Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Solutions DLL Endpoint WinHTTP] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Solutions DLL Endpoint WinHTTP] 'ImagePath' = 'C:\khfofmkitz\twgoemxkhjx.exe'
Creates the following services
- 'Solutions DLL Endpoint WinHTTP' C:\khfofmkitz\twgoemxkhjx.exe
Modifies file system
Creates the following files
- %WINDIR%\khfofmkitz\sv02jl9e
- C:\khfofmkitz\sv02jl9e
- C:\khfofmkitz\rtuhkz9otujftvpujql.exe
- C:\khfofmkitz\twgoemxkhjx.exe
- C:\khfofmkitz\lbjtlwgmtsvb.exe
Sets the 'hidden' attribute to the following files
- C:\khfofmkitz\twgoemxkhjx.exe
- C:\khfofmkitz\lbjtlwgmtsvb.exe
Deletes the following files
- %WINDIR%\khfofmkitz\sv02jl9e
- C:\khfofmkitz\rtuhkz9otujftvpujql.exe
Substitutes the following files
- %WINDIR%\khfofmkitz\sv02jl9e
Network activity
Connects to
- 'th###stream.net':80
- 'ef####business.net':80
- 'jo####ybright.net':80
- 'be####bright.net':80
TCP
HTTP GET requests
- http://th###stream.net/index.php
- http://ef####business.net/index.php
- http://jo####ybright.net/index.php
- http://be####bright.net/index.php
UDP
- DNS ASK de####ybottle.net
- DNS ASK re####ermanner.net
- DNS ASK wo####nother.net
- DNS ASK re####eranother.net
- DNS ASK wo####usiness.net
- DNS ASK re#####rbusiness.net
- DNS ASK wo###appear.net
- DNS ASK re####erappear.net
- DNS ASK de####yexplain.net
- DNS ASK jo####yinstead.net
- DNS ASK jo####yexplain.net
- DNS ASK hu####dexplain.net
- DNS ASK jo####ybright.net
- DNS ASK hu####dbright.net
- DNS ASK jo####yinside.net
- DNS ASK hu####dinside.net
- DNS ASK de####yinstead.net
- DNS ASK in####seappear.net
- DNS ASK wo###manner.net
- DNS ASK hu####dinstead.net
- DNS ASK li####instead.net
- DNS ASK fo####business.net
- DNS ASK su####business.net
- DNS ASK wi####appear.net
- DNS ASK su####appear.net
- DNS ASK ef####manner.net
- DNS ASK th####hmanner.net
- DNS ASK ef####another.net
- DNS ASK th####hanother.net
- DNS ASK ef####business.net
- DNS ASK th####hbusiness.net
- DNS ASK ef####appear.net
- DNS ASK th####happear.net
- DNS ASK fo####manner.net
- DNS ASK in####semanner.net
- DNS ASK fo####another.net
- DNS ASK in####seanother.net
- DNS ASK in#####ebusiness.net
- DNS ASK su####another.net
- DNS ASK fo####appear.net
- DNS ASK hu####dmanner.net
- DNS ASK li####explain.net
- DNS ASK su####explain.net
- DNS ASK su####bright.net
- DNS ASK wi####inside.net
- DNS ASK su####inside.net
- DNS ASK ef####instead.net
- DNS ASK th####hinstead.net
- DNS ASK ef####explain.net
- DNS ASK th####hexplain.net
- DNS ASK de####ybright.net
- DNS ASK ef####bright.net
- DNS ASK ef####inside.net
- DNS ASK th####hinside.net
- DNS ASK fo####instead.net
- DNS ASK in####seinstead.net
- DNS ASK fo####explain.net
- DNS ASK in####seexplain.net
- DNS ASK wi####explain.net
- DNS ASK su####instead.net
- DNS ASK wi####bright.net
- DNS ASK wi####instead.net
- DNS ASK th###inside.net
- DNS ASK li####bright.net
- DNS ASK li####inside.net
- DNS ASK ri####instead.net
- DNS ASK be####instead.net
- DNS ASK ri####explain.net
