Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Offline Studio System Now Proxy Access Input] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Offline Studio System Now Proxy Access Input] 'ImagePath' = 'C:\ecegqbrp\aeynymalsxcz.exe'
Creates the following services
- 'Offline Studio System Now Proxy Access Input' C:\ecegqbrp\aeynymalsxcz.exe
Modifies file system
Creates the following files
- %WINDIR%\ecegqbrp\gs2hhpakx71u
- C:\ecegqbrp\gs2hhpakx71u
- C:\ecegqbrp\aumywhwp1fyzhuysezi.exe
- C:\ecegqbrp\aeynymalsxcz.exe
- C:\ecegqbrp\fcwrmofgs.exe
- C:\ecegqbrp\o0qfgd
Sets the 'hidden' attribute to the following files
- C:\ecegqbrp\aeynymalsxcz.exe
- C:\ecegqbrp\fcwrmofgs.exe
Deletes the following files
- %WINDIR%\ecegqbrp\gs2hhpakx71u
- C:\ecegqbrp\aumywhwp1fyzhuysezi.exe
Substitutes the following files
- %WINDIR%\ecegqbrp\gs2hhpakx71u
Network activity
Connects to
- 'mi####dollar.net':80
- 'th###board.net':80
- 'ch###board.net':80
TCP
HTTP GET requests
- http://mi####dollar.net/index.php
- http://th###board.net/index.php
- http://ch###board.net/index.php
UDP
- DNS ASK fl###above.net
- DNS ASK th###enter.net
- DNS ASK pr####tboard.net
- DNS ASK th###board.net
- DNS ASK pr####tladder.net
- DNS ASK th###ladder.net
- DNS ASK pr#####character.net
- DNS ASK th####haracter.net
- DNS ASK cl####ealize.net
- DNS ASK cl###dollar.net
- DNS ASK cl####ritten.net
- DNS ASK cl###shore.net
- DNS ASK pr####tenter.net
- DNS ASK we####rrealize.net
- DNS ASK we####rdollar.net
- DNS ASK am####dollar.net
- DNS ASK we####rwritten.net
- DNS ASK am####written.net
- DNS ASK we####rshore.net
- DNS ASK am###tshore.net
- DNS ASK hi####yrealize.net
- DNS ASK st####erealize.net
- DNS ASK hi####ydollar.net
- DNS ASK st####edollar.net
- DNS ASK hi####ywritten.net
- DNS ASK am####realize.net
- DNS ASK of###enter.net
- DNS ASK mo####gladder.net
- DNS ASK ch###ladder.net
- DNS ASK ra####ladder.net
- DNS ASK mo#####character.net
- DNS ASK ra####character.net
- DNS ASK tw###eenter.net
- DNS ASK mi###eenter.net
- DNS ASK tw###eboard.net
- DNS ASK mi###eboard.net
- DNS ASK tw####ladder.net
- DNS ASK mi####ladder.net
- DNS ASK tw####character.net
- DNS ASK mi####character.net
- DNS ASK st####ewritten.net
- DNS ASK al###enter.net
- DNS ASK al###board.net
- DNS ASK of###board.net
- DNS ASK al###ladder.net
- DNS ASK of###ladder.net
- DNS ASK al####haracter.net
- DNS ASK of####haracter.net
- DNS ASK co####eenter.net
- DNS ASK ch###enter.net
- DNS ASK co####eboard.net
- DNS ASK ch###board.net
- DNS ASK co####eladder.net
- DNS ASK ch####haracter.net
- DNS ASK co#####character.net
- DNS ASK hi####yshore.net
- DNS ASK co####edollar.net
- DNS ASK ch####ritten.net
- DNS ASK co####eshore.net
- DNS ASK ch###shore.net
- DNS ASK pr####trealize.net
- DNS ASK th####ealize.net
- DNS ASK pr####tdollar.net
- DNS ASK th###dollar.net
- DNS ASK pr####twritten.net
- DNS ASK th####ritten.net
- DNS ASK pr####tshore.net
- DNS ASK th###shore.net
- DNS ASK co####ewritten.net
- DNS ASK se####finger.net
- DNS ASK se####shoulder.net
- DNS ASK qu####houlder.net
- DNS ASK se###nabove.net
- DNS ASK qu###above.net
- DNS ASK se###nuntil.net
- DNS ASK qu###until.net
- DNS ASK br###finger.net
- DNS ASK fl###finger.net
- DNS ASK br####houlder.net
- DNS ASK fl####houlder.net
- DNS ASK br###above.net
- DNS ASK qu###finger.net
- DNS ASK mi####written.net
- DNS ASK mo####grealize.net
- DNS ASK ch####ealize.net
- DNS ASK ra####realize.net
- DNS ASK mo####gdollar.net
- DNS ASK ra####dollar.net
- DNS ASK mo####gwritten.net
- DNS ASK ra####written.net
- DNS ASK mo####gshore.net
- DNS ASK ra###rshore.net
- DNS ASK tw####realize.net
- DNS ASK mi####realize.net
- DNS ASK tw####dollar.net
- DNS ASK mi####dollar.net
- DNS ASK st####eshore.net
- DNS ASK tw####written.net
- DNS ASK tw###eshore.net
- DNS ASK mi###eshore.net
- DNS ASK al####ealize.net
- DNS ASK of####ealize.net
- DNS ASK al###dollar.net
- DNS ASK of###dollar.net
- DNS ASK al####ritten.net
- DNS ASK of####ritten.net
- DNS ASK al###shore.net
- DNS ASK of###shore.net
- DNS ASK co####erealize.net
- DNS ASK ch###dollar.net
- DNS ASK ra###rboard.net
Miscellaneous
Creates and executes the following
- 'C:\ecegqbrp\aumywhwp1fyzhuysezi.exe'
- 'C:\ecegqbrp\aeynymalsxcz.exe'
- 'C:\ecegqbrp\fcwrmofgs.exe' "c:\ecegqbrp\aeynymalsxcz.exe"
