Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Support Power Protocol Themes] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Support Power Protocol Themes] 'ImagePath' = 'C:\ifyweabwbgp\khosfqx.exe'
Creates the following services
- 'Support Power Protocol Themes' C:\ifyweabwbgp\khosfqx.exe
Modifies file system
Creates the following files
- %WINDIR%\ifyweabwbgp\d5hitbw
- C:\ifyweabwbgp\d5hitbw
- C:\ifyweabwbgp\rkvdrrdpvbvhdwgb21aw.exe
- C:\ifyweabwbgp\khosfqx.exe
- C:\ifyweabwbgp\nchyqjy.exe
- C:\ifyweabwbgp\rmnws5
Sets the 'hidden' attribute to the following files
- C:\ifyweabwbgp\khosfqx.exe
- C:\ifyweabwbgp\nchyqjy.exe
Deletes the following files
- %WINDIR%\ifyweabwbgp\d5hitbw
- C:\ifyweabwbgp\rkvdrrdpvbvhdwgb21aw.exe
Substitutes the following files
- %WINDIR%\ifyweabwbgp\d5hitbw
Network activity
Connects to
- 'be####strong.net':80
- 'th####rouble.net':80
TCP
HTTP GET requests
- http://be####strong.net/index.php
- http://th####rouble.net/index.php
UDP
- DNS ASK li####strong.net
- DNS ASK ef####trouble.net
- DNS ASK th####htrouble.net
- DNS ASK ef####president.net
- DNS ASK th#####president.net
- DNS ASK ef####caught.net
- DNS ASK th####hcaught.net
- DNS ASK fo####strong.net
- DNS ASK in####sestrong.net
- DNS ASK fo####trouble.net
- DNS ASK in####setrouble.net
- DNS ASK fo####president.net
- DNS ASK in#####epresident.net
- DNS ASK fo####caught.net
- DNS ASK wo###strong.net
- DNS ASK jo####ydiscover.net
- DNS ASK re####erstrong.net
- DNS ASK wo####rouble.net
- DNS ASK re####ertrouble.net
- DNS ASK wo####resident.net
- DNS ASK re#####rpresident.net
- DNS ASK wo###caught.net
- DNS ASK re####ercaught.net
- DNS ASK jo####ycontinue.net
- DNS ASK hu####dcontinue.net
- DNS ASK jo####ymaster.net
- DNS ASK hu####dmaster.net
- DNS ASK jo####ywonder.net
- DNS ASK hu####dwonder.net
- DNS ASK th####hstrong.net
- DNS ASK in####secaught.net
- DNS ASK ef####strong.net
- DNS ASK be####caught.net
- DNS ASK de####ytrouble.net
- DNS ASK li####trouble.net
- DNS ASK de#####president.net
- DNS ASK li####president.net
- DNS ASK de####ycaught.net
- DNS ASK li####caught.net
- DNS ASK ri####strong.net
- DNS ASK be####strong.net
- DNS ASK ri####trouble.net
- DNS ASK be####trouble.net
- DNS ASK ri####president.net
- DNS ASK be####president.net
- DNS ASK ri####caught.net
- DNS ASK ch###strong.net
- DNS ASK wi####caught.net
- DNS ASK th###strong.net
- DNS ASK ch####rouble.net
- DNS ASK th####rouble.net
- DNS ASK ch####resident.net
- DNS ASK th####resident.net
- DNS ASK ch###caught.net
- DNS ASK th###caught.net
- DNS ASK wi####strong.net
- DNS ASK su####strong.net
- DNS ASK wi####trouble.net
- DNS ASK su####trouble.net
- DNS ASK wi####president.net
- DNS ASK su####president.net
- DNS ASK su####caught.net
- DNS ASK hu####ddiscover.net
Miscellaneous
Creates and executes the following
- 'C:\ifyweabwbgp\rkvdrrdpvbvhdwgb21aw.exe'
- 'C:\ifyweabwbgp\khosfqx.exe'
- 'C:\ifyweabwbgp\nchyqjy.exe' "c:\ifyweabwbgp\khosfqx.exe"
