Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Function HomeGroup Now Defender] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Function HomeGroup Now Defender] 'ImagePath' = 'C:\udcvxjkple\snyaica.exe'
Creates the following services
- 'Function HomeGroup Now Defender' C:\udcvxjkple\snyaica.exe
Modifies file system
Creates the following files
- %WINDIR%\udcvxjkple\ylnmnivo
- C:\udcvxjkple\ylnmnivo
- C:\udcvxjkple\w5fpkaar2buo8eyjlqm.exe
- C:\udcvxjkple\snyaica.exe
- C:\udcvxjkple\wnyrkidrccub.exe
- C:\udcvxjkple\lebdhjpsac
Sets the 'hidden' attribute to the following files
- C:\udcvxjkple\snyaica.exe
- C:\udcvxjkple\wnyrkidrccub.exe
Deletes the following files
- %WINDIR%\udcvxjkple\ylnmnivo
- C:\udcvxjkple\w5fpkaar2buo8eyjlqm.exe
Substitutes the following files
- %WINDIR%\udcvxjkple\ylnmnivo
Network activity
Connects to
- 'st####eneral.net':80
- 'do###eclear.net':80
- 'do####general.net':80
- 'st###north.net':80
- 'ev####gbelieve.net':80
- 'st####elieve.net':80
- 'st####thquarter.net':80
- 'bu####nghonor.net':80
- 'bu####ngtrust.net':80
- 'st###trust.net':80
- 'do####system.net':80
TCP
HTTP GET requests
- http://st####eneral.net/index.php
- http://do###eclear.net/index.php
- http://do####general.net/index.php
- http://st###north.net/index.php
- http://ev####gbelieve.net/index.php
- http://st####elieve.net/index.php
- http://st####thquarter.net/index.php
- http://bu####nghonor.net/index.php
- http://bu####ngtrust.net/index.php
- http://st###trust.net/index.php
UDP
- DNS ASK mo####ntclear.net
- DNS ASK fe####believe.net
- DNS ASK fe####receive.net
- DNS ASK fe####quarter.net
- DNS ASK br####branch.net
- DNS ASK re####branch.net
- DNS ASK br####believe.net
- DNS ASK br####receive.net
- DNS ASK de####believe.net
- DNS ASK re####receive.net
- DNS ASK br####quarter.net
- DNS ASK re####quarter.net
- DNS ASK pr####ebranch.net
- DNS ASK de####branch.net
- DNS ASK pr####ebelieve.net
- DNS ASK fe####branch.net
- DNS ASK re####believe.net
- DNS ASK pr####quarter.net
- DNS ASK mi####eceive.net
- DNS ASK ev####gquarter.net
- DNS ASK st###branch.net
- DNS ASK mi###branch.net
- DNS ASK st####elieve.net
- DNS ASK mi####elieve.net
- DNS ASK st####eceive.net
- DNS ASK st####uarter.net
- DNS ASK pr####receive.net
- DNS ASK mi####uarter.net
- DNS ASK do####branch.net
- DNS ASK pr####branch.net
- DNS ASK do####believe.net
- DNS ASK pr####believe.net
- DNS ASK do####receive.net
- DNS ASK do####quarter.net
- DNS ASK mo####ntneither.net
- DNS ASK pr####neither.net
- DNS ASK pr####equarter.net
- DNS ASK ev####gsystem.net
- DNS ASK bu####ngtrust.net
- DNS ASK ev####gtrust.net
- DNS ASK st###honor.net
- DNS ASK mi###honor.net
- DNS ASK st####either.net
- DNS ASK st###system.net
- DNS ASK de####receive.net
- DNS ASK mi###system.net
- DNS ASK st###trust.net
- DNS ASK mi###trust.net
