Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\fastuserswitchingcompatibility] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\fastuserswitchingcompatibility] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
Modifies file system
Creates the following files
- C:\gjoerefite
- <Current directory>\pqnnohotyo
- %TEMP%\wcftxggfsb.dat
- %WINDIR%\syswow64\tcwniykugo
Deletes the following files
- <Current directory>\pqnnohotyo
- %WINDIR%\syswow64\tcwniykugo
- C:\gjoerefite
Moves the following files
- from %TEMP%\wcftxggfsb.dat to %ProgramFiles(x86)%\stormii\%sessionname%\orvhe.cc3
Substitutes the following files
- %WINDIR%\syswow64\tcwniykugo
Deletes itself.
Network activity
Connects to
- 'ze####ayu.3322.org':8000
UDP
- DNS ASK ze####ayu.3322.org
- DNS ASK co##.f.360.cn
Miscellaneous
Creates and executes the following
- 'C:\gjoerefite' a -s<Full path to file>
Executes the following
- '%WINDIR%\syswow64\svchost.exe' -k netsvcs
