Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 1f83a3e6186cf39f
Modifies file system
Creates the following files
- %APPDATA%\ehwetwc
Sets the 'hidden' attribute to the following files
- %APPDATA%\ehwetwc
Deletes itself.
Network activity
Connects to
- 'po###ulit.org':80
- 'hu###lior.net':80
- 'bu###u55t.net':80
- 'so###tlic4.net':80
- 'no####sa5org.org':80
- 'to###olihul.net':80
- 'so####ka51hub.net':80
- 'hu###ui3.net':80
- 'bu###uka1.net':80
- 'go####paster.org':80
- 'ne####annd66.org':80
TCP
HTTP GET requests
- http://bu###uka1.net/1
HTTP POST requests
- http://po###ulit.org/
- http://hu###lior.net/
- http://bu###u55t.net/
- http://so###tlic4.net/
- http://no####sa5org.org/
- http://to###olihul.net/
- http://so####ka51hub.net/
- http://hu###ui3.net/
- http://bu###uka1.net/
UDP
- DNS ASK po###ulit.org
- DNS ASK hu###lior.net
- DNS ASK bu###u55t.net
- DNS ASK so###tlic4.net
- DNS ASK no####sa5org.org
- DNS ASK nu###jnuli.org
- DNS ASK to###olihul.net
- DNS ASK so####ka51hub.net
- DNS ASK hu###ui3.net
- DNS ASK bu###uka1.net
- DNS ASK go####paster.org
- DNS ASK ne####annd66.org
- DNS ASK ot###uyttn.org
