Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Remote Copy Filtering Shell] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Remote Copy Filtering Shell] 'ImagePath' = 'C:\sffggaxsysllho\bwcxfcpn.exe'
Creates the following services
- 'Remote Copy Filtering Shell' C:\sffggaxsysllho\bwcxfcpn.exe
Modifies file system
Creates the following files
- %WINDIR%\sffggaxsysllho\wggadjz
- C:\sffggaxsysllho\wggadjz
- C:\sffggaxsysllho\famhybpamuj1qflk.exe
- C:\sffggaxsysllho\bwcxfcpn.exe
- C:\sffggaxsysllho\cykekxrpp.exe
- C:\sffggaxsysllho\bkyjb34pgb
Sets the 'hidden' attribute to the following files
- C:\sffggaxsysllho\bwcxfcpn.exe
- C:\sffggaxsysllho\cykekxrpp.exe
Deletes the following files
- %WINDIR%\sffggaxsysllho\wggadjz
- C:\sffggaxsysllho\famhybpamuj1qflk.exe
Substitutes the following files
- %WINDIR%\sffggaxsysllho\wggadjz
Network activity
Connects to
- 'co####estation.net':80
- 'co####eobject.net':80
- 'of####hildhood.net':80
- 'mo####gstation.net':80
- 'st####eobject.net':80
- 'cl###object.net':80
- 'th###space.net':80
- 'th###travel.net':80
- 'co####espace.net':80
- 'co####etravel.net':80
- 'of###travel.net':80
- 'mi###espace.net':80
TCP
HTTP GET requests
- http://co####estation.net/index.php
- http://co####eobject.net/index.php
- http://of####hildhood.net/index.php
- http://mo####gstation.net/index.php
- http://st####eobject.net/index.php
- http://cl###object.net/index.php
- http://th###space.net/index.php
- http://th###travel.net/index.php
- http://co####espace.net/index.php
- http://co####etravel.net/index.php
UDP
- DNS ASK th###demand.net
- DNS ASK cl####hildhood.net
- DNS ASK cl###object.net
- DNS ASK cl###third.net
- DNS ASK cl####tation.net
- DNS ASK we#####childhood.net
- DNS ASK am####childhood.net
- DNS ASK we####robject.net
- DNS ASK am####object.net
- DNS ASK th###space.net
- DNS ASK we####rthird.net
- DNS ASK we####rstation.net
- DNS ASK am####station.net
- DNS ASK hi#####childhood.net
- DNS ASK st#####childhood.net
- DNS ASK hi####yobject.net
- DNS ASK st####eobject.net
- DNS ASK hi####ythird.net
- DNS ASK st####ethird.net
- DNS ASK am###tthird.net
- DNS ASK pr####tspace.net
- DNS ASK th###travel.net
- DNS ASK pr####ttravel.net
- DNS ASK of###close.net
- DNS ASK al###yellow.net
- DNS ASK of###yellow.net
- DNS ASK al###travel.net
- DNS ASK of###travel.net
- DNS ASK al###space.net
- DNS ASK of###space.net
- DNS ASK co####eclose.net
- DNS ASK ch###close.net
- DNS ASK co####eyellow.net
- DNS ASK ch###yellow.net
- DNS ASK co####etravel.net
- DNS ASK ch###travel.net
- DNS ASK co####espace.net
- DNS ASK ch###space.net
- DNS ASK pr####tclose.net
- DNS ASK th###close.net
- DNS ASK pr####tyellow.net
- DNS ASK th###yellow.net
- DNS ASK hi####ystation.net
- DNS ASK al###close.net
- DNS ASK st####estation.net
- DNS ASK ra####childhood.net
- DNS ASK ch####hildhood.net
- DNS ASK co####eobject.net
- DNS ASK ch###object.net
- DNS ASK co####ethird.net
- DNS ASK ch###third.net
- DNS ASK co####estation.net
- DNS ASK ch####tation.net
- DNS ASK pr#####childhood.net
- DNS ASK co#####childhood.net
- DNS ASK th####hildhood.net
- DNS ASK th###object.net
- DNS ASK pr####tthird.net
- DNS ASK th###third.net
- DNS ASK pr####tstation.net
- DNS ASK th####tation.net
- DNS ASK cl###shout.net
- DNS ASK th###shout.net
- DNS ASK cl###demand.net
- DNS ASK pr####tobject.net
- DNS ASK of####tation.net
- DNS ASK al####tation.net
- DNS ASK of###third.net
- DNS ASK mo####gobject.net
- DNS ASK ra####object.net
- DNS ASK mo####gthird.net
- DNS ASK ra###rthird.net
- DNS ASK mo####gstation.net
- DNS ASK ra####station.net
- DNS ASK tw####childhood.net
- DNS ASK mi####childhood.net
- DNS ASK tw####object.net
- DNS ASK mi####object.net
- DNS ASK tw###ethird.net
- DNS ASK mi###ethird.net
- DNS ASK tw####station.net
- DNS ASK mi####station.net
- DNS ASK al####hildhood.net
- DNS ASK of####hildhood.net
- DNS ASK al###object.net
- DNS ASK of###object.net
- DNS ASK al###third.net
- DNS ASK mo#####childhood.net
- DNS ASK mi###espace.net
Miscellaneous
Creates and executes the following
- 'C:\sffggaxsysllho\famhybpamuj1qflk.exe'
- 'C:\sffggaxsysllho\bwcxfcpn.exe'
- 'C:\sffggaxsysllho\cykekxrpp.exe' "c:\sffggaxsysllho\bwcxfcpn.exe"
