Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Accounts Storage Peer Windows Now Color Shadow] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Accounts Storage Peer Windows Now Color Shadow] 'ImagePath' = 'C:\ohoxcczkwsglqx\yccclaebo.exe'
Creates the following services
- 'Accounts Storage Peer Windows Now Color Shadow' C:\ohoxcczkwsglqx\yccclaebo.exe
Modifies file system
Creates the following files
- %WINDIR%\ohoxcczkwsglqx\oqne3ztvxdmb
- C:\ohoxcczkwsglqx\oqne3ztvxdmb
- C:\ohoxcczkwsglqx\h3u18unhzqllijtlttf.exe
- C:\ohoxcczkwsglqx\yccclaebo.exe
- C:\ohoxcczkwsglqx\aymtlzzct.exe
- C:\ohoxcczkwsglqx\bsx0oy
Sets the 'hidden' attribute to the following files
- C:\ohoxcczkwsglqx\yccclaebo.exe
- C:\ohoxcczkwsglqx\aymtlzzct.exe
Deletes the following files
- %WINDIR%\ohoxcczkwsglqx\oqne3ztvxdmb
- C:\ohoxcczkwsglqx\h3u18unhzqllijtlttf.exe
Substitutes the following files
- %WINDIR%\ohoxcczkwsglqx\oqne3ztvxdmb
Network activity
Connects to
- 'de####daughter.net':80
- 'fo####ddaughter.net':80
- 'di####ultpeople.net':80
- 'di#####ltdaughter.net':80
- 'le###rready.net':80
- 'ge####people.net':80
- 'fo####dnation.net':80
- 'de####soldier.net':80
- 'gl###nation.net':80
- 'pl####ntplease.net':80
- 'he####nation.net':80
- 'va####snation.net':80
- 'de###epower.net':80
TCP
HTTP GET requests
- http://de####daughter.net/index.php
- http://fo####ddaughter.net/index.php
- http://di####ultpeople.net/index.php
- http://di#####ltdaughter.net/index.php
- http://le###rready.net/index.php
- http://ge####people.net/index.php
- http://fo####dnation.net/index.php
- http://de####soldier.net/index.php
- http://gl###nation.net/index.php
- http://pl####ntplease.net/index.php
- http://he####nation.net/index.php
- http://va####snation.net/index.php
UDP
- DNS ASK he####xplain.net
- DNS ASK an####condition.net
- DNS ASK gl####ondition.net
- DNS ASK di####ultnation.net
- DNS ASK he###nation.net
- DNS ASK di#####ltsoldier.net
- DNS ASK he####oldier.net
- DNS ASK he###please.net
- DNS ASK de####please.net
- DNS ASK di#####ltcondition.net
- DNS ASK he####ondition.net
- DNS ASK pl####ntnation.net
- DNS ASK ne####arynation.net
- DNS ASK pl####ntsoldier.net
- DNS ASK ne#####rysoldier.net
- DNS ASK gl###please.net
- DNS ASK an####please.net
- DNS ASK gl####oldier.net
- DNS ASK an####soldier.net
- DNS ASK gl###nation.net
- DNS ASK an####nation.net
- DNS ASK fo#####condition.net
- DNS ASK de####condition.net
- DNS ASK fo####dplease.net
- DNS ASK di####ultplease.net
- DNS ASK fo####dsoldier.net
- DNS ASK de####soldier.net
- DNS ASK fo####dnation.net
- DNS ASK de####nation.net
- DNS ASK re####daughter.net
- DNS ASK va####sdaughter.net
- DNS ASK re####people.net
- DNS ASK pl####ntplease.net
- DNS ASK re#####condition.net
- DNS ASK fo####dfamous.net
- DNS ASK ne#####rycondition.net
- DNS ASK ge####soldier.net
- DNS ASK ge####please.net
- DNS ASK ge####condition.net
- DNS ASK va####snation.net
- DNS ASK re####nation.net
