Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Files Time Management User] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Files Time Management User] 'ImagePath' = 'C:\khjwfqe\hlkoqalw.exe'
Creates the following services
- 'Files Time Management User' C:\khjwfqe\hlkoqalw.exe
Modifies file system
Creates the following files
- %WINDIR%\khjwfqe\bxzbcc9elj
- C:\khjwfqe\bxzbcc9elj
- C:\khjwfqe\bfmv5ojlmuwzcexh.exe
- C:\khjwfqe\hlkoqalw.exe
- C:\khjwfqe\vmqvqsvplx.exe
- C:\khjwfqe\kf0dyadxzfbq
Sets the 'hidden' attribute to the following files
- C:\khjwfqe\hlkoqalw.exe
- C:\khjwfqe\vmqvqsvplx.exe
Deletes the following files
- %WINDIR%\khjwfqe\bxzbcc9elj
- C:\khjwfqe\bfmv5ojlmuwzcexh.exe
Substitutes the following files
- %WINDIR%\khjwfqe\bxzbcc9elj
Network activity
TCP
HTTP GET requests
- http://st####ervice.net/index.php
- http://mi###river.net/index.php
- http://br####service.net/index.php
- http://st###river.net/index.php
- http://do###eshake.net/index.php
UDP
- DNS ASK st####ervice.net
- DNS ASK st###nearly.net
- DNS ASK ev####gshare.net
- DNS ASK bu####ngshare.net
- DNS ASK ev####gshake.net
- DNS ASK bu####ngshake.net
- DNS ASK ev####ghappen.net
- DNS ASK bu####nghappen.net
- DNS ASK ev####gnearly.net
- DNS ASK bu####ngnearly.net
- DNS ASK ou####eshare.net
- DNS ASK mo####ntshare.net
- DNS ASK ou####eshake.net
- DNS ASK mo####ntshake.net
- DNS ASK ou####ehappen.net
- DNS ASK mo####nthappen.net
- DNS ASK mo####ntnearly.net
- DNS ASK ou####enearly.net
- DNS ASK mi###nearly.net
- DNS ASK st###happen.net
- DNS ASK fe###wshake.net
- DNS ASK fe####happen.net
- DNS ASK fe####nearly.net
- DNS ASK pr###yshare.net
- DNS ASK do###rshare.net
- DNS ASK pr###yshake.net
- DNS ASK do###rshake.net
- DNS ASK do####happen.net
- DNS ASK pr####esuppose.net
- DNS ASK pr####nearly.net
- DNS ASK do####nearly.net
- DNS ASK mi###share.net
- DNS ASK st###share.net
- DNS ASK mi###shake.net
- DNS ASK st###shake.net
- DNS ASK mi###happen.net
- DNS ASK st####thriver.net
- DNS ASK st####thservice.net
- DNS ASK st####uppose.net
- DNS ASK fe####service.net
- DNS ASK fe####suppose.net
- DNS ASK fe####mister.net
- DNS ASK pr###yriver.net
- DNS ASK do###rriver.net
- DNS ASK pr####service.net
- DNS ASK do####service.net
- DNS ASK pr####suppose.net
- DNS ASK do####suppose.net
- DNS ASK pr####mister.net
- DNS ASK do####mister.net
- DNS ASK mi###river.net
- DNS ASK st###river.net
- DNS ASK mi####ervice.net
- DNS ASK do###eriver.net
- DNS ASK br####mister.net
- DNS ASK fe###wriver.net
- DNS ASK re####mister.net
- DNS ASK st####thsuppose.net
- DNS ASK br####suppose.net
- DNS ASK st###mister.net
- DNS ASK st####thmister.net
- DNS ASK de###eriver.net
- DNS ASK pr####eriver.net
- DNS ASK de####service.net
- DNS ASK pr####eservice.net
- DNS ASK pr####happen.net
- DNS ASK do###eshake.net
- DNS ASK de####mister.net
- DNS ASK pr####emister.net
- DNS ASK re###triver.net
- DNS ASK br###nriver.net
- DNS ASK re####service.net
- DNS ASK br####service.net
- DNS ASK re####suppose.net
- DNS ASK de####suppose.net
- DNS ASK fe###wshare.net
Miscellaneous
Creates and executes the following
- 'C:\khjwfqe\bfmv5ojlmuwzcexh.exe'
- 'C:\khjwfqe\hlkoqalw.exe'
- 'C:\khjwfqe\vmqvqsvplx.exe' "c:\khjwfqe\hlkoqalw.exe"
