Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Software Net.Tcp Connection Print Service Logs] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Software Net.Tcp Connection Print Service Logs] 'ImagePath' = 'C:\fvxeqpfzwotsu\lpawwdjmi.exe'
Creates the following services
- 'Software Net.Tcp Connection Print Service Logs' C:\fvxeqpfzwotsu\lpawwdjmi.exe
Modifies file system
Creates the following files
- %WINDIR%\fvxeqpfzwotsu\yqsgcgcnc
- C:\fvxeqpfzwotsu\yqsgcgcnc
- C:\fvxeqpfzwotsu\lvjwkk9evh3bsryxdgc.exe
- C:\fvxeqpfzwotsu\lpawwdjmi.exe
- C:\fvxeqpfzwotsu\gttqdcrgnl.exe
Sets the 'hidden' attribute to the following files
- C:\fvxeqpfzwotsu\lpawwdjmi.exe
- C:\fvxeqpfzwotsu\gttqdcrgnl.exe
Deletes the following files
- %WINDIR%\fvxeqpfzwotsu\yqsgcgcnc
- C:\fvxeqpfzwotsu\lvjwkk9evh3bsryxdgc.exe
Substitutes the following files
- %WINDIR%\fvxeqpfzwotsu\yqsgcgcnc
Network activity
Connects to
- 'do####orderly.net':80
- 'mo####ntchance.net':80
- 'do#####nderstood.net':80
- 'do####twenty.net':80
- 'st#####hunderstood.net':80
TCP
HTTP GET requests
- http://do####orderly.net/index.php
- http://mo####ntchance.net/index.php
- http://do#####nderstood.net/index.php
- http://do####twenty.net/index.php
- http://st#####hunderstood.net/index.php
UDP
- DNS ASK mi###value.net
- DNS ASK st#####hunderstood.net
- DNS ASK st####thtwenty.net
- DNS ASK st####thmeeting.net
- DNS ASK st####thchance.net
- DNS ASK de#####nderstood.net
- DNS ASK pr#####understood.net
- DNS ASK de####twenty.net
- DNS ASK pr####etwenty.net
- DNS ASK de####meeting.net
- DNS ASK pr####emeeting.net
- DNS ASK de####chance.net
- DNS ASK pr####echance.net
- DNS ASK re#####nderstood.net
- DNS ASK mo####ntborrow.net
- DNS ASK br#####nderstood.net
- DNS ASK br####twenty.net
- DNS ASK re####meeting.net
- DNS ASK br####meeting.net
- DNS ASK re####chance.net
- DNS ASK br####chance.net
- DNS ASK fe#####nderstood.net
- DNS ASK fe####twenty.net
- DNS ASK fe####meeting.net
- DNS ASK fe####chance.net
- DNS ASK pr#####nderstood.net
- DNS ASK do#####nderstood.net
- DNS ASK pr####twenty.net
- DNS ASK do####twenty.net
- DNS ASK re####twenty.net
- DNS ASK ou####eborrow.net
- DNS ASK mo####nttrain.net
- DNS ASK ou####etrain.net
- DNS ASK fe####borrow.net
- DNS ASK pr####delight.net
- DNS ASK do####delight.net
- DNS ASK pr#####lectricity.net
- DNS ASK do#####lectricity.net
- DNS ASK pr###ytrain.net
- DNS ASK do###rtrain.net
- DNS ASK pr####borrow.net
- DNS ASK do####borrow.net
- DNS ASK mi####elight.net
- DNS ASK st####elight.net
- DNS ASK mi#####ectricity.net
- DNS ASK st#####ectricity.net
- DNS ASK mi###train.net
- DNS ASK st###train.net
- DNS ASK mi###borrow.net
- DNS ASK st###borrow.net
- DNS ASK ev####gdelight.net
- DNS ASK bu####ngdelight.net
- DNS ASK ev#####electricity.net
- DNS ASK bu#####gelectricity.net
- DNS ASK ev####gtrain.net
- DNS ASK bu####ngtrain.net
- DNS ASK ev####gborrow.net
- DNS ASK bu####ngborrow.net
- DNS ASK ou####edelight.net
- DNS ASK mo####ntdelight.net
- DNS ASK ou#####electricity.net
- DNS ASK mo#####telectricity.net
- DNS ASK pr####meeting.net
- DNS ASK fe###wtrain.net
- DNS ASK do####meeting.net
- DNS ASK do####chance.net
- DNS ASK pr####evalue.net
- DNS ASK de####orderly.net
- DNS ASK pr####eorderly.net
- DNS ASK de####reason.net
- DNS ASK pr####ereason.net
- DNS ASK de####almost.net
- DNS ASK pr####ealmost.net
- DNS ASK re###tvalue.net
- DNS ASK br###nvalue.net
- DNS ASK re####orderly.net
- DNS ASK br####orderly.net
- DNS ASK re####reason.net
- DNS ASK br####reason.net
- DNS ASK de###evalue.net
- DNS ASK re####almost.net
- DNS ASK do###evalue.net
- DNS ASK fe###wvalue.net
- DNS ASK fe####orderly.net
- DNS ASK fe####reason.net
- DNS ASK fe####almost.net
- DNS ASK pr###yvalue.net
- DNS ASK do###rvalue.net
- DNS ASK pr####orderly.net
- DNS ASK do####orderly.net
- DNS ASK pr####reason.net
- DNS ASK do####reason.net
- DNS ASK pr####almost.net
- DNS ASK do####almost.net
- DNS ASK br####almost.net
- DNS ASK st####thalmost.net
- DNS ASK st###almost.net
- DNS ASK st####threason.net
- DNS ASK mi####nderstood.net
- DNS ASK st####nderstood.net
- DNS ASK mi###twenty.net
- DNS ASK st###twenty.net
- DNS ASK mi####eeting.net
- DNS ASK st####eeting.net
- DNS ASK mi###chance.net
- DNS ASK st###chance.net
- DNS ASK ev#####understood.net
- DNS ASK bu#####gunderstood.net
- DNS ASK ev####gtwenty.net
- DNS ASK bu####ngtwenty.net
- DNS ASK ev####gmeeting.net
- DNS ASK bu####ngmeeting.net
- DNS ASK ev####gchance.net
- DNS ASK bu####ngchance.net
- DNS ASK ou#####understood.net
- DNS ASK mo#####tunderstood.net
- DNS ASK ou####etwenty.net
- DNS ASK mo####nttwenty.net
- DNS ASK ou####emeeting.net
- DNS ASK mo####ntmeeting.net
- DNS ASK ou####echance.net
- DNS ASK mo####ntchance.net
- DNS ASK st###value.net
- DNS ASK st####thvalue.net
- DNS ASK st####rderly.net
- DNS ASK st####thorderly.net
- DNS ASK st###reason.net
- DNS ASK pr####chance.net
- DNS ASK do###etrain.net
Miscellaneous
Creates and executes the following
- 'C:\fvxeqpfzwotsu\lvjwkk9evh3bsryxdgc.exe'
- 'C:\fvxeqpfzwotsu\lpawwdjmi.exe'
- 'C:\fvxeqpfzwotsu\gttqdcrgnl.exe' "c:\fvxeqpfzwotsu\lpawwdjmi.exe"