- DNS ASK va####ssoldier.net
- DNS ASK va####splease.net
- DNS ASK ne####aryplease.net
- DNS ASK re####please.net
- DNS ASK va#####condition.net
- DNS ASK re####condition.net
- DNS ASK de####century.net
- DNS ASK fo####dcentury.net
- DNS ASK de####famous.net
- DNS ASK ge####nation.net
- DNS ASK he####condition.net
- DNS ASK le####condition.net
- DNS ASK he####please.net
- DNS ASK le####please.net
- DNS ASK he####soldier.net
- DNS ASK le####soldier.net
- DNS ASK he####nation.net
- DNS ASK le####nation.net
- DNS ASK va####speople.net
- DNS ASK or####ondition.net
- DNS ASK re####eplease.net
- DNS ASK or###please.net
- DNS ASK re####esoldier.net
- DNS ASK or####oldier.net
- DNS ASK re####enation.net
- DNS ASK or###nation.net
- DNS ASK pl#####tcondition.net
- DNS ASK re####soldier.net
- DNS ASK re###nbrown.net
- DNS ASK he####people.net
- DNS ASK de####people.net
- DNS ASK fo####dpeople.net
- DNS ASK de####daughter.net
- DNS ASK fo####ddaughter.net
- DNS ASK an###rready.net
- DNS ASK gl###ready.net
- DNS ASK gl###brown.net
- DNS ASK va####s##plain.net
- DNS ASK an####people.net
- DNS ASK gl###people.net
- DNS ASK an####daughter.net
- DNS ASK gl####aughter.net
- DNS ASK di####ultready.net
- DNS ASK he###ready.net
- DNS ASK fo####dbrown.net
- DNS ASK de###ebrown.net
- DNS ASK fo####dready.net
- DNS ASK de###eready.net
- DNS ASK re####inside.net
- DNS ASK va####sinside.net
- DNS ASK re####bright.net
- DNS ASK va####sbright.net
- DNS ASK re####explain.net
- DNS ASK an###rbrown.net
- DNS ASK re####instead.net
- DNS ASK va####sinstead.net
- DNS ASK ge####inside.net
- DNS ASK he###inside.net
- DNS ASK ge####bright.net
- DNS ASK he###bright.net
- DNS ASK ge####explain.net
- DNS ASK di####ultbrown.net
- DNS ASK ne####arypeople.net
- DNS ASK re###nready.net
- DNS ASK he###people.net
- DNS ASK re####edaughter.net
- DNS ASK le###rready.net
- DNS ASK he###nready.net
- DNS ASK le###rbrown.net
- DNS ASK he###nbrown.net
- DNS ASK le####people.net
- DNS ASK le####daughter.net
- DNS ASK he###brown.net
- DNS ASK he####daughter.net
- DNS ASK ge###eready.net
- DNS ASK ge###ebrown.net
- DNS ASK ge####people.net
- DNS ASK ge####daughter.net
- DNS ASK va####sready.net
- DNS ASK or####aughter.net
- DNS ASK re####epeople.net
- DNS ASK or###people.net
- DNS ASK re####ebrown.net
- DNS ASK or###brown.net
- DNS ASK re####eready.net
- DNS ASK or###ready.net
- DNS ASK ne#####rydaughter.net
- DNS ASK pl#####tdaughter.net
- DNS ASK va####sbrown.net
- DNS ASK pl####ntpeople.net
- DNS ASK ne####arybrown.net
- DNS ASK pl####ntbrown.net
- DNS ASK ne####aryready.net
- DNS ASK pl####ntready.net
- DNS ASK he####aughter.net
- DNS ASK di#####ltdaughter.net
- DNS ASK di####ultpeople.net
- DNS ASK de###epower.net
Miscellaneous
Creates and executes the following
- 'C:\ohoxcczkwsglqx\h3u18unhzqllijtlttf.exe'
- 'C:\ohoxcczkwsglqx\yccclaebo.exe'
- 'C:\ohoxcczkwsglqx\aymtlzzct.exe' "c:\ohoxcczkwsglqx\yccclaebo.exe"
