Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Keying Error Font Resource Base Video] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Keying Error Font Resource Base Video] 'ImagePath' = 'C:\gpiblxen\zviqupc.exe'
Creates the following services
- 'Keying Error Font Resource Base Video' C:\gpiblxen\zviqupc.exe
Modifies file system
Creates the following files
- %WINDIR%\gpiblxen\lt8sr7bezgn
- C:\gpiblxen\lt8sr7bezgn
- C:\gpiblxen\znfrn9tujnmbrxst.exe
- C:\gpiblxen\zviqupc.exe
- C:\gpiblxen\dijrqzisx.exe
- C:\gpiblxen\gesuvkcfvphj
Sets the 'hidden' attribute to the following files
- C:\gpiblxen\zviqupc.exe
- C:\gpiblxen\dijrqzisx.exe
Deletes the following files
- %WINDIR%\gpiblxen\lt8sr7bezgn
- C:\gpiblxen\znfrn9tujnmbrxst.exe
Substitutes the following files
- %WINDIR%\gpiblxen\lt8sr7bezgn
Network activity
Connects to
- '78.#7.87.58':21017
- '18#.#38.249.34':37331
- '86.##5.19.130':27743
- '94.##1.114.138':44254
- '31.##7.83.237':44843
- '21#.#65.0.136':35711
- '20#.#23.152.97':27682
Miscellaneous
Creates and executes the following
- 'C:\gpiblxen\znfrn9tujnmbrxst.exe'
- 'C:\gpiblxen\zviqupc.exe'
- 'C:\gpiblxen\dijrqzisx.exe' "c:\gpiblxen\zviqupc.exe"
