Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Process Copy Background Information] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Process Copy Background Information] 'ImagePath' = 'C:\sblvmdqv\pmiaxdraitt.exe'
Creates the following services
- 'Process Copy Background Information' C:\sblvmdqv\pmiaxdraitt.exe
Modifies file system
Creates the following files
- %WINDIR%\sblvmdqv\ofaj5efk
- C:\sblvmdqv\ofaj5efk
- C:\sblvmdqv\kfs6fuz9nz9wjae1.exe
- C:\sblvmdqv\pmiaxdraitt.exe
- C:\sblvmdqv\bjespvl.exe
- C:\sblvmdqv\c6mrjq
Sets the 'hidden' attribute to the following files
- C:\sblvmdqv\pmiaxdraitt.exe
- C:\sblvmdqv\bjespvl.exe
Deletes the following files
- %WINDIR%\sblvmdqv\ofaj5efk
- C:\sblvmdqv\kfs6fuz9nz9wjae1.exe
Substitutes the following files
- %WINDIR%\sblvmdqv\ofaj5efk
Network activity
Connects to
- 'do###espeak.net':80
- 'pr####eoclock.net':80
- 'wh####rbehind.net':80
- 'wh####rbutter.net':80
- 'fo####ndried.net':80
TCP
HTTP GET requests
- http://do###espeak.net/index.php
- http://pr####eoclock.net/index.php
- http://wh####rbehind.net/index.php
- http://wh####rbutter.net/index.php
- http://fo####ndried.net/index.php
UDP
- DNS ASK do###rniece.net
- DNS ASK en####hbroad.net
- DNS ASK ei####behind.net
- DNS ASK en####hbehind.net
- DNS ASK ei####butter.net
- DNS ASK en####hbutter.net
- DNS ASK ex###tdried.net
- DNS ASK be####edried.net
- DNS ASK ex####fifteen.net
- DNS ASK be####efifteen.net
- DNS ASK ex###tangry.net
- DNS ASK be####eangry.net
- DNS ASK ex####article.net
- DNS ASK be####earticle.net
- DNS ASK pe###ndried.net
- DNS ASK ma####edried.net
- DNS ASK ei###rbroad.net
- DNS ASK pe####fifteen.net
- DNS ASK en#####understand.net
- DNS ASK fa####butter.net
- DNS ASK pi#####understand.net
- DNS ASK ci#####teunderstand.net
- DNS ASK pi####ebroad.net
- DNS ASK ci####ttebroad.net
- DNS ASK pi####ebehind.net
- DNS ASK ci####ttebehind.net
- DNS ASK pi####ebutter.net
- DNS ASK ci####ttebutter.net
- DNS ASK ch#####nunderstand.net
- DNS ASK fa#####nderstand.net
- DNS ASK ch####enbroad.net
- DNS ASK fa###ybroad.net
- DNS ASK ch####enbehind.net
- DNS ASK fa####behind.net
- DNS ASK ch####enbutter.net
- DNS ASK ei#####nderstand.net
- DNS ASK wh####rarticle.net
- DNS ASK ch####endried.net
- DNS ASK ma####eangry.net
- DNS ASK th###hdried.net
- DNS ASK fi####fifteen.net
- DNS ASK th####fifteen.net
- DNS ASK fi###eangry.net
- DNS ASK th###hangry.net
- DNS ASK fi####article.net
- DNS ASK th####article.net
- DNS ASK pi####edried.net
- DNS ASK ci####ttedried.net
- DNS ASK pi####efifteen.net
- DNS ASK ci#####tefifteen.net
- DNS ASK pi####eangry.net
- DNS ASK ci####tteangry.net
- DNS ASK pi####earticle.net
- DNS ASK ci#####tearticle.net
- DNS ASK fi###edried.net
- DNS ASK th####butter.net
- DNS ASK ri####rticle.net
