Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\HomeGroup RPC Bluetooth SPP Office Program] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\HomeGroup RPC Bluetooth SPP Office Program] 'ImagePath' = 'C:\fjfzwgnqpnu\tjndrqjfiur.exe'
Creates the following services
- 'HomeGroup RPC Bluetooth SPP Office Program' C:\fjfzwgnqpnu\tjndrqjfiur.exe
Modifies file system
Creates the following files
- %WINDIR%\fjfzwgnqpnu\ibmwush
- C:\fjfzwgnqpnu\ibmwush
- C:\fjfzwgnqpnu\pdqgwr3glxofuaz57.exe
- C:\fjfzwgnqpnu\tjndrqjfiur.exe
- C:\fjfzwgnqpnu\wqeagvsvs.exe
Sets the 'hidden' attribute to the following files
- C:\fjfzwgnqpnu\tjndrqjfiur.exe
- C:\fjfzwgnqpnu\wqeagvsvs.exe
Deletes the following files
- %WINDIR%\fjfzwgnqpnu\ibmwush
- C:\fjfzwgnqpnu\pdqgwr3glxofuaz57.exe
Substitutes the following files
- %WINDIR%\fjfzwgnqpnu\ibmwush
Network activity
Connects to
- 'el####icbicycle.net':80
- 'tr###bridge.net':80
- 'be####bicycle.net':80
- 'ni####itchen.net':80
- 'st####kitchen.net':80
- 'be####kitchen.net':80
- 'ga####kitchen.net':80
TCP
HTTP GET requests
- http://el####icbicycle.net/index.php
- http://tr###bridge.net/index.php
- http://be####bicycle.net/index.php
- http://ni####itchen.net/index.php
- http://st####kitchen.net/index.php
- http://be####kitchen.net/index.php
- http://ga####kitchen.net/index.php
UDP
- DNS ASK de####bicycle.net
- DNS ASK be####probable.net
- DNS ASK ga####kitchen.net
- DNS ASK be####kitchen.net
- DNS ASK ga####without.net
- DNS ASK be####without.net
- DNS ASK ga###rwagon.net
- DNS ASK be###rwagon.net
- DNS ASK tr####robable.net
- DNS ASK st####probable.net
- DNS ASK tr####itchen.net
- DNS ASK st####kitchen.net
- DNS ASK tr####ithout.net
- DNS ASK st####without.net
- DNS ASK tr###wagon.net
- DNS ASK el#####cprobable.net
- DNS ASK fl###wagon.net
- DNS ASK re####probable.net
- DNS ASK el####ickitchen.net
- DNS ASK re####kitchen.net
- DNS ASK el####icwithout.net
- DNS ASK re####without.net
- DNS ASK el####icwagon.net
- DNS ASK re###dwagon.net
- DNS ASK ca####nprobable.net
- DNS ASK la####robable.net
- DNS ASK ca####nkitchen.net
- DNS ASK la####itchen.net
- DNS ASK ca####nwithout.net
- DNS ASK la####ithout.net
- DNS ASK st###twagon.net
- DNS ASK qu###whose.net
- DNS ASK br###wagon.net
- DNS ASK la####elcome.net
- DNS ASK de####complete.net
- DNS ASK ni####omplete.net
- DNS ASK de###eproud.net
- DNS ASK ni###proud.net
- DNS ASK de####around.net
- DNS ASK ni###around.net
- DNS ASK de####welcome.net
- DNS ASK ni####elcome.net
- DNS ASK do####omplete.net
- DNS ASK ag####tcomplete.net
- DNS ASK do###proud.net
- DNS ASK ag####tproud.net
- DNS ASK do###around.net
- DNS ASK ca####nwagon.net
- DNS ASK ga####probable.net
- DNS ASK ag####twelcome.net
- DNS ASK se####probable.net
- DNS ASK qu####robable.net
- DNS ASK se####kitchen.net
- DNS ASK qu####itchen.net
- DNS ASK se####without.net
- DNS ASK qu####ithout.net
- DNS ASK se###nwagon.net
- DNS ASK qu###wagon.net
- DNS ASK br####robable.net
- DNS ASK fl####robable.net
- DNS ASK br####itchen.net
- DNS ASK fl####itchen.net
- DNS ASK br####ithout.net
- DNS ASK do####elcome.net
- DNS ASK fl####ithout.net
- DNS ASK la###wagon.net
- DNS ASK de####probable.net
- DNS ASK ni####robable.net
- DNS ASK re####bicycle.net
- DNS ASK be####bridge.net
- DNS ASK ga####except.net
- DNS ASK be####except.net
- DNS ASK tr###whose.net
- DNS ASK st###twhose.net
- DNS ASK tr####icycle.net
- DNS ASK st####bicycle.net
- DNS ASK tr###bridge.net
- DNS ASK st####bridge.net
- DNS ASK tr###except.net
- DNS ASK st####except.net
- DNS ASK el####icwhose.net
- DNS ASK re###dwhose.net
- DNS ASK ca####nwelcome.net
- DNS ASK be####bicycle.net
- DNS ASK el####icbridge.net
- DNS ASK re####bridge.net
- DNS ASK el####icexcept.net
- DNS ASK re####except.net
- DNS ASK ca####nwhose.net
- DNS ASK la###whose.net
- DNS ASK ca####nbicycle.net
- DNS ASK la####icycle.net
- DNS ASK ca####nbridge.net
- DNS ASK la###bridge.net
- DNS ASK ca####nexcept.net
- DNS ASK la###except.net
- DNS ASK de###ewhose.net
- DNS ASK ni###whose.net
- DNS ASK el####icbicycle.net
- DNS ASK ag####taround.net
- DNS ASK ga####bicycle.net
- DNS ASK fl###except.net
- DNS ASK be###rwhose.net
- DNS ASK de####kitchen.net
- DNS ASK ni####itchen.net
- DNS ASK de####without.net
- DNS ASK ni####ithout.net
- DNS ASK de###ewagon.net
- DNS ASK ni###wagon.net
- DNS ASK do####robable.net
- DNS ASK ag####tprobable.net
- DNS ASK do####itchen.net
- DNS ASK ag####tkitchen.net
- DNS ASK do####ithout.net
- DNS ASK ag####twithout.net
- DNS ASK do###wagon.net
- DNS ASK ga###rwhose.net
- DNS ASK ag####twagon.net
- DNS ASK ga####bridge.net
- DNS ASK se####bicycle.net
- DNS ASK qu####icycle.net
- DNS ASK se####bridge.net
- DNS ASK qu###bridge.net
- DNS ASK se####except.net
- DNS ASK qu###except.net
- DNS ASK br###whose.net
- DNS ASK fl###whose.net
- DNS ASK br####icycle.net
- DNS ASK fl####icycle.net
- DNS ASK br###bridge.net
- DNS ASK fl###bridge.net
- DNS ASK br###except.net
- DNS ASK se###nwhose.net
- DNS ASK la###around.net
Miscellaneous
Creates and executes the following
- 'C:\fjfzwgnqpnu\pdqgwr3glxofuaz57.exe'
- 'C:\fjfzwgnqpnu\tjndrqjfiur.exe'
- 'C:\fjfzwgnqpnu\wqeagvsvs.exe' "c:\fjfzwgnqpnu\tjndrqjfiur.exe"
