Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\TPM Firewall Shadow IP Gateway] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\TPM Firewall Shadow IP Gateway] 'ImagePath' = 'C:\jhjdxpifwuvy\ggbtvylwg.exe'
Creates the following services
- 'TPM Firewall Shadow IP Gateway' C:\jhjdxpifwuvy\ggbtvylwg.exe
Modifies file system
Creates the following files
- %WINDIR%\jhjdxpifwuvy\zkgb07c
- C:\jhjdxpifwuvy\zkgb07c
- C:\jhjdxpifwuvy\mh8lh5mvmbmzhwcuuo.exe
- C:\jhjdxpifwuvy\ggbtvylwg.exe
- C:\jhjdxpifwuvy\edaamao.exe
- C:\jhjdxpifwuvy\nqsmzfcznna
Sets the 'hidden' attribute to the following files
- C:\jhjdxpifwuvy\ggbtvylwg.exe
- C:\jhjdxpifwuvy\edaamao.exe
Deletes the following files
- %WINDIR%\jhjdxpifwuvy\zkgb07c
- C:\jhjdxpifwuvy\mh8lh5mvmbmzhwcuuo.exe
Substitutes the following files
- %WINDIR%\jhjdxpifwuvy\zkgb07c
Network activity
Connects to
- 're####corner.net':80
- 'st####flower.net':80
- 'st####corner.net':80
- 'br###corner.net':80
- 'qu###flower.net':80
- 'se####flower.net':80
- 'qu###corner.net':80
- 'ag####tstranger.net':80
- 'tr####dvance.net':80
- 'be####fortieth.net':80
- 'de####problem.net':80
- 'ca####nescape.net':80
TCP
HTTP GET requests
- http://re####corner.net/index.php
- http://st####corner.net/index.php
- http://br###corner.net/index.php
- http://qu###flower.net/index.php
- http://se####flower.net/index.php
- http://qu###corner.net/index.php
- http://ag####tstranger.net/index.php
- http://tr####dvance.net/index.php
- http://be####fortieth.net/index.php
- http://de####problem.net/index.php
- http://ca####nescape.net/index.php
UDP
- DNS ASK ag####tflower.net
- DNS ASK st####stranger.net
- DNS ASK tr####tranger.net
- DNS ASK st####goodbye.net
- DNS ASK tr####oodbye.net
- DNS ASK st####fortieth.net
- DNS ASK tr####ortieth.net
- DNS ASK be####advance.net
- DNS ASK ga####advance.net
- DNS ASK be####stranger.net
- DNS ASK ga####stranger.net
- DNS ASK be####goodbye.net
- DNS ASK ga####goodbye.net
- DNS ASK be####fortieth.net
- DNS ASK ga####fortieth.net
- DNS ASK fl####dvance.net
- DNS ASK tr####dvance.net
- DNS ASK de####goodbye.net
- DNS ASK st####advance.net
- DNS ASK re####fortieth.net
- DNS ASK de####fortieth.net
- DNS ASK la####dvance.net
- DNS ASK ca####nadvance.net
- DNS ASK la####tranger.net
- DNS ASK ca####nstranger.net
- DNS ASK la####oodbye.net
- DNS ASK ca####ngoodbye.net
- DNS ASK la####ortieth.net
- DNS ASK ca####nfortieth.net
- DNS ASK re####advance.net
- DNS ASK el####icadvance.net
- DNS ASK re####stranger.net
- DNS ASK el#####cstranger.net
- DNS ASK re####goodbye.net
- DNS ASK el####icgoodbye.net
- DNS ASK el#####cfortieth.net
- DNS ASK ni####ortieth.net
- DNS ASK br####dvance.net
- DNS ASK br####oodbye.net
- DNS ASK ni###escape.net
- DNS ASK de####escape.net
- DNS ASK ni###animal.net
- DNS ASK de####animal.net
- DNS ASK ni####roblem.net
- DNS ASK de####problem.net
- DNS ASK ga####corner.net
- DNS ASK ni###modern.net
- DNS ASK la###escape.net
- DNS ASK ca####nescape.net
- DNS ASK la###animal.net
