Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Counter NetBIOS UserMode Intelligent] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Counter NetBIOS UserMode Intelligent] 'ImagePath' = 'C:\lzaihdojxqjn\acfuxhsyvx.exe'
Creates the following services
- 'Counter NetBIOS UserMode Intelligent' C:\lzaihdojxqjn\acfuxhsyvx.exe
Modifies file system
Creates the following files
- %WINDIR%\lzaihdojxqjn\kueqzotjq
- C:\lzaihdojxqjn\kueqzotjq
- C:\lzaihdojxqjn\ekvrbku8zinasiolymuxl.exe
- C:\lzaihdojxqjn\acfuxhsyvx.exe
- C:\lzaihdojxqjn\vvonqzl.exe
Sets the 'hidden' attribute to the following files
- C:\lzaihdojxqjn\acfuxhsyvx.exe
- C:\lzaihdojxqjn\vvonqzl.exe
Deletes the following files
- %WINDIR%\lzaihdojxqjn\kueqzotjq
- C:\lzaihdojxqjn\ekvrbku8zinasiolymuxl.exe
Substitutes the following files
- %WINDIR%\lzaihdojxqjn\kueqzotjq
Network activity
Connects to
- 'va####sreceive.net':80
- 'or###system.net':80
- 'le###rtrust.net':80
- 'de###efancy.net':80
- 'fo####dconsider.net':80
- 'de####friend.net':80
TCP
HTTP GET requests
- http://va####sreceive.net/index.php
- http://or###system.net/index.php
- http://le###rtrust.net/index.php
- http://de###efancy.net/index.php
- http://fo####dconsider.net/index.php
- http://de####friend.net/index.php
UDP
- DNS ASK va####sbranch.net
- DNS ASK he###friend.net
- DNS ASK di####ultfriend.net
- DNS ASK he####onsider.net
- DNS ASK di#####ltconsider.net
- DNS ASK he###fancy.net
- DNS ASK di####ultfancy.net
- DNS ASK he####aughter.net
- DNS ASK di#####ltlaughter.net
- DNS ASK gl###friend.net
- DNS ASK an####friend.net
- DNS ASK gl####onsider.net
- DNS ASK an####consider.net
- DNS ASK gl###fancy.net
- DNS ASK an###rfancy.net
- DNS ASK gl####aughter.net
- DNS ASK an####laughter.net
- DNS ASK fo####dfriend.net
- DNS ASK de####friend.net
- DNS ASK fo####dconsider.net
- DNS ASK de####consider.net
- DNS ASK fo####dfancy.net
- DNS ASK de###efancy.net
- DNS ASK fo####dlaughter.net
- DNS ASK de####laughter.net
- DNS ASK re###ntrust.net
- DNS ASK va####strust.net
- DNS ASK re####system.net
- DNS ASK re####neither.net
- DNS ASK va####ssystem.net
- DNS ASK pl#####tlaughter.net
- DNS ASK ne#####rylaughter.net
- DNS ASK re####laughter.net
- DNS ASK va####slaughter.net
- DNS ASK ge####friend.net
- DNS ASK ge####consider.net
- DNS ASK ge###efancy.net
- DNS ASK ge####laughter.net
- DNS ASK he####friend.net
- DNS ASK le####friend.net
- DNS ASK he####consider.net
- DNS ASK le####consider.net
- DNS ASK he###nfancy.net
- DNS ASK le###rfancy.net
- DNS ASK he####laughter.net
- DNS ASK re####efriend.net
- DNS ASK re####esystem.net
- DNS ASK or###friend.net
- DNS ASK re####econsider.net
- DNS ASK or####onsider.net
- DNS ASK re####efancy.net
- DNS ASK or###fancy.net
- DNS ASK re####elaughter.net
- DNS ASK or####aughter.net
- DNS ASK ne####aryfriend.net
- DNS ASK pl####ntfriend.net
- DNS ASK ne#####ryconsider.net
- DNS ASK pl#####tconsider.net
- DNS ASK ne####aryfancy.net
- DNS ASK pl####ntfancy.net
- DNS ASK va####sneither.net
- DNS ASK re###nhonor.net
- DNS ASK va####shonor.net
- DNS ASK di#####ltneither.net
- DNS ASK he###honor.net
- DNS ASK di####ulthonor.net
- DNS ASK gl###trust.net
- DNS ASK an###rtrust.net
- DNS ASK gl###system.net
- DNS ASK an####system.net
- DNS ASK gl####either.net
- DNS ASK an####neither.net
- DNS ASK gl###honor.net
- DNS ASK an###rhonor.net
- DNS ASK fo####dtrust.net
- DNS ASK de###etrust.net
- DNS ASK fo####dsystem.net
- DNS ASK de####system.net
- DNS ASK fo####dneither.net
- DNS ASK de####neither.net
- DNS ASK fo####dhonor.net
- DNS ASK de###ehonor.net
- DNS ASK re####quarter.net
- DNS ASK va####squarter.net
- DNS ASK re####receive.net
- DNS ASK va####sreceive.net
- DNS ASK re####believe.net
- DNS ASK va####sbelieve.net
- DNS ASK re####branch.net
- DNS ASK di####ultsystem.net
- DNS ASK he###system.net
- DNS ASK he####either.net
- DNS ASK di####ulttrust.net
- DNS ASK ge###etrust.net
- DNS ASK he###trust.net
- DNS ASK ge####system.net
- DNS ASK ge####neither.net
- DNS ASK ge###ehonor.net
- DNS ASK he###ntrust.net
- DNS ASK le###rtrust.net
- DNS ASK he####system.net
- DNS ASK le####system.net
- DNS ASK he####neither.net
- DNS ASK le####neither.net
- DNS ASK he###nhonor.net
- DNS ASK le###rhonor.net
- DNS ASK re####etrust.net
- DNS ASK le####laughter.net
- DNS ASK va####sfancy.net
- DNS ASK or###system.net
- DNS ASK re####eneither.net
- DNS ASK or####either.net
- DNS ASK re####ehonor.net
- DNS ASK or###honor.net
- DNS ASK ne####arytrust.net
- DNS ASK pl####nttrust.net
- DNS ASK ne####arysystem.net
- DNS ASK pl####ntsystem.net
- DNS ASK ne#####ryneither.net
- DNS ASK pl####ntneither.net
- DNS ASK ne####aryhonor.net
- DNS ASK pl####nthonor.net
- DNS ASK or###trust.net
- DNS ASK re###nfancy.net
Miscellaneous
Creates and executes the following
- 'C:\lzaihdojxqjn\ekvrbku8zinasiolymuxl.exe'
- 'C:\lzaihdojxqjn\acfuxhsyvx.exe'
- 'C:\lzaihdojxqjn\vvonqzl.exe' "c:\lzaihdojxqjn\acfuxhsyvx.exe"
