Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] 'Web Event Logger' = '{79FEACFF-FFCE-815E-A900-316290B5B738}'
Modifies file system
Creates the following files
- %WINDIR%\syswow64\gocbko32.exe
- %WINDIR%\syswow64\nhpkdg32.dll
- %WINDIR%\syswow64\kojmfpbq.exe
- %WINDIR%\syswow64\klbhji32.dll
- %WINDIR%\syswow64\kjdngmoo.exe
- %WINDIR%\syswow64\ekcfai32.dll
- %WINDIR%\syswow64\kdloif32.exe
- %WINDIR%\syswow64\dbdefdlo.dll
- %WINDIR%\syswow64\koepjc32.exe
- %WINDIR%\syswow64\cjiihd32.dll
- %WINDIR%\syswow64\jdblcg32.exe
- %WINDIR%\syswow64\lkglde32.dll
- %WINDIR%\syswow64\lmlmigeh.exe
- %WINDIR%\syswow64\affbloeb.dll
- %WINDIR%\syswow64\lmnjogcf.exe
- %WINDIR%\syswow64\fabinn32.dll
- %WINDIR%\syswow64\liekchij.exe
- %WINDIR%\syswow64\idhiemgl.dll
- %WINDIR%\syswow64\lgjgdd32.exe
- %WINDIR%\syswow64\aolqca32.dll
- %WINDIR%\syswow64\kmiqchgk.exe
- %WINDIR%\syswow64\nceefefo.dll
- %WINDIR%\syswow64\jpqgjd32.exe
- %WINDIR%\syswow64\ijeqim32.dll
- %WINDIR%\syswow64\jidbhjld.exe
- %WINDIR%\syswow64\gebghfel.exe
- %WINDIR%\syswow64\onfohmoj.dll
- %WINDIR%\syswow64\gaihngjp.exe
- %WINDIR%\syswow64\cmpnocpc.dll
- %WINDIR%\syswow64\gefqce32.exe
- %WINDIR%\syswow64\gjchhb32.dll
- %WINDIR%\syswow64\gamahffk.exe
- %WINDIR%\syswow64\ahchno32.dll
- %WINDIR%\syswow64\hpekobip.exe
- %WINDIR%\syswow64\jjlbaklj.dll
- %WINDIR%\syswow64\agipnjmi.dll
- %WINDIR%\syswow64\pjqlja32.dll
- %WINDIR%\syswow64\hooakn32.exe
- %WINDIR%\syswow64\hokgkjda.dll
- %WINDIR%\syswow64\ioanan32.exe
- %WINDIR%\syswow64\ffdiddao.dll
- %WINDIR%\syswow64\ikmhanio.exe
- %WINDIR%\syswow64\nkldhpbe.dll
- %WINDIR%\syswow64\igcifo32.exe
- %WINDIR%\syswow64\elgjjkgn.dll
- %WINDIR%\syswow64\hiplngnn.exe
- %WINDIR%\syswow64\lcqhje32.exe
- %WINDIR%\syswow64\bocbopgq.dll
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\gocbko32.exe'
- '%WINDIR%\syswow64\kojmfpbq.exe'
- '%WINDIR%\syswow64\jdblcg32.exe'
- '%WINDIR%\syswow64\koepjc32.exe'
- '%WINDIR%\syswow64\jpqgjd32.exe'
- '%WINDIR%\syswow64\lcqhje32.exe'
- '%WINDIR%\syswow64\jidbhjld.exe'
- '%WINDIR%\syswow64\igcifo32.exe'
- '%WINDIR%\syswow64\kmiqchgk.exe'
- '%WINDIR%\syswow64\ikmhanio.exe'
- '%WINDIR%\syswow64\ioanan32.exe'
- '%WINDIR%\syswow64\kjdngmoo.exe'
- '%WINDIR%\syswow64\kdloif32.exe'
- '%WINDIR%\syswow64\lmlmigeh.exe'
- '%WINDIR%\syswow64\hiplngnn.exe'
- '%WINDIR%\syswow64\gebghfel.exe'
- '%WINDIR%\syswow64\lgjgdd32.exe'
- '%WINDIR%\syswow64\gaihngjp.exe'
- '%WINDIR%\syswow64\liekchij.exe'
- '%WINDIR%\syswow64\gefqce32.exe'
- '%WINDIR%\syswow64\hpekobip.exe'
- '%WINDIR%\syswow64\lmnjogcf.exe'
- '%WINDIR%\syswow64\gamahffk.exe'
- '%WINDIR%\syswow64\hooakn32.exe'
- '%WINDIR%\syswow64\kojmfpbq.exe' ' (with hidden window)
- '%WINDIR%\syswow64\jidbhjld.exe' ' (with hidden window)
- '%WINDIR%\syswow64\kdloif32.exe' ' (with hidden window)
- '%WINDIR%\syswow64\kmiqchgk.exe' ' (with hidden window)
- '%WINDIR%\syswow64\kjdngmoo.exe' ' (with hidden window)
- '%WINDIR%\syswow64\lmlmigeh.exe' ' (with hidden window)
- '%WINDIR%\syswow64\koepjc32.exe' ' (with hidden window)
- '%WINDIR%\syswow64\lmnjogcf.exe' ' (with hidden window)
- '%WINDIR%\syswow64\jdblcg32.exe' ' (with hidden window)
- '%WINDIR%\syswow64\liekchij.exe' ' (with hidden window)
- '%WINDIR%\syswow64\lgjgdd32.exe' ' (with hidden window)
- '%WINDIR%\syswow64\gaihngjp.exe' ' (with hidden window)
- '%WINDIR%\syswow64\gamahffk.exe' ' (with hidden window)
- '%WINDIR%\syswow64\ikmhanio.exe' ' (with hidden window)
- '%WINDIR%\syswow64\gebghfel.exe' ' (with hidden window)
- '%WINDIR%\syswow64\gefqce32.exe' ' (with hidden window)
- '%WINDIR%\syswow64\gocbko32.exe' ' (with hidden window)
- '%WINDIR%\syswow64\hpekobip.exe' ' (with hidden window)
- '%WINDIR%\syswow64\hiplngnn.exe' ' (with hidden window)
- '%WINDIR%\syswow64\hooakn32.exe' ' (with hidden window)
- '%WINDIR%\syswow64\ioanan32.exe' ' (with hidden window)
- '%WINDIR%\syswow64\jpqgjd32.exe' ' (with hidden window)
- '%WINDIR%\syswow64\igcifo32.exe' ' (with hidden window)
- '%WINDIR%\syswow64\lcqhje32.exe' ' (with hidden window)