- DNS ASK be####explain.net
- DNS ASK ri####bright.net
- DNS ASK wi####another.net
- DNS ASK be####bright.net
- DNS ASK wi####business.net
- DNS ASK be####inside.net
- DNS ASK th####nstead.net
- DNS ASK ch####xplain.net
- DNS ASK th####xplain.net
- DNS ASK ch###bright.net
- DNS ASK th###bright.net
- DNS ASK ch###inside.net
- DNS ASK ri####inside.net
- DNS ASK de####yinside.net
- DNS ASK ch####nstead.net
- DNS ASK su####manner.net
- DNS ASK wi####manner.net
- DNS ASK th###appear.net
- DNS ASK su####bottle.net
- DNS ASK wi####divide.net
- DNS ASK su####divide.net
- DNS ASK ef####stream.net
- DNS ASK th####hstream.net
- DNS ASK ef####nothing.net
- DNS ASK th####hnothing.net
- DNS ASK ef####bottle.net
- DNS ASK th####hbottle.net
- DNS ASK ef####divide.net
- DNS ASK th####hdivide.net
- DNS ASK fo####stream.net
- DNS ASK in####sestream.net
- DNS ASK fo####nothing.net
- DNS ASK in####senothing.net
- DNS ASK wi####nothing.net
- DNS ASK wi####stream.net
- DNS ASK wi####bottle.net
- DNS ASK su####stream.net
- DNS ASK th###divide.net
- DNS ASK ri####divide.net
- DNS ASK de####ydivide.net
- DNS ASK li####divide.net
- DNS ASK ri####stream.net
- DNS ASK be####stream.net
- DNS ASK ri####nothing.net
- DNS ASK be####nothing.net
- DNS ASK ri####bottle.net
- DNS ASK fo####bottle.net
- DNS ASK fo####bright.net
- DNS ASK be####bottle.net
- DNS ASK ch###stream.net
- DNS ASK th###stream.net
- DNS ASK ch####othing.net
- DNS ASK th####othing.net
- DNS ASK ch###bottle.net
- DNS ASK th###bottle.net
- DNS ASK ch###divide.net
- DNS ASK li####bottle.net
- DNS ASK be####divide.net
- DNS ASK th####hbright.net
- DNS ASK in####sebottle.net
- DNS ASK re####erstream.net
- DNS ASK ri####manner.net
- DNS ASK be####manner.net
- DNS ASK ri####another.net
- DNS ASK be####another.net
- DNS ASK ri####business.net
- DNS ASK be####business.net
- DNS ASK su####nothing.net
- DNS ASK ri####appear.net
- DNS ASK ch###manner.net
- DNS ASK th###manner.net
- DNS ASK ch####nother.net
- DNS ASK th####nother.net
- DNS ASK ch####usiness.net
- DNS ASK th####usiness.net
- DNS ASK ch###appear.net
- DNS ASK li####business.net
- DNS ASK be####appear.net
- DNS ASK li####appear.net
- DNS ASK de####yappear.net
- DNS ASK de####ybusiness.net
- DNS ASK li####another.net
- DNS ASK wo####othing.net
- DNS ASK re####ernothing.net
- DNS ASK wo###bottle.net
- DNS ASK re####erbottle.net
- DNS ASK wo###divide.net
- DNS ASK re####erdivide.net
- DNS ASK fo####divide.net
- DNS ASK jo####ymanner.net
- DNS ASK in####sedivide.net
- DNS ASK jo####yanother.net
- DNS ASK jo####ybusiness.net
- DNS ASK hu####dbusiness.net
- DNS ASK jo####yappear.net
- DNS ASK hu####dappear.net
- DNS ASK de####ymanner.net
- DNS ASK li####manner.net
- DNS ASK wo###stream.net
- DNS ASK de####yanother.net
- DNS ASK hu####danother.net
- DNS ASK in####sebright.net
Miscellaneous
Creates and executes the following
- 'C:\khfofmkitz\rtuhkz9otujftvpujql.exe'
- 'C:\khfofmkitz\twgoemxkhjx.exe'
- 'C:\khfofmkitz\lbjtlwgmtsvb.exe' "c:\khfofmkitz\twgoemxkhjx.exe"
