Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Auto Cryptographic Information Bus Update] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Auto Cryptographic Information Bus Update] 'ImagePath' = 'C:\ihhehgtnnxjgq\rwxkxhixhu.exe'
Creates the following services
- 'Auto Cryptographic Information Bus Update' C:\ihhehgtnnxjgq\rwxkxhixhu.exe
Modifies file system
Creates the following files
- %WINDIR%\ihhehgtnnxjgq\m1cqdn9
- C:\ihhehgtnnxjgq\m1cqdn9
- C:\ihhehgtnnxjgq\gjjn33ovpllqbq8jk.exe
- C:\ihhehgtnnxjgq\rwxkxhixhu.exe
- C:\ihhehgtnnxjgq\qvxhcmsqspx.exe
- C:\ihhehgtnnxjgq\cmne4ju
Sets the 'hidden' attribute to the following files
- C:\ihhehgtnnxjgq\rwxkxhixhu.exe
- C:\ihhehgtnnxjgq\qvxhcmsqspx.exe
Deletes the following files
- %WINDIR%\ihhehgtnnxjgq\m1cqdn9
- C:\ihhehgtnnxjgq\gjjn33ovpllqbq8jk.exe
Substitutes the following files
- %WINDIR%\ihhehgtnnxjgq\m1cqdn9
Network activity
Connects to
- 'he###finger.net':80
- 'pl#####tshoulder.net':80
- 'he###nabove.net':80
- 'jo####ybottom.net':80
- 'li###ebeing.net':80
- 'be####beyond.net':80
- 'ch####orever.net':80
TCP
HTTP GET requests
- http://he###finger.net/index.php
- http://pl#####tshoulder.net/index.php
- http://he###nabove.net/index.php
- http://jo####ybottom.net/index.php
- http://li###ebeing.net/index.php
- http://be####beyond.net/index.php
- http://ch####orever.net/index.php
UDP
- DNS ASK va####sfurther.net
- DNS ASK de####yforever.net
- DNS ASK li###ebeing.net
- DNS ASK de####ybeing.net
- DNS ASK li####beyond.net
- DNS ASK de####ybeyond.net
- DNS ASK hu####dbottom.net
- DNS ASK jo####ybottom.net
- DNS ASK hu####dforever.net
- DNS ASK jo####yforever.net
- DNS ASK hu####dbeing.net
- DNS ASK jo####ybeing.net
- DNS ASK li####forever.net
- DNS ASK hu####dbeyond.net
- DNS ASK re####finger.net
- DNS ASK va####sfinger.net
- DNS ASK re####shoulder.net
- DNS ASK va####sshoulder.net
- DNS ASK re###nabove.net
- DNS ASK va####sabove.net
- DNS ASK re###nuntil.net
- DNS ASK va####suntil.net
- DNS ASK ge####finger.net
- DNS ASK ge####shoulder.net
- DNS ASK ge###eabove.net
- DNS ASK jo####ybeyond.net
- DNS ASK ch####orever.net
- DNS ASK th####hbeyond.net
- DNS ASK ri####beyond.net
- DNS ASK ef####beyond.net
- DNS ASK su####bottom.net
- DNS ASK wi####bottom.net
- DNS ASK su####forever.net
- DNS ASK wi####forever.net
- DNS ASK su###rbeing.net
- DNS ASK wi###nbeing.net
- DNS ASK su####beyond.net
- DNS ASK wi####beyond.net
- DNS ASK th###bottom.net
- DNS ASK ch###bottom.net
- DNS ASK ge###euntil.net
- DNS ASK th####orever.net
- DNS ASK th###being.net
- DNS ASK ch###being.net
- DNS ASK th###beyond.net
- DNS ASK ch###beyond.net
- DNS ASK be####bottom.net
- DNS ASK ri####bottom.net
- DNS ASK be####forever.net
- DNS ASK ri####forever.net
- DNS ASK be###gbeing.net
- DNS ASK ri###nbeing.net
- DNS ASK be####beyond.net
- DNS ASK de####ybottom.net
- DNS ASK li####bottom.net
- DNS ASK he####finger.net
- DNS ASK he###above.net
- DNS ASK di####ultuntil.net
- DNS ASK gl###finger.net
- DNS ASK an####finger.net
- DNS ASK gl####houlder.net
- DNS ASK an####shoulder.net
- DNS ASK gl###above.net
- DNS ASK an###rabove.net
- DNS ASK gl###until.net
- DNS ASK an###runtil.net
- DNS ASK fo####dfinger.net
- DNS ASK de####finger.net
- DNS ASK he###until.net
- DNS ASK fo####dshoulder.net
- DNS ASK fo####dabove.net
- DNS ASK de###eabove.net
- DNS ASK fo####duntil.net
- DNS ASK de###euntil.net
- DNS ASK re####company.net
- DNS ASK va####scompany.net
- DNS ASK re####become.net
- DNS ASK va####sbecome.net
- DNS ASK re###ncover.net
- DNS ASK va####scover.net
- DNS ASK re####further.net
- DNS ASK de####shoulder.net
- DNS ASK or###until.net
- DNS ASK he####shoulder.net
- DNS ASK di#####ltshoulder.net
- DNS ASK le####shoulder.net
- DNS ASK he###nabove.net
- DNS ASK le###rabove.net
- DNS ASK he###nuntil.net
- DNS ASK le###runtil.net
- DNS ASK re####efinger.net
- DNS ASK or###finger.net
- DNS ASK re####eshoulder.net
- DNS ASK or####houlder.net
- DNS ASK re####eabove.net
- DNS ASK or###above.net
- DNS ASK le####finger.net
- DNS ASK re####euntil.net
- DNS ASK ne####aryfinger.net
- DNS ASK pl####ntfinger.net
- DNS ASK ne#####ryshoulder.net
- DNS ASK pl#####tshoulder.net
- DNS ASK ne####aryabove.net
- DNS ASK pl####ntabove.net
- DNS ASK ne####aryuntil.net
- DNS ASK pl####ntuntil.net
- DNS ASK he###finger.net
- DNS ASK di####ultfinger.net
- DNS ASK he####houlder.net
- DNS ASK di####ultabove.net
- DNS ASK ef###tbeing.net
Miscellaneous
Creates and executes the following
- 'C:\ihhehgtnnxjgq\gjjn33ovpllqbq8jk.exe'
- 'C:\ihhehgtnnxjgq\rwxkxhixhu.exe'
- 'C:\ihhehgtnnxjgq\qvxhcmsqspx.exe' "c:\ihhehgtnnxjgq\rwxkxhixhu.exe"
