Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Adaptive Secondary Removal] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Adaptive Secondary Removal] 'ImagePath' = 'C:\sybcgxdbirjuedl\zdornjpgx.exe'
Creates the following services
- 'Adaptive Secondary Removal' C:\sybcgxdbirjuedl\zdornjpgx.exe
Modifies file system
Creates the following files
- %WINDIR%\sybcgxdbirjuedl\qsjyhur
- C:\sybcgxdbirjuedl\qsjyhur
- C:\sybcgxdbirjuedl\vszkowjqzbmw8iysumv.exe
- C:\sybcgxdbirjuedl\zdornjpgx.exe
- C:\sybcgxdbirjuedl\wvfktksqys.exe
Sets the 'hidden' attribute to the following files
- C:\sybcgxdbirjuedl\zdornjpgx.exe
- C:\sybcgxdbirjuedl\wvfktksqys.exe
Deletes the following files
- %WINDIR%\sybcgxdbirjuedl\qsjyhur
- C:\sybcgxdbirjuedl\vszkowjqzbmw8iysumv.exe
Substitutes the following files
- %WINDIR%\sybcgxdbirjuedl\qsjyhur
Network activity
Connects to
- 'li####flower.net':80
- 'li####corner.net':80
- 'li####animal.net':80
TCP
HTTP GET requests
- http://li####flower.net/index.php
- http://li####corner.net/index.php
- http://li####animal.net/index.php
UDP
- DNS ASK ef####beyond.net
- DNS ASK be####goodbye.net
- DNS ASK ri####fortieth.net
- DNS ASK be####fortieth.net
- DNS ASK ch####dvance.net
- DNS ASK th####dvance.net
- DNS ASK ch####tranger.net
- DNS ASK th####tranger.net
- DNS ASK wi####fortieth.net
- DNS ASK ch####oodbye.net
- DNS ASK ch####ortieth.net
- DNS ASK th####ortieth.net
- DNS ASK wi####advance.net
- DNS ASK su####advance.net
- DNS ASK wi####stranger.net
- DNS ASK su####stranger.net
- DNS ASK wi####goodbye.net
- DNS ASK be####stranger.net
- DNS ASK ri####goodbye.net
- DNS ASK th####oodbye.net
- DNS ASK su####goodbye.net
- DNS ASK ri####advance.net
- DNS ASK hu####dadvance.net
- DNS ASK jo####ystranger.net
- DNS ASK hu####dstranger.net
- DNS ASK jo####ygoodbye.net
- DNS ASK hu####dgoodbye.net
- DNS ASK jo####yfortieth.net
- DNS ASK hu####dfortieth.net
- DNS ASK de####yadvance.net
- DNS ASK li####advance.net
- DNS ASK de####ystranger.net
- DNS ASK li####stranger.net
- DNS ASK de####ygoodbye.net
- DNS ASK li####goodbye.net
- DNS ASK de####yfortieth.net
- DNS ASK li####fortieth.net
- DNS ASK be####advance.net
- DNS ASK re####ercorner.net
- DNS ASK ri####stranger.net
- DNS ASK th####pecial.net
- DNS ASK su####fortieth.net
- DNS ASK re#####rfortieth.net
- DNS ASK hu####descape.net
- DNS ASK jo####yanimal.net
- DNS ASK hu####danimal.net
- DNS ASK jo####yproblem.net
- DNS ASK hu####dproblem.net
- DNS ASK jo####ymodern.net
- DNS ASK hu####dmodern.net
- DNS ASK ef####advance.net
- DNS ASK de####yescape.net
- DNS ASK de####yanimal.net
- DNS ASK li####animal.net
- DNS ASK de####yproblem.net
- DNS ASK li####problem.net
- DNS ASK de####ymodern.net
- DNS ASK li####modern.net
- DNS ASK wo####ortieth.net
- DNS ASK re####ergoodbye.net
- DNS ASK jo####yescape.net
- DNS ASK wo####oodbye.net
- DNS ASK re#####rstranger.net
- DNS ASK th####hadvance.net
- DNS ASK th####hstranger.net
- DNS ASK ef####goodbye.net
- DNS ASK th####hgoodbye.net
- DNS ASK ef####fortieth.net
- DNS ASK th####hfortieth.net
