Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Link-Layer Redirector Power Input] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Link-Layer Redirector Power Input] 'ImagePath' = 'C:\ypserqphmlnb\xepknzgilaku.exe'
Creates the following services
- 'Link-Layer Redirector Power Input' C:\ypserqphmlnb\xepknzgilaku.exe
Modifies file system
Creates the following files
- %WINDIR%\ypserqphmlnb\qnyty3mc4
- C:\ypserqphmlnb\qnyty3mc4
- C:\ypserqphmlnb\zqdkcc6d6bwgcymgh.exe
- C:\ypserqphmlnb\xepknzgilaku.exe
- C:\ypserqphmlnb\zcdeljzjdugp.exe
- C:\ypserqphmlnb\ie8irtl
Sets the 'hidden' attribute to the following files
- C:\ypserqphmlnb\xepknzgilaku.exe
- C:\ypserqphmlnb\zcdeljzjdugp.exe
Deletes the following files
- %WINDIR%\ypserqphmlnb\qnyty3mc4
- C:\ypserqphmlnb\zqdkcc6d6bwgcymgh.exe
Substitutes the following files
- %WINDIR%\ypserqphmlnb\qnyty3mc4
Network activity
Connects to
- 'pr####estrike.net':80
- 'st####artial.net':80
- 'ou####esquare.net':80
- 'fe####attempt.net':80
- 'do####square.net':80
- 're####square.net':80
- 'de####attempt.net':80
- 'bu####ngmarket.net':80
- 'bu####ngreport.net':80
- 'bu####ngbeauty.net':80
- 'ev####ggarden.net':80
- 'st###report.net':80
- 'mi###report.net':80
- 'st###garden.net':80
- 'do####market.net':80
- 'do####beauty.net':80
TCP
HTTP GET requests
- http://pr####estrike.net/index.php
- http://st####artial.net/index.php
- http://ou####esquare.net/index.php
- http://fe####attempt.net/index.php
- http://do####square.net/index.php
- http://re####square.net/index.php
- http://de####attempt.net/index.php
- http://bu####ngmarket.net/index.php
- http://bu####ngbeauty.net/index.php
- http://ev####ggarden.net/index.php
- http://mi###report.net/index.php
- http://st###garden.net/index.php
- http://do####market.net/index.php
UDP
- DNS ASK fe####partial.net
- DNS ASK st#####hneighbor.net
- DNS ASK st####thsquare.net
- DNS ASK st####thattempt.net
- DNS ASK de####spread.net
- DNS ASK pr####espread.net
- DNS ASK de####neighbor.net
- DNS ASK pr####eneighbor.net
- DNS ASK de####square.net
- DNS ASK pr####esquare.net
- DNS ASK de####attempt.net
- DNS ASK pr####eattempt.net
- DNS ASK st####thspread.net
- DNS ASK re####spread.net
- DNS ASK re####neighbor.net
- DNS ASK br####neighbor.net
- DNS ASK re####square.net
- DNS ASK br####square.net
- DNS ASK re####attempt.net
- DNS ASK br####attempt.net
- DNS ASK fe####spread.net
- DNS ASK fe####neighbor.net
- DNS ASK fe####square.net
- DNS ASK fe####attempt.net
- DNS ASK pr####spread.net
- DNS ASK br####spread.net
- DNS ASK bu####nggarden.net
- DNS ASK pr####report.net
- DNS ASK mo####ntreport.net
- DNS ASK do####report.net
- DNS ASK pr####market.net
- DNS ASK do####market.net
- DNS ASK mi###garden.net
- DNS ASK st###garden.net
- DNS ASK mi###beauty.net
- DNS ASK st###beauty.net
- DNS ASK mi###report.net
- DNS ASK st###report.net
- DNS ASK mi###market.net
- DNS ASK st###market.net
- DNS ASK do####spread.net
- DNS ASK ev####ggarden.net
- DNS ASK ev####gbeauty.net
- DNS ASK bu####ngbeauty.net
- DNS ASK ev####greport.net
- DNS ASK bu####ngreport.net
- DNS ASK ev####gmarket.net
- DNS ASK bu####ngmarket.net
- DNS ASK ou####egarden.net
- DNS ASK mo####ntgarden.net
- DNS ASK ou####ebeauty.net
- DNS ASK mo####ntbeauty.net
- DNS ASK ou####ereport.net
- DNS ASK mo####ntmarket.net
- DNS ASK ou####emarket.net
- DNS ASK pr####neighbor.net
- DNS ASK ou####eattempt.net
- DNS ASK st####thpartial.net
- DNS ASK st###strike.net
- DNS ASK st####thstrike.net
- DNS ASK st####osition.net
- DNS ASK st#####hposition.net
- DNS ASK st###number.net
- DNS ASK st####thnumber.net
- DNS ASK de####partial.net
- DNS ASK pr####epartial.net
- DNS ASK de####strike.net
- DNS ASK pr####estrike.net
- DNS ASK st####artial.net
- DNS ASK de####position.net
- DNS ASK de####number.net
- DNS ASK pr####enumber.net
- DNS ASK re####partial.net
- DNS ASK br####partial.net
- DNS ASK re####strike.net
- DNS ASK br####strike.net
- DNS ASK re####position.net
- DNS ASK br####position.net
- DNS ASK re####number.net
- DNS ASK br####number.net
- DNS ASK do####partial.net
- DNS ASK pr####eposition.net
- DNS ASK bu####ngspread.net
- DNS ASK pr####square.net
- DNS ASK mo####ntsquare.net
- DNS ASK do####square.net
- DNS ASK pr####attempt.net
- DNS ASK do####attempt.net
- DNS ASK mi###spread.net
- DNS ASK st###spread.net
- DNS ASK mi####eighbor.net
- DNS ASK st####eighbor.net
- DNS ASK mi###square.net
- DNS ASK st###square.net
- DNS ASK mi####ttempt.net
- DNS ASK st####ttempt.net
- DNS ASK do####neighbor.net
- DNS ASK ev####gspread.net
- DNS ASK ev####gneighbor.net
- DNS ASK bu#####gneighbor.net
- DNS ASK ev####gsquare.net
- DNS ASK bu####ngsquare.net
- DNS ASK ev####gattempt.net
- DNS ASK bu####ngattempt.net
- DNS ASK ou####espread.net
- DNS ASK mo####ntspread.net
- DNS ASK ou####eneighbor.net
- DNS ASK mo#####tneighbor.net
- DNS ASK ou####esquare.net
- DNS ASK mo####ntattempt.net
- DNS ASK do####beauty.net
Miscellaneous
Creates and executes the following
- 'C:\ypserqphmlnb\zqdkcc6d6bwgcymgh.exe'
- 'C:\ypserqphmlnb\xepknzgilaku.exe'
- 'C:\ypserqphmlnb\zcdeljzjdugp.exe' "c:\ypserqphmlnb\xepknzgilaku.exe"
