Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Enumerator Cache Update TPM Disk Function] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Enumerator Cache Update TPM Disk Function] 'ImagePath' = 'C:\brmsldorrwbjxgy\gregegoll.exe'
Modifies file system
Creates the following files
- %WINDIR%\brmsldorrwbjxgy\yfuanyo
- C:\brmsldorrwbjxgy\yfuanyo
- C:\brmsldorrwbjxgy\lvznvnzn5pktgglbl.exe
- C:\brmsldorrwbjxgy\gregegoll.exe
- C:\brmsldorrwbjxgy\xxoermmzml.exe
Sets the 'hidden' attribute to the following files
- C:\brmsldorrwbjxgy\gregegoll.exe
- C:\brmsldorrwbjxgy\xxoermmzml.exe
Deletes the following files
- %WINDIR%\brmsldorrwbjxgy\yfuanyo
- C:\brmsldorrwbjxgy\lvznvnzn5pktgglbl.exe
Substitutes the following files
- %WINDIR%\brmsldorrwbjxgy\yfuanyo
Network activity
TCP
HTTP GET requests
- http://ef####appear.net/index.php
- http://hu####dinstead.net/index.php
- http://jo####ybright.net/index.php
- http://be####instead.net/index.php
- http://su####explain.net/index.php
- http://jo####ybrown.net/index.php
- http://hu####dbrown.net/index.php
- http://li###ebrown.net/index.php
- http://li####people.net/index.php
- http://be####people.net/index.php
- http://ri####daughter.net/index.php
- http://th###people.net/index.php
- http://ef####people.net/index.php
- http://wo###ready.net/index.php
UDP
- DNS ASK th####hbusiness.net
- DNS ASK de####ypeople.net
- DNS ASK li####people.net
- DNS ASK de####ydaughter.net
- DNS ASK li####daughter.net
- DNS ASK ri###nready.net
- DNS ASK de####ybrown.net
- DNS ASK li###ebrown.net
- DNS ASK be###gready.net
- DNS ASK ri####people.net
- DNS ASK be####people.net
- DNS ASK ri####daughter.net
- DNS ASK be####daughter.net
- DNS ASK ch###ready.net
- DNS ASK ri###nbrown.net
- DNS ASK be###gbrown.net
- DNS ASK li###eready.net
- DNS ASK de####yready.net
- DNS ASK hu####ddaughter.net
- DNS ASK re####erinstead.net
- DNS ASK wo####xplain.net
- DNS ASK re####erexplain.net
- DNS ASK wo###bright.net
- DNS ASK re####erbright.net
- DNS ASK wo###inside.net
- DNS ASK wo####nstead.net
- DNS ASK re####erinside.net
- DNS ASK hu####dready.net
- DNS ASK jo####ybrown.net
- DNS ASK hu####dbrown.net
- DNS ASK jo####ypeople.net
- DNS ASK hu####dpeople.net
- DNS ASK jo####ydaughter.net
- DNS ASK jo####yready.net
- DNS ASK th###ready.net
- DNS ASK th###brown.net
- DNS ASK wo####aughter.net
- DNS ASK ch###people.net
- DNS ASK in####seready.net
- DNS ASK fo###tbrown.net
- DNS ASK in####sebrown.net
- DNS ASK fo####people.net
- DNS ASK in####sepeople.net
- DNS ASK th####hdaughter.net
- DNS ASK fo###tready.net
- DNS ASK fo####daughter.net
- DNS ASK re####erready.net
- DNS ASK wo###brown.net
- DNS ASK re####erbrown.net
- DNS ASK wo###people.net
- DNS ASK re####erpeople.net
- DNS ASK in#####edaughter.net
- DNS ASK wo###ready.net
- DNS ASK ef####daughter.net
- DNS ASK th####hpeople.net
- DNS ASK ef####people.net
- DNS ASK ch####aughter.net
- DNS ASK th####aughter.net
- DNS ASK wi###nready.net
- DNS ASK su###rready.net
- DNS ASK wi###nbrown.net
- DNS ASK su###rbrown.net
- DNS ASK th###people.net
- DNS ASK wi####people.net
- DNS ASK wi####daughter.net
- DNS ASK su####daughter.net
- DNS ASK ef###tready.net
- DNS ASK th####hready.net
- DNS ASK ef###tbrown.net
- DNS ASK th####hbrown.net
- DNS ASK su####people.net
- DNS ASK in####seinside.net
- DNS ASK ch###brown.net
- DNS ASK fo####inside.net
- DNS ASK ri####instead.net
- DNS ASK jo####yexplain.net
- DNS ASK hu####dexplain.net
- DNS ASK jo####ybright.net
- DNS ASK hu####dbright.net
- DNS ASK jo####yinside.net
- DNS ASK jo####yinstead.net
- DNS ASK hu####dinstead.net
- DNS ASK hu####dinside.net
- DNS ASK de####yexplain.net
- DNS ASK li####explain.net
- DNS ASK de####ybright.net
- DNS ASK li####bright.net
- DNS ASK de####yinside.net
- DNS ASK de####yinstead.net
- DNS ASK li####instead.net
- DNS ASK re####erappear.net
- DNS ASK wo###appear.net
- DNS ASK re#####rbusiness.net
- DNS ASK th####happear.net
- DNS ASK fo####manner.net
- DNS ASK in####semanner.net
- DNS ASK fo####another.net
- DNS ASK in####seanother.net
- DNS ASK fo####business.net
- DNS ASK ef####appear.net
- DNS ASK in#####ebusiness.net
- DNS ASK in####seappear.net
- DNS ASK wo###manner.net
- DNS ASK re####ermanner.net
- DNS ASK wo####nother.net
- DNS ASK re####eranother.net
- DNS ASK wo####usiness.net
- DNS ASK fo####appear.net
- DNS ASK li####inside.net
- DNS ASK be####instead.net
- DNS ASK fo####bright.net
- DNS ASK ri####explain.net
- DNS ASK su####inside.net
- DNS ASK ef####instead.net
- DNS ASK th####hinstead.net
- DNS ASK ef####explain.net
- DNS ASK th####hexplain.net
- DNS ASK su####bright.net
- DNS ASK wi####inside.net
- DNS ASK ef####bright.net
- DNS ASK th####hinside.net
- DNS ASK fo####instead.net
- DNS ASK in####seinstead.net
- DNS ASK fo####explain.net
- DNS ASK in####seexplain.net
- DNS ASK th####hbright.net
- DNS ASK ef####inside.net
- DNS ASK wi####bright.net
- DNS ASK su####explain.net
- DNS ASK wi####explain.net
- DNS ASK ri####bright.net
- DNS ASK be####bright.net
- DNS ASK ri####inside.net
- DNS ASK be####inside.net
- DNS ASK ch####nstead.net
- DNS ASK th####nstead.net
- DNS ASK be####explain.net
- DNS ASK ch####xplain.net
- DNS ASK ch###bright.net
- DNS ASK th###bright.net
- DNS ASK ch###inside.net
- DNS ASK th###inside.net
- DNS ASK wi####instead.net
- DNS ASK su####instead.net
- DNS ASK th####xplain.net
- DNS ASK in####sebright.net
- DNS ASK re#####rdaughter.net
Miscellaneous
Creates and executes the following
- 'C:\brmsldorrwbjxgy\lvznvnzn5pktgglbl.exe'
- 'C:\brmsldorrwbjxgy\gregegoll.exe'
- 'C:\brmsldorrwbjxgy\xxoermmzml.exe' "c:\brmsldorrwbjxgy\gregegoll.exe"