- DNS ASK fo####advance.net
- DNS ASK wo###corner.net
- DNS ASK in####seadvance.net
- DNS ASK jo####yadvance.net
- DNS ASK in#####estranger.net
- DNS ASK in####segoodbye.net
- DNS ASK fo####fortieth.net
- DNS ASK in#####efortieth.net
- DNS ASK wo####dvance.net
- DNS ASK re####eradvance.net
- DNS ASK wo####tranger.net
- DNS ASK fo####stranger.net
- DNS ASK ef####stranger.net
- DNS ASK fo####goodbye.net
- DNS ASK re####erspecial.net
- DNS ASK wo####pecial.net
- DNS ASK re####erminute.net
- DNS ASK hu####dflower.net
- DNS ASK jo####yminute.net
- DNS ASK hu####dminute.net
- DNS ASK jo####yspecial.net
- DNS ASK hu####dspecial.net
- DNS ASK jo####ycorner.net
- DNS ASK hu####dcorner.net
- DNS ASK de####yflower.net
- DNS ASK li####flower.net
- DNS ASK de####yminute.net
- DNS ASK li####minute.net
- DNS ASK de####yspecial.net
- DNS ASK li####special.net
- DNS ASK de####ycorner.net
- DNS ASK li####corner.net
- DNS ASK wo###bottom.net
- DNS ASK wo####orever.net
- DNS ASK jo####yflower.net
- DNS ASK re####erforever.net
- DNS ASK re####erbeing.net
- DNS ASK fo###tbeing.net
- DNS ASK ef###tbeing.net
- DNS ASK th####hbeing.net
- DNS ASK ef####forever.net
- DNS ASK th####hforever.net
- DNS ASK ef####bottom.net
- DNS ASK th####hbottom.net
- DNS ASK fo####beyond.net
- DNS ASK ri####flower.net
- DNS ASK ri####escape.net
- DNS ASK in####sebeyond.net
- DNS ASK fo####forever.net
- DNS ASK in####seforever.net
- DNS ASK fo####bottom.net
- DNS ASK in####sebottom.net
- DNS ASK wo###beyond.net
- DNS ASK re####erbeyond.net
- DNS ASK wo###being.net
- DNS ASK th####hbeyond.net
- DNS ASK in####sebeing.net
- DNS ASK li####escape.net
- DNS ASK be####flower.net
- DNS ASK be####special.net
- DNS ASK ef####special.net
- DNS ASK th####hspecial.net
- DNS ASK ef####corner.net
- DNS ASK th####hcorner.net
- DNS ASK fo####flower.net
- DNS ASK in####seflower.net
- DNS ASK re####erbottom.net
- DNS ASK fo####minute.net
- DNS ASK fo####special.net
- DNS ASK in####sespecial.net
- DNS ASK fo####corner.net
- DNS ASK in####secorner.net
- DNS ASK wo###flower.net
- DNS ASK re####erflower.net
- DNS ASK wo###minute.net
- DNS ASK th####hflower.net
- DNS ASK in####seminute.net
- DNS ASK th####hminute.net
- DNS ASK ef####minute.net
- DNS ASK ef####flower.net
- DNS ASK su####corner.net
- DNS ASK ri####corner.net
- DNS ASK be####corner.net
- DNS ASK ch###flower.net
- DNS ASK th###flower.net
- DNS ASK ch###minute.net
- DNS ASK th###minute.net
- DNS ASK ri####minute.net
- DNS ASK ch####pecial.net
- DNS ASK be####minute.net
- DNS ASK ch###corner.net
- DNS ASK wi####flower.net
- DNS ASK su####flower.net
- DNS ASK wi####minute.net
- DNS ASK su####minute.net
- DNS ASK wi####special.net
- DNS ASK su####special.net
- DNS ASK ri####special.net
- DNS ASK wi####corner.net
- DNS ASK th###corner.net
- DNS ASK be####escape.net
Miscellaneous
Creates and executes the following
- 'C:\sybcgxdbirjuedl\vszkowjqzbmw8iysumv.exe'
- 'C:\sybcgxdbirjuedl\zdornjpgx.exe'
- 'C:\sybcgxdbirjuedl\wvfktksqys.exe' "c:\sybcgxdbirjuedl\zdornjpgx.exe"
