Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Management Resource Publication Logs] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Management Resource Publication Logs] 'ImagePath' = 'C:\kmllbneuaynlzwr\htvgwnfwbzy.exe'
Creates the following services
- 'Management Resource Publication Logs' C:\kmllbneuaynlzwr\htvgwnfwbzy.exe
Modifies file system
Creates the following files
- %WINDIR%\kmllbneuaynlzwr\golfq4kw
- C:\kmllbneuaynlzwr\golfq4kw
- C:\kmllbneuaynlzwr\woaqi59tyqdg8vg6h.exe
- C:\kmllbneuaynlzwr\htvgwnfwbzy.exe
- C:\kmllbneuaynlzwr\hgifgduvx.exe
Sets the 'hidden' attribute to the following files
- C:\kmllbneuaynlzwr\htvgwnfwbzy.exe
- C:\kmllbneuaynlzwr\hgifgduvx.exe
Deletes the following files
- %WINDIR%\kmllbneuaynlzwr\golfq4kw
- C:\kmllbneuaynlzwr\woaqi59tyqdg8vg6h.exe
Substitutes the following files
- %WINDIR%\kmllbneuaynlzwr\golfq4kw
Network activity
Connects to
- 'wa####ndustry.net':80
- 'wo####ndustry.net':80
- 'pa####ndustry.net':80
- 'pa###became.net':80
- 'ex#####ncelanguage.net':80
- 'kn###before.net':80
- 'wa####anguage.net':80
TCP
HTTP GET requests
- http://wa####ndustry.net/index.php
- http://wo####ndustry.net/index.php
- http://pa####ndustry.net/index.php
- http://pa###became.net/index.php
- http://ex#####ncelanguage.net/index.php
- http://kn###before.net/index.php
- http://wa####anguage.net/index.php
UDP
- DNS ASK al####ycontain.net
- DNS ASK kn####anguage.net
- DNS ASK be####anguage.net
- DNS ASK kn###settle.net
- DNS ASK be###settle.net
- DNS ASK me####before.net
- DNS ASK fo####before.net
- DNS ASK me####device.net
- DNS ASK fo####device.net
- DNS ASK me####language.net
- DNS ASK fo####language.net
- DNS ASK me####settle.net
- DNS ASK fo####settle.net
- DNS ASK al####ybefore.net
- DNS ASK ge####manbefore.net
- DNS ASK al####ydevice.net
- DNS ASK ge####mandevice.net
- DNS ASK al####ylanguage.net
- DNS ASK ge#####anlanguage.net
- DNS ASK al####ysettle.net
- DNS ASK ge####mansettle.net
- DNS ASK ex#####ncebefore.net
- DNS ASK fr###before.net
- DNS ASK ex#####ncedevice.net
- DNS ASK be###device.net
- DNS ASK kn###device.net
- DNS ASK be###before.net
- DNS ASK kn###before.net
- DNS ASK sm###before.net
- DNS ASK wo###before.net
- DNS ASK sm###device.net
- DNS ASK wo###device.net
- DNS ASK sm####anguage.net
- DNS ASK wo####anguage.net
- DNS ASK sm###settle.net
- DNS ASK wo###settle.net
- DNS ASK wa###before.net
- DNS ASK th####tbefore.net
- DNS ASK wa###device.net
- DNS ASK wa####anguage.net
- DNS ASK th####tdevice.net
- DNS ASK th####tlanguage.net
- DNS ASK wa###settle.net
- DNS ASK th####tsettle.net
- DNS ASK cr###before.net
- DNS ASK su####before.net
- DNS ASK cr###device.net
- DNS ASK su####device.net
- DNS ASK cr####anguage.net
- DNS ASK su####language.net
- DNS ASK cr###settle.net
- DNS ASK su####settle.net
- DNS ASK pa###settle.net
- DNS ASK fr###device.net
- DNS ASK ex#####ncelanguage.net
- DNS ASK fr####anguage.net
- DNS ASK su####contain.net
- DNS ASK cr###became.net
- DNS ASK su####became.net
- DNS ASK cr####ndustry.net
- DNS ASK su####industry.net
- DNS ASK kn###basket.net
- DNS ASK be###basket.net
- DNS ASK kn####ontain.net
- DNS ASK be####ontain.net
- DNS ASK kn###became.net
- DNS ASK be###became.net
- DNS ASK kn####ndustry.net
- DNS ASK be####ndustry.net
- DNS ASK me####basket.net
- DNS ASK fo####basket.net
- DNS ASK me####contain.net
- DNS ASK fo####contain.net
- DNS ASK me####became.net
- DNS ASK fo####became.net
- DNS ASK me####industry.net
- DNS ASK fo####industry.net
- DNS ASK al####ybasket.net
- DNS ASK ge####manbasket.net
- DNS ASK cr####ontain.net
- DNS ASK su####basket.net
- DNS ASK cr###basket.net
- DNS ASK th####tindustry.net
- DNS ASK fr###settle.net
- DNS ASK fi###basket.net
- DNS ASK pa###basket.net
- DNS ASK fi####ontain.net
- DNS ASK pa####ontain.net
- DNS ASK fi###became.net
- DNS ASK pa###became.net
- DNS ASK fi####ndustry.net
- DNS ASK pa####ndustry.net
- DNS ASK sm###basket.net
- DNS ASK wo###basket.net
- DNS ASK wo####ontain.net
- DNS ASK sm####ontain.net
- DNS ASK sm###became.net
- DNS ASK wo###became.net
- DNS ASK sm####ndustry.net
- DNS ASK wo####ndustry.net
- DNS ASK wa###basket.net
- DNS ASK th####tbasket.net
- DNS ASK wa####ontain.net
- DNS ASK th####tcontain.net
- DNS ASK wa###became.net
- DNS ASK th####tbecame.net
- DNS ASK wa####ndustry.net
- DNS ASK ex#####ncesettle.net
- DNS ASK fi###settle.net
Miscellaneous
Creates and executes the following
- 'C:\kmllbneuaynlzwr\woaqi59tyqdg8vg6h.exe'
- 'C:\kmllbneuaynlzwr\htvgwnfwbzy.exe'
- 'C:\kmllbneuaynlzwr\hgifgduvx.exe' "c:\kmllbneuaynlzwr\htvgwnfwbzy.exe"