- DNS ASK do###rhonor.net
- DNS ASK pr###yhonor.net
- DNS ASK do####neither.net
- DNS ASK bu####ngsystem.net
- DNS ASK bu####ngquarter.net
- DNS ASK ev####gneither.net
- DNS ASK ou####ehonor.net
- DNS ASK de####quarter.net
- DNS ASK st####thbranch.net
- DNS ASK st####thbelieve.net
- DNS ASK st####threceive.net
- DNS ASK st####thquarter.net
- DNS ASK mo####nthonor.net
- DNS ASK pr####ereceive.net
- DNS ASK ev####ghonor.net
- DNS ASK ou####eneither.net
- DNS ASK mo####ntsystem.net
- DNS ASK ou####esystem.net
- DNS ASK mo####nttrust.net
- DNS ASK ou####etrust.net
- DNS ASK bu####nghonor.net
- DNS ASK bu####ngneither.net
- DNS ASK mi####either.net
- DNS ASK ev####greceive.net
- DNS ASK ou####ebelieve.net
- DNS ASK mi####eneral.net
- DNS ASK st####nclude.net
- DNS ASK mi####nclude.net
- DNS ASK st###north.net
- DNS ASK mi###north.net
- DNS ASK do###rclear.net
- DNS ASK do####general.net
- DNS ASK do###eclear.net
- DNS ASK pr####general.net
- DNS ASK do####include.net
- DNS ASK pr####include.net
- DNS ASK do###rnorth.net
- DNS ASK pr###ynorth.net
- DNS ASK fe###wclear.net
- DNS ASK st####eneral.net
- DNS ASK pr###yclear.net
- DNS ASK mi###clear.net
- DNS ASK ou####enorth.net
- DNS ASK ou####eclear.net
- DNS ASK mo####ntgeneral.net
- DNS ASK ou####egeneral.net
- DNS ASK mo####ntinclude.net
- DNS ASK ou####einclude.net
- DNS ASK mo####ntnorth.net
- DNS ASK bu####ngclear.net
- DNS ASK ev####gnorth.net
- DNS ASK ev####gclear.net
- DNS ASK bu####nggeneral.net
- DNS ASK ev####ggeneral.net
- DNS ASK bu####nginclude.net
- DNS ASK ev####ginclude.net
- DNS ASK bu####ngnorth.net
- DNS ASK st###clear.net
- DNS ASK br###nnorth.net
- DNS ASK ev####gbelieve.net
- DNS ASK fe###wnorth.net
- DNS ASK st####thgeneral.net
- DNS ASK st####thinclude.net
- DNS ASK st####thnorth.net
- DNS ASK mo####ntbranch.net
- DNS ASK ou####ebranch.net
- DNS ASK mo####ntbelieve.net
- DNS ASK mo####ntreceive.net
- DNS ASK fe####include.net
- DNS ASK ou####ereceive.net
- DNS ASK mo####ntquarter.net
- DNS ASK ou####equarter.net
- DNS ASK bu####ngbranch.net
- DNS ASK ev####gbranch.net
- DNS ASK bu####ngbelieve.net
- DNS ASK st####thclear.net
- DNS ASK bu####ngreceive.net
- DNS ASK de###enorth.net
- DNS ASK re####include.net
- DNS ASK do###enorth.net
- DNS ASK br###nclear.net
- DNS ASK re###tclear.net
- DNS ASK br####general.net
- DNS ASK re####general.net
- DNS ASK br####include.net
- DNS ASK fe####general.net
- DNS ASK de####include.net
- DNS ASK re###tnorth.net
- DNS ASK pr####eclear.net
- DNS ASK de###eclear.net
- DNS ASK pr####egeneral.net
- DNS ASK de####general.net
- DNS ASK pr####einclude.net
- DNS ASK pr####enorth.net
- DNS ASK do####system.net
Miscellaneous
Creates and executes the following
- 'C:\udcvxjkple\w5fpkaar2buo8eyjlqm.exe'
- 'C:\udcvxjkple\snyaica.exe'
- 'C:\udcvxjkple\wnyrkidrccub.exe' "c:\udcvxjkple\snyaica.exe"