- DNS ASK ca####nanimal.net
- DNS ASK la####roblem.net
- DNS ASK ca####nproblem.net
- DNS ASK ag####tmodern.net
- DNS ASK do###modern.net
- DNS ASK br####tranger.net
- DNS ASK fl####tranger.net
- DNS ASK do###animal.net
- DNS ASK fl####ortieth.net
- DNS ASK br####ortieth.net
- DNS ASK qu####dvance.net
- DNS ASK se####advance.net
- DNS ASK qu####tranger.net
- DNS ASK se####stranger.net
- DNS ASK qu####oodbye.net
- DNS ASK se####goodbye.net
- DNS ASK qu####ortieth.net
- DNS ASK se####fortieth.net
- DNS ASK ag####tescape.net
- DNS ASK do###escape.net
- DNS ASK ag####tanimal.net
- DNS ASK ag####tproblem.net
- DNS ASK fl####oodbye.net
- DNS ASK do####roblem.net
- DNS ASK ni####oodbye.net
- DNS ASK de####stranger.net
- DNS ASK ni####tranger.net
- DNS ASK ca####nspecial.net
- DNS ASK la###corner.net
- DNS ASK ca####ncorner.net
- DNS ASK re####flower.net
- DNS ASK el####icflower.net
- DNS ASK re####minute.net
- DNS ASK el####icminute.net
- DNS ASK re####special.net
- DNS ASK el####icspecial.net
- DNS ASK re####corner.net
- DNS ASK el####iccorner.net
- DNS ASK st####flower.net
- DNS ASK tr###flower.net
- DNS ASK st####minute.net
- DNS ASK ca####nminute.net
- DNS ASK tr###minute.net
- DNS ASK la###minute.net
- DNS ASK la###flower.net
- DNS ASK do###flower.net
- DNS ASK ag####tminute.net
- DNS ASK do###minute.net
- DNS ASK ag####tspecial.net
- DNS ASK do####pecial.net
- DNS ASK ag####tcorner.net
- DNS ASK do###corner.net
- DNS ASK ni###flower.net
- DNS ASK de####flower.net
- DNS ASK ni###minute.net
- DNS ASK de####minute.net
- DNS ASK ni####pecial.net
- DNS ASK de####special.net
- DNS ASK ni###corner.net
- DNS ASK de####corner.net
- DNS ASK ca####nflower.net
- DNS ASK st####special.net
- DNS ASK la####pecial.net
- DNS ASK tr####pecial.net
- DNS ASK se####minute.net
- DNS ASK se####special.net
- DNS ASK qu###corner.net
- DNS ASK se####corner.net
- DNS ASK ag####tadvance.net
- DNS ASK do####dvance.net
- DNS ASK ag####tstranger.net
- DNS ASK do####tranger.net
- DNS ASK ag####tgoodbye.net
- DNS ASK do####oodbye.net
- DNS ASK ag####tfortieth.net
- DNS ASK do####ortieth.net
- DNS ASK ni####dvance.net
- DNS ASK de####advance.net
- DNS ASK qu###minute.net
- DNS ASK qu###flower.net
- DNS ASK qu####pecial.net
- DNS ASK se####flower.net
- DNS ASK br###corner.net
- DNS ASK st####corner.net
- DNS ASK be####flower.net
- DNS ASK ga####flower.net
- DNS ASK be####minute.net
- DNS ASK ga####minute.net
- DNS ASK be####special.net
- DNS ASK ga####special.net
- DNS ASK la###modern.net
- DNS ASK de####modern.net
- DNS ASK be####corner.net
- DNS ASK br###flower.net
- DNS ASK fl###minute.net
- DNS ASK br###minute.net
- DNS ASK fl####pecial.net
- DNS ASK br####pecial.net
- DNS ASK fl###corner.net
- DNS ASK tr###corner.net
- DNS ASK fl###flower.net
- DNS ASK ca####nmodern.net
Miscellaneous
Creates and executes the following
- 'C:\jhjdxpifwuvy\mh8lh5mvmbmzhwcuuo.exe'
- 'C:\jhjdxpifwuvy\ggbtvylwg.exe'
- 'C:\jhjdxpifwuvy\edaamao.exe' "c:\jhjdxpifwuvy\ggbtvylwg.exe"
