Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Office Protocol SPP Networking Auto Adaptive] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Office Protocol SPP Networking Auto Adaptive] 'ImagePath' = 'C:\creqrsyahjydhs\lyvxtqmfnl.exe'
Creates the following services
- 'Office Protocol SPP Networking Auto Adaptive' C:\creqrsyahjydhs\lyvxtqmfnl.exe
Modifies file system
Creates the following files
- %WINDIR%\creqrsyahjydhs\lervh1kk1tag
- C:\creqrsyahjydhs\lervh1kk1tag
- C:\creqrsyahjydhs\brvxqsyg7wngcreragiib.exe
- C:\creqrsyahjydhs\lyvxtqmfnl.exe
- C:\creqrsyahjydhs\ljqtdiqebe.exe
- C:\creqrsyahjydhs\zazc9cdzv
Sets the 'hidden' attribute to the following files
- C:\creqrsyahjydhs\lyvxtqmfnl.exe
- C:\creqrsyahjydhs\ljqtdiqebe.exe
Deletes the following files
- %WINDIR%\creqrsyahjydhs\lervh1kk1tag
- C:\creqrsyahjydhs\brvxqsyg7wngcreragiib.exe
Substitutes the following files
- %WINDIR%\creqrsyahjydhs\lervh1kk1tag
Network activity
Connects to
- 'mi###espace.net':80
- 'mo####gtravel.net':80
- 'cl###space.net':80
- 'ch###indeed.net':80
TCP
HTTP GET requests
- http://mi###espace.net/index.php
- http://mo####gtravel.net/index.php
- http://ch###indeed.net/index.php
UDP
- DNS ASK mi###espace.net
- DNS ASK ri####indeed.net
- DNS ASK be####notice.net
- DNS ASK ri####notice.net
- DNS ASK be####length.net
- DNS ASK ri####length.net
- DNS ASK li####during.net
- DNS ASK de####yduring.net
- DNS ASK li####indeed.net
- DNS ASK de####yindeed.net
- DNS ASK li####notice.net
- DNS ASK de####ynotice.net
- DNS ASK li####length.net
- DNS ASK de####ylength.net
- DNS ASK hu####dduring.net
- DNS ASK jo####yduring.net
- DNS ASK hu####dindeed.net
- DNS ASK jo####yindeed.net
- DNS ASK be####indeed.net
- DNS ASK ri####during.net
- DNS ASK be####during.net
- DNS ASK ch###length.net
- DNS ASK ef####notice.net
- DNS ASK th####hlength.net
- DNS ASK ef####length.net
- DNS ASK su####during.net
- DNS ASK wi####during.net
- DNS ASK su####indeed.net
- DNS ASK wi####indeed.net
- DNS ASK su####notice.net
- DNS ASK su####length.net
- DNS ASK wi####notice.net
- DNS ASK wi####length.net
- DNS ASK th###during.net
- DNS ASK ch###during.net
- DNS ASK th###indeed.net
- DNS ASK ch###indeed.net
- DNS ASK th###notice.net
- DNS ASK ch###notice.net
- DNS ASK th###length.net
- DNS ASK th####hnotice.net
- DNS ASK hu####dnotice.net
- DNS ASK jo####ynotice.net
- DNS ASK hu####dlength.net
- DNS ASK hi####yspace.net
- DNS ASK st####espace.net
- DNS ASK mo####gclose.net
- DNS ASK ra###rclose.net
- DNS ASK mo####gyellow.net
- DNS ASK ra####yellow.net
- DNS ASK mo####gtravel.net
- DNS ASK ra####travel.net
- DNS ASK mo####gspace.net
- DNS ASK ra###rspace.net
- DNS ASK tw###eclose.net
- DNS ASK mi###eclose.net
- DNS ASK tw####yellow.net
- DNS ASK mi####yellow.net
- DNS ASK tw####travel.net
- DNS ASK mi####travel.net
- DNS ASK tw###espace.net
- DNS ASK st####etravel.net
- DNS ASK hi####ytravel.net
- DNS ASK st####eyellow.net
- DNS ASK hi####yyellow.net
- DNS ASK cl###close.net
- DNS ASK th###close.net
- DNS ASK cl###yellow.net
- DNS ASK th###yellow.net
- DNS ASK cl###travel.net
- DNS ASK th###travel.net
- DNS ASK cl###space.net
- DNS ASK th###space.net
- DNS ASK am###tclose.net
- DNS ASK we####rclose.net
- DNS ASK we####ryellow.net
- DNS ASK am####yellow.net
- DNS ASK we####rtravel.net
- DNS ASK am####travel.net
- DNS ASK we####rspace.net
- DNS ASK am###tspace.net
- DNS ASK hi####yclose.net
- DNS ASK st####eclose.net
- DNS ASK jo####ylength.net
- DNS ASK ef####indeed.net
Miscellaneous
Creates and executes the following
- 'C:\creqrsyahjydhs\brvxqsyg7wngcreragiib.exe'
- 'C:\creqrsyahjydhs\lyvxtqmfnl.exe'
- 'C:\creqrsyahjydhs\ljqtdiqebe.exe' "c:\creqrsyahjydhs\lyvxtqmfnl.exe"
