Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\List Background Helper Group Computer] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\List Background Helper Group Computer] 'ImagePath' = 'C:\ywsnxaulne\bcsjwvdglaq.exe'
Creates the following services
- 'List Background Helper Group Computer' C:\ywsnxaulne\bcsjwvdglaq.exe
Modifies file system
Creates the following files
- %WINDIR%\ywsnxaulne\b8nwoomp
- C:\ywsnxaulne\b8nwoomp
- C:\ywsnxaulne\ptzlnxosnoriwhdwuvdlm.exe
- C:\ywsnxaulne\bcsjwvdglaq.exe
- C:\ywsnxaulne\vvsisrxp.exe
Sets the 'hidden' attribute to the following files
- C:\ywsnxaulne\bcsjwvdglaq.exe
- C:\ywsnxaulne\vvsisrxp.exe
Deletes the following files
- %WINDIR%\ywsnxaulne\b8nwoomp
- C:\ywsnxaulne\ptzlnxosnoriwhdwuvdlm.exe
Substitutes the following files
- %WINDIR%\ywsnxaulne\b8nwoomp
Network activity
Connects to
- 'li####health.net':80
- 'ch####lothes.net':80
- 'wi####health.net':80
- 'su####clothes.net':80
- 'in####sehealth.net':80
- 're####erhealth.net':80
- 'li###edress.net':80
- 'in####sedress.net':80
TCP
HTTP GET requests
- http://li####health.net/index.php
- http://ch####lothes.net/index.php
- http://wi####health.net/index.php
- http://su####clothes.net/index.php
- http://re####erhealth.net/index.php
- http://li###edress.net/index.php
- http://in####sedress.net/index.php
UDP
- DNS ASK de####yseparate.net
- DNS ASK th###catch.net
- DNS ASK ch###catch.net
- DNS ASK be###gdress.net
- DNS ASK ri###ndress.net
- DNS ASK be####public.net
- DNS ASK ri####public.net
- DNS ASK be####eearly.net
- DNS ASK ri####eearly.net
- DNS ASK be###gcatch.net
- DNS ASK ri###ncatch.net
- DNS ASK li###edress.net
- DNS ASK ch###eearly.net
- DNS ASK de####ydress.net
- DNS ASK de####ypublic.net
- DNS ASK li####eearly.net
- DNS ASK de####yeearly.net
- DNS ASK li###ecatch.net
- DNS ASK de####ycatch.net
- DNS ASK hu####ddress.net
- DNS ASK jo####ydress.net
- DNS ASK hu####dpublic.net
- DNS ASK jo####ypublic.net
- DNS ASK hu####deearly.net
- DNS ASK jo####yeearly.net
- DNS ASK li####public.net
- DNS ASK th###eearly.net
- DNS ASK ch###public.net
- DNS ASK th###public.net
- DNS ASK fo###tdress.net
- DNS ASK in####sepublic.net
- DNS ASK fo####public.net
- DNS ASK in####seeearly.net
- DNS ASK fo####eearly.net
- DNS ASK in####secatch.net
- DNS ASK fo###tcatch.net
- DNS ASK th####hdress.net
- DNS ASK ef###tdress.net
- DNS ASK th####hpublic.net
- DNS ASK ef####public.net
- DNS ASK th####heearly.net
- DNS ASK ef####eearly.net
- DNS ASK th####hcatch.net
- DNS ASK ef###tcatch.net
- DNS ASK su###rdress.net
- DNS ASK wi###ndress.net
- DNS ASK su####public.net
- DNS ASK wi####public.net
- DNS ASK su####eearly.net
- DNS ASK wi####eearly.net
- DNS ASK su###rcatch.net
- DNS ASK wi###ncatch.net
- DNS ASK th###dress.net
- DNS ASK ch###dress.net
- DNS ASK hu####dcatch.net
- DNS ASK in####sedress.net
- DNS ASK jo####ycatch.net
- DNS ASK wo####istant.net
- DNS ASK wi####separate.net
- DNS ASK th####istant.net
- DNS ASK ch####istant.net
- DNS ASK th####lothes.net
- DNS ASK ch####lothes.net
- DNS ASK th###health.net
- DNS ASK ch###health.net
- DNS ASK th####eparate.net
- DNS ASK ch####eparate.net
- DNS ASK be####distant.net
- DNS ASK ri####distant.net
- DNS ASK su####separate.net
- DNS ASK be####clothes.net
- DNS ASK be####health.net
- DNS ASK ri####health.net
- DNS ASK be####separate.net
- DNS ASK ri####separate.net
- DNS ASK li####distant.net
- DNS ASK de####ydistant.net
- DNS ASK li####clothes.net
- DNS ASK de####yclothes.net
- DNS ASK li####health.net
- DNS ASK de####yhealth.net
- DNS ASK li####separate.net
- DNS ASK ri####clothes.net
- DNS ASK wi####health.net
- DNS ASK su####health.net
- DNS ASK wi####clothes.net
- DNS ASK re####erclothes.net
- DNS ASK wo####lothes.net
- DNS ASK re####erhealth.net
- DNS ASK wo###health.net
- DNS ASK re#####rseparate.net
- DNS ASK wo####eparate.net
- DNS ASK in####sedistant.net
- DNS ASK fo####distant.net
- DNS ASK in####seclothes.net
- DNS ASK fo####clothes.net
- DNS ASK in####sehealth.net
- DNS ASK fo####health.net
- DNS ASK in#####eseparate.net
- DNS ASK fo####separate.net
- DNS ASK th####hdistant.net
- DNS ASK ef####distant.net
- DNS ASK th####hclothes.net
- DNS ASK ef####clothes.net
- DNS ASK th####hhealth.net
- DNS ASK ef####health.net
- DNS ASK th####hseparate.net
- DNS ASK ef####separate.net
- DNS ASK su####distant.net
- DNS ASK wi####distant.net
- DNS ASK su####clothes.net
- DNS ASK re####erdistant.net
- DNS ASK wo###catch.net
Miscellaneous
Creates and executes the following
- 'C:\ywsnxaulne\ptzlnxosnoriwhdwuvdlm.exe'
- 'C:\ywsnxaulne\bcsjwvdglaq.exe'
- 'C:\ywsnxaulne\vvsisrxp.exe' "c:\ywsnxaulne\bcsjwvdglaq.exe"
