Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DCOM Visual Wired HomeGroup' = 'C:\txwkpbu\gczlhkzn7xmp9.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Link-Layer SNMP RPC Power Policy Workstation] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Link-Layer SNMP RPC Power Policy Workstation] 'ImagePath' = 'C:\txwkpbu\gczlhkzn7xmp9.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\txwkpbu\dlwhc4z
- C:\txwkpbu\dlwhc4z
- C:\txwkpbu\cvndfi2fc3zrqjkwhf7q5h.exe
- C:\txwkpbu\gczlhkzn7xmp9.exe
- C:\txwkpbu\fu0jqzpotwr.exe
- C:\txwkpbu\mxas3iejxu
Sets the 'hidden' attribute to the following files:
- C:\txwkpbu\gczlhkzn7xmp9.exe
- C:\txwkpbu\fu0jqzpotwr.exe
Deletes the following files:
- %WINDIR%\txwkpbu\dlwhc4z
- C:\txwkpbu\cvndfi2fc3zrqjkwhf7q5h.exe
Substitutes the following files:
- %WINDIR%\txwkpbu\dlwhc4z
Network activity:
Connects to:
- 'ge#####naaugustine.net':80
- 'cl#####ndesmeralda.net':80
- 'ch#####neesmeralda.net':80
- 'se#####antatyanna.net':80
- 'ch#####natatyanna.net':80
- 'se#####anethelinda.net':80
- 'ch#####naethelinda.net':80
- 'se#####anbeverley.net':80
- 'ch#####nabeverley.net':80
- 'se#####anesmeralda.net':80
- 'ch#####naesmeralda.net':80
- 'ch#####anaugustine.net':80
- 'gw#####reaugustine.net':80
- 'ch#####anfairclough.net':80
- 'gw#####refairclough.net':80
- 'ch#####anfairbairn.net':80
- 'gw#####refairbairn.net':80
- 'ch#####antimothyson.net':80
- 'gw#####retimothyson.net':80
- 'gu#####enaugustine.net':80
- 'an#####leaugustine.net':80
- 'gu#####enfairclough.net':80
- 'an#####lefairclough.net':80
- 'gu#####enfairbairn.net':80
- 'an#####lefairbairn.net':80
- 'gu#####entimothyson.net':80
- 'an#####letimothyson.net':80
- 'ch#####leaugustine.net':80
- 'ch#####nebeverley.net':80
- 'cl#####ndbeverley.net':80
TCP:
HTTP GET requests:
- http://ge#####naaugustine.net/index.php
- http://cl#####ndesmeralda.net/index.php
- http://ch#####neesmeralda.net/index.php
- http://se#####antatyanna.net/index.php
- http://ch#####natatyanna.net/index.php
- http://se#####anethelinda.net/index.php
- http://ch#####naethelinda.net/index.php
- http://se#####anbeverley.net/index.php
- http://ch#####nabeverley.net/index.php
- http://se#####anesmeralda.net/index.php
- http://ch#####naesmeralda.net/index.php
- http://ch#####anaugustine.net/index.php
- http://gw#####reaugustine.net/index.php
- http://ch#####anfairclough.net/index.php
- http://gw#####refairclough.net/index.php
- http://ch#####anfairbairn.net/index.php
- http://gw#####refairbairn.net/index.php
- http://ch#####antimothyson.net/index.php
- http://gw#####retimothyson.net/index.php
- http://gu#####enaugustine.net/index.php
- http://an#####leaugustine.net/index.php
- http://gu#####enfairclough.net/index.php
- http://an#####lefairclough.net/index.php
- http://gu#####enfairbairn.net/index.php
- http://an#####lefairbairn.net/index.php
- http://gu#####entimothyson.net/index.php
- http://an#####letimothyson.net/index.php
- http://ch#####leaugustine.net/index.php
- http://ch#####nebeverley.net/index.php
- http://cl#####ndbeverley.net/index.php
UDP:
- DNS ASK ge#####naaugustine.net
- DNS ASK ch#####nebeverley.net
- DNS ASK cl#####ndesmeralda.net
- DNS ASK ch#####neesmeralda.net
- DNS ASK se#####antatyanna.net
- DNS ASK ch#####natatyanna.net
- DNS ASK se#####anethelinda.net
- DNS ASK ch#####naethelinda.net
- DNS ASK se#####anbeverley.net
- DNS ASK ch#####nabeverley.net
- DNS ASK se#####anesmeralda.net
- DNS ASK ch#####naesmeralda.net
- DNS ASK ch#####anaugustine.net
- DNS ASK gw#####reaugustine.net
- DNS ASK cl#####ndbeverley.net
- DNS ASK ch#####anfairclough.net
- DNS ASK ch#####anfairbairn.net
- DNS ASK gw#####refairbairn.net
- DNS ASK ch#####antimothyson.net
- DNS ASK gw#####retimothyson.net
- DNS ASK gu#####enaugustine.net
- DNS ASK an#####leaugustine.net
- DNS ASK gu#####enfairclough.net
- DNS ASK an#####lefairclough.net
- DNS ASK gu#####enfairbairn.net
- DNS ASK an#####lefairbairn.net
- DNS ASK gu#####entimothyson.net
- DNS ASK an#####letimothyson.net
- DNS ASK ch#####leaugustine.net
- DNS ASK gw#####refairclough.net
- DNS ASK ch#####neethelinda.net
Miscellaneous:
Creates and executes the following:
- 'C:\txwkpbu\cvndfi2fc3zrqjkwhf7q5h.exe'
- 'C:\txwkpbu\gczlhkzn7xmp9.exe'
- 'C:\txwkpbu\fu0jqzpotwr.exe' "c:\txwkpbu\gczlhkzn7xmp9.exe"
