Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Auto User-mode Instrumentation Remote Firewall] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Auto User-mode Instrumentation Remote Firewall] 'ImagePath' = 'C:\ljauptlzmwherju\psgnprxe.exe'
Creates the following services
- 'Auto User-mode Instrumentation Remote Firewall' C:\ljauptlzmwherju\psgnprxe.exe
Modifies file system
Creates the following files
- %WINDIR%\ljauptlzmwherju\qdfjvp6ehlkc
- C:\ljauptlzmwherju\qdfjvp6ehlkc
- C:\ljauptlzmwherju\ab7j5d5uyjlgfbp8.exe
- C:\ljauptlzmwherju\psgnprxe.exe
- C:\ljauptlzmwherju\zznejgnmtohi.exe
- C:\ljauptlzmwherju\enrvd1lb
Sets the 'hidden' attribute to the following files
- C:\ljauptlzmwherju\psgnprxe.exe
- C:\ljauptlzmwherju\zznejgnmtohi.exe
Deletes the following files
- %WINDIR%\ljauptlzmwherju\qdfjvp6ehlkc
- C:\ljauptlzmwherju\ab7j5d5uyjlgfbp8.exe
Substitutes the following files
- %WINDIR%\ljauptlzmwherju\qdfjvp6ehlkc
Network activity
Connects to
- 'qu###value.net':80
- 'ni###chance.net':80
- 'tr####eeting.net':80
- 'st####twenty.net':80
- 'be####chance.net':80
- 'be####meeting.net':80
- 'qu####nderstood.net':80
- 'ni###train.net':80
- 'ni####elight.net':80
- 'ca####ntrain.net':80
- 'el####ictrain.net':80
TCP
HTTP GET requests
- http://qu###value.net/index.php
- http://ni###chance.net/index.php
- http://tr####eeting.net/index.php
- http://st####twenty.net/index.php
- http://be####chance.net/index.php
- http://be####meeting.net/index.php
- http://qu####nderstood.net/index.php
- http://ni###train.net/index.php
- http://ni####elight.net/index.php
- http://ca####ntrain.net/index.php
- http://el####ictrain.net/index.php
UDP
- DNS ASK br###almost.net
- DNS ASK la###borrow.net
- DNS ASK de####delight.net
- DNS ASK ni####elight.net
- DNS ASK de#####lectricity.net
- DNS ASK ni#####ectricity.net
- DNS ASK de###etrain.net
- DNS ASK ni###train.net
- DNS ASK de####borrow.net
- DNS ASK ni###borrow.net
- DNS ASK do####elight.net
- DNS ASK ag####tdelight.net
- DNS ASK do#####ectricity.net
- DNS ASK ag#####electricity.net
- DNS ASK do###train.net
- DNS ASK ag####ttrain.net
- DNS ASK do###borrow.net
- DNS ASK ag####tborrow.net
- DNS ASK se#####nderstood.net
- DNS ASK qu####nderstood.net
- DNS ASK se####twenty.net
- DNS ASK qu###twenty.net
- DNS ASK se####meeting.net
- DNS ASK qu####eeting.net
- DNS ASK se####chance.net
- DNS ASK qu###chance.net
- DNS ASK br####nderstood.net
- DNS ASK fl####nderstood.net
- DNS ASK br###twenty.net
- DNS ASK fl###twenty.net
- DNS ASK ca####nborrow.net
- DNS ASK ca####ntrain.net
- DNS ASK fl###train.net
- DNS ASK la#####ectricity.net
- DNS ASK br###borrow.net
- DNS ASK fl###borrow.net
- DNS ASK ga####delight.net
- DNS ASK be####delight.net
- DNS ASK ga#####lectricity.net
- DNS ASK be#####lectricity.net
- DNS ASK ga###rtrain.net
- DNS ASK be###rtrain.net
- DNS ASK ga####borrow.net
- DNS ASK be####borrow.net
- DNS ASK tr####elight.net
- DNS ASK st####delight.net
- DNS ASK tr#####ectricity.net
- DNS ASK st#####lectricity.net
- DNS ASK tr###train.net
- DNS ASK st###ttrain.net
- DNS ASK tr###borrow.net
- DNS ASK st####borrow.net
- DNS ASK el####icdelight.net
- DNS ASK re####delight.net
- DNS ASK el#####celectricity.net
- DNS ASK re#####lectricity.net
- DNS ASK el####ictrain.net
- DNS ASK re###dtrain.net
- DNS ASK el####icborrow.net
- DNS ASK re####borrow.net
- DNS ASK ca####ndelight.net
- DNS ASK la####elight.net
- DNS ASK ca#####electricity.net
- DNS ASK br####eeting.net
- DNS ASK la###train.net
- DNS ASK fl####eeting.net
- DNS ASK la###chance.net
- DNS ASK ni####nderstood.net
- DNS ASK de####twenty.net
- DNS ASK ni###twenty.net
- DNS ASK de####meeting.net
- DNS ASK ni####eeting.net
- DNS ASK de####chance.net
- DNS ASK ni###chance.net
- DNS ASK do####nderstood.net
- DNS ASK ag#####understood.net
- DNS ASK do###twenty.net
- DNS ASK ag####ttwenty.net
- DNS ASK do####eeting.net
- DNS ASK ag####tmeeting.net
- DNS ASK do###chance.net
- DNS ASK ag####tchance.net
- DNS ASK se###nvalue.net
- DNS ASK qu###value.net
- DNS ASK se####orderly.net
- DNS ASK qu####rderly.net
- DNS ASK se####reason.net
- DNS ASK qu###reason.net
- DNS ASK se####almost.net
- DNS ASK qu###almost.net
- DNS ASK br###value.net
- DNS ASK fl###value.net
- DNS ASK br####rderly.net
- DNS ASK fl####rderly.net
- DNS ASK br###reason.net
- DNS ASK fl###reason.net
- DNS ASK de#####nderstood.net
- DNS ASK ca####nchance.net
- DNS ASK fl###chance.net
- DNS ASK la####eeting.net
- DNS ASK ga#####nderstood.net
- DNS ASK be#####nderstood.net
- DNS ASK ga####twenty.net
- DNS ASK be####twenty.net
- DNS ASK ga####meeting.net
- DNS ASK be####meeting.net
- DNS ASK ga####chance.net
- DNS ASK be####chance.net
- DNS ASK tr####nderstood.net
- DNS ASK st#####nderstood.net
- DNS ASK tr###twenty.net
- DNS ASK st####twenty.net
- DNS ASK tr####eeting.net
- DNS ASK st####meeting.net
- DNS ASK tr###chance.net
- DNS ASK st####chance.net
- DNS ASK el#####cunderstood.net
- DNS ASK re#####nderstood.net
- DNS ASK el####ictwenty.net
- DNS ASK re####twenty.net
- DNS ASK el####icmeeting.net
- DNS ASK re####meeting.net
- DNS ASK el####icchance.net
- DNS ASK re####chance.net
- DNS ASK ca#####understood.net
- DNS ASK la####nderstood.net
- DNS ASK ca####ntwenty.net
- DNS ASK la###twenty.net
- DNS ASK ca####nmeeting.net
- DNS ASK br###chance.net
- DNS ASK br###train.net
Miscellaneous
Creates and executes the following
- 'C:\ljauptlzmwherju\ab7j5d5uyjlgfbp8.exe'
- 'C:\ljauptlzmwherju\psgnprxe.exe'
- 'C:\ljauptlzmwherju\zznejgnmtohi.exe' "c:\ljauptlzmwherju\psgnprxe.exe"
