
- DNS ASK ce#####nerupertson.net
- DNS ASK ce#####negranville.net
- DNS ASK th#####nagranville.net
- DNS ASK kr#####lerowbottom.net
- DNS ASK he#####onrowbottom.net
- DNS ASK kr#####lecarpenter.net
- DNS ASK he#####oncarpenter.net
- DNS ASK kr#####lerupertson.net
- DNS ASK he#####onrupertson.net
- DNS ASK je#####oncarpenter.net
- DNS ASK br#####iatittensor.net
- DNS ASK ga#####lalongstaff.net
- DNS ASK br#####ialongstaff.net
- DNS ASK je#####onlongstaff.net
- DNS ASK br#####temillhouse.net
- DNS ASK je#####onmillhouse.net
- DNS ASK ce#####necotterill.net
- DNS ASK th#####nacotterill.net
- DNS ASK ce#####netittensor.net
- DNS ASK th#####natittensor.net
- DNS ASK ce#####nelongstaff.net
- DNS ASK th#####nalongstaff.net
- DNS ASK ce#####nemillhouse.net
- DNS ASK th#####namillhouse.net
- DNS ASK kr#####lecotterill.net
- DNS ASK he#####oncotterill.net
- DNS ASK kr#####letittensor.net
- DNS ASK he#####ontittensor.net
- DNS ASK kr#####lelongstaff.net
- DNS ASK he#####onlongstaff.net
- DNS ASK br#####telongstaff.net
- DNS ASK je#####ontittensor.net
- DNS ASK br#####tetittensor.net
- DNS ASK je#####oncotterill.net
- DNS ASK br#####iamillhouse.net
- DNS ASK sh#####lecotterill.net
- DNS ASK gr#####orcotterill.net
- DNS ASK sh#####letittensor.net
- DNS ASK gr#####ortittensor.net
- DNS ASK sh#####lelongstaff.net
- DNS ASK gr#####orlongstaff.net
- DNS ASK sh#####lemillhouse.net
- DNS ASK ge#####necotterill.net
- DNS ASK gr#####ormillhouse.net
- DNS ASK he#####tacotterill.net
- DNS ASK ge#####netittensor.net
- DNS ASK he#####tatittensor.net
- DNS ASK ge#####nelongstaff.net
- DNS ASK he#####talongstaff.net
- DNS ASK ge#####nemillhouse.net
- DNS ASK he#####tamillhouse.net
- DNS ASK br#####tecotterill.net
- DNS ASK ga#####lamillhouse.net
- DNS ASK br#####tecarpenter.net
Miscellaneous
Creates and executes the following
- 'C:\acuigiz\wm2fudoxu3gjhkposl0.exe'
- 'C:\acuigiz\afoxzfazkc9y.exe'
- 'C:\acuigiz\nvnnwczblz.exe' "c:\acuigiz\afoxzfazkc9y.exe"
