Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'User-mode Player WWAN Program Error' = 'C:\qforiyhzd\qquszzgmwxz.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Color AutoConfig Player Config Propagation] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Color AutoConfig Player Config Propagation] 'ImagePath' = 'C:\qforiyhzd\qquszzgmwxz.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\qforiyhzd\byh1ebyrgdd
- C:\qforiyhzd\byh1ebyrgdd
- C:\qforiyhzd\zf2mpaewtivvnvpp7.exe
- C:\qforiyhzd\qquszzgmwxz.exe
- C:\qforiyhzd\goucmrmvk.exe
Sets the 'hidden' attribute to the following files:
- C:\qforiyhzd\qquszzgmwxz.exe
- C:\qforiyhzd\goucmrmvk.exe
Deletes the following files:
- %WINDIR%\qforiyhzd\byh1ebyrgdd
- C:\qforiyhzd\zf2mpaewtivvnvpp7.exe
Substitutes the following files:
- %WINDIR%\qforiyhzd\byh1ebyrgdd
Network activity:
Connects to:
- 'ex####student.net':80
- 'ri####tudent.net':80
- 'fi####succeed.net':80
- 'th####succeed.net':80
- 'fi####between.net':80
- 'th####between.net':80
- 'fi####produce.net':80
- 'th####produce.net':80
- 'fi####student.net':80
- 'th####student.net':80
- 'ci#####tesucceed.net':80
- 'fa####between.net':80
- 'pi####ebetween.net':80
- 'ci#####tebetween.net':80
- 'pi####eproduce.net':80
- 'ci#####teproduce.net':80
- 'pi####estudent.net':80
- 'ci#####testudent.net':80
- 'ch####ensucceed.net':80
- 'fa####succeed.net':80
- 'ch####enbetween.net':80
- 'wh####rstudent.net':80
- 'pi####esucceed.net':80
- 'ri####roduce.net':80
- 'su####succeed.net':80
- 'be####estudent.net':80
- 'pe####succeed.net':80
- 'ma####esucceed.net':80
- 'pe####between.net':80
- 'ma####ebetween.net':80
- 'pe####produce.net':80
- 'ma####eproduce.net':80
- 'pe####student.net':80
- 'ma####estudent.net':80
- 'fo####nsucceed.net':80
- 'ri####etween.net':80
- 'su####between.net':80
- 'fo####nbetween.net':80
- 'su####produce.net':80
- 'fo####nproduce.net':80
- 'su####student.net':80
- 'fo####nstudent.net':80
- 'wh####rsucceed.net':80
- 'ri####ucceed.net':80
- 'wh####rbetween.net':80
- 'wh####rproduce.net':80
- 'ch####enproduce.net':80
TCP:
HTTP GET requests:
- http://ex####student.net/index.php
- http://ri####tudent.net/index.php
- http://fi####succeed.net/index.php
- http://th####succeed.net/index.php
- http://fi####between.net/index.php
- http://th####between.net/index.php
- http://fi####produce.net/index.php
- http://th####produce.net/index.php
- http://fi####student.net/index.php
- http://th####student.net/index.php
- http://ci#####tesucceed.net/index.php
- http://fa####between.net/index.php
- http://pi####ebetween.net/index.php
- http://ci#####tebetween.net/index.php
- http://pi####eproduce.net/index.php
- http://ci#####teproduce.net/index.php
- http://pi####estudent.net/index.php
- http://ci#####testudent.net/index.php
- http://ch####ensucceed.net/index.php
- http://fa####succeed.net/index.php
- http://ch####enbetween.net/index.php
- http://wh####rstudent.net/index.php
- http://pi####esucceed.net/index.php
- http://ri####roduce.net/index.php
- http://su####succeed.net/index.php
- http://be####estudent.net/index.php
- http://pe####succeed.net/index.php
- http://ma####esucceed.net/index.php
- http://pe####between.net/index.php
- http://ma####ebetween.net/index.php
- http://pe####produce.net/index.php
- http://ma####eproduce.net/index.php
- http://pe####student.net/index.php
- http://ma####estudent.net/index.php
- http://fo####nsucceed.net/index.php
- http://ri####etween.net/index.php
- http://su####between.net/index.php
- http://fo####nbetween.net/index.php
- http://su####produce.net/index.php
- http://fo####nproduce.net/index.php
- http://su####student.net/index.php
- http://fo####nstudent.net/index.php
- http://wh####rsucceed.net/index.php
- http://ri####ucceed.net/index.php
- http://wh####rbetween.net/index.php
- http://wh####rproduce.net/index.php
- http://ch####enproduce.net/index.php
UDP:
- DNS ASK ex####student.net
- DNS ASK ri####tudent.net
- DNS ASK fi####succeed.net
- DNS ASK th####succeed.net
- DNS ASK fi####between.net
- DNS ASK th####between.net
- DNS ASK fi####produce.net
- DNS ASK th####produce.net
- DNS ASK fi####student.net
- DNS ASK th####student.net
- DNS ASK ci#####tesucceed.net
- DNS ASK fa####between.net
- DNS ASK pi####ebetween.net
- DNS ASK ci#####tebetween.net
- DNS ASK pi####eproduce.net
- DNS ASK ci#####teproduce.net
- DNS ASK pi####estudent.net
- DNS ASK ci#####testudent.net
- DNS ASK ch####ensucceed.net
- DNS ASK fa####succeed.net
- DNS ASK ch####enbetween.net
- DNS ASK wh####rstudent.net
- DNS ASK pi####esucceed.net
- DNS ASK ri####roduce.net
- DNS ASK su####succeed.net
- DNS ASK be####estudent.net
- DNS ASK pe####succeed.net
- DNS ASK ma####esucceed.net
- DNS ASK pe####between.net
- DNS ASK ma####ebetween.net
- DNS ASK pe####produce.net
- DNS ASK ma####eproduce.net
- DNS ASK pe####student.net
- DNS ASK ma####estudent.net
- DNS ASK fo####nsucceed.net
- DNS ASK ri####etween.net
- DNS ASK su####between.net
- DNS ASK fo####nbetween.net
- DNS ASK su####produce.net
- DNS ASK fo####nproduce.net
- DNS ASK su####student.net
- DNS ASK fo####nstudent.net
- DNS ASK wh####rsucceed.net
- DNS ASK ri####ucceed.net
- DNS ASK wh####rbetween.net
- DNS ASK wh####rproduce.net
- DNS ASK ch####enproduce.net
Miscellaneous:
Creates and executes the following:
- 'C:\qforiyhzd\zf2mpaewtivvnvpp7.exe'
- 'C:\qforiyhzd\qquszzgmwxz.exe'
- 'C:\qforiyhzd\goucmrmvk.exe' "c:\qforiyhzd\qquszzgmwxz.exe"