- DNS ASK ri###angry.net
- DNS ASK pe####article.net
- DNS ASK ma####earticle.net
- DNS ASK su###ndried.net
- DNS ASK fo####ndried.net
- DNS ASK su####fifteen.net
- DNS ASK fo####nfifteen.net
- DNS ASK su###nangry.net
- DNS ASK fo####nangry.net
- DNS ASK su####article.net
- DNS ASK fo####narticle.net
- DNS ASK wh####rdried.net
- DNS ASK ri###dried.net
- DNS ASK wh####rfifteen.net
- DNS ASK ri####ifteen.net
- DNS ASK wh####rangry.net
- DNS ASK ma####efifteen.net
- DNS ASK pe###nangry.net
- DNS ASK fi####butter.net
- DNS ASK ex#####nderstand.net
- DNS ASK re####oclock.net
- DNS ASK pr####espeak.net
- DNS ASK de###espeak.net
- DNS ASK pr####eniece.net
- DNS ASK de###eniece.net
- DNS ASK pr####ewrite.net
- DNS ASK de###ewrite.net
- DNS ASK pr####eoclock.net
- DNS ASK de####oclock.net
- DNS ASK st####thspeak.net
- DNS ASK st###speak.net
- DNS ASK st####thniece.net
- DNS ASK st###niece.net
- DNS ASK st####thwrite.net
- DNS ASK st###write.net
- DNS ASK br####oclock.net
- DNS ASK st####thoclock.net
- DNS ASK re###twrite.net
- DNS ASK re###tniece.net
- DNS ASK pr###yniece.net
- DNS ASK do###rwrite.net
- DNS ASK pr###ywrite.net
- DNS ASK do####oclock.net
- DNS ASK pr####oclock.net
- DNS ASK fe###wspeak.net
- DNS ASK do###espeak.net
- DNS ASK fe###wniece.net
- DNS ASK do###eniece.net
- DNS ASK fe###wwrite.net
- DNS ASK do###ewrite.net
- DNS ASK fe####oclock.net
- DNS ASK br###nspeak.net
- DNS ASK re###tspeak.net
- DNS ASK br###nniece.net
- DNS ASK br###nwrite.net
- DNS ASK su###nbroad.net
- DNS ASK fi####behind.net
- DNS ASK be#####understand.net
- DNS ASK fo####nbehind.net
- DNS ASK su####butter.net
- DNS ASK fo####nbutter.net
- DNS ASK wh#####understand.net
- DNS ASK ri####nderstand.net
- DNS ASK wh####rbroad.net
- DNS ASK ri###broad.net
- DNS ASK wh####rbehind.net
- DNS ASK ri###behind.net
- DNS ASK wh####rbutter.net
- DNS ASK ri###butter.net
- DNS ASK fi#####nderstand.net
- DNS ASK th#####nderstand.net
- DNS ASK fi###ebroad.net
- DNS ASK th###hbroad.net
- DNS ASK su####behind.net
- DNS ASK th####behind.net
- DNS ASK fo####nbroad.net
- DNS ASK fo#####understand.net
- DNS ASK ex###tbroad.net
- DNS ASK be####ebroad.net
- DNS ASK ex####behind.net
- DNS ASK be####ebehind.net
- DNS ASK ex####butter.net
- DNS ASK be####ebutter.net
- DNS ASK pe#####nderstand.net
- DNS ASK ma#####understand.net
- DNS ASK pe###nbroad.net
- DNS ASK ma####ebroad.net
- DNS ASK pe####behind.net
- DNS ASK ma####ebehind.net
- DNS ASK pe####butter.net
- DNS ASK ma####ebutter.net
- DNS ASK su#####nderstand.net
- DNS ASK st###oclock.net
- DNS ASK fa###ydried.net
Miscellaneous
Creates and executes the following
- 'C:\sblvmdqv\kfs6fuz9nz9wjae1.exe'
- 'C:\sblvmdqv\pmiaxdraitt.exe'
- 'C:\sblvmdqv\bjespvl.exe' "c:\sblvmdqv\pmiaxdraitt.exe"
