Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Extender Management Session Tablet RPC] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Extender Management Session Tablet RPC] 'ImagePath' = 'C:\htyotrpbpqfeyx\xbdphsemq.exe'
Creates the following services
- 'Extender Management Session Tablet RPC' C:\htyotrpbpqfeyx\xbdphsemq.exe
Modifies file system
Creates the following files
- %WINDIR%\htyotrpbpqfeyx\vwefp4s4qzm
- C:\htyotrpbpqfeyx\vwefp4s4qzm
- C:\htyotrpbpqfeyx\mff6x2hu5yaiywxh.exe
- C:\htyotrpbpqfeyx\xbdphsemq.exe
- C:\htyotrpbpqfeyx\vkydeuopcjqz.exe
- C:\htyotrpbpqfeyx\gtrkympzx
Sets the 'hidden' attribute to the following files
- C:\htyotrpbpqfeyx\xbdphsemq.exe
- C:\htyotrpbpqfeyx\vkydeuopcjqz.exe
Deletes the following files
- %WINDIR%\htyotrpbpqfeyx\vwefp4s4qzm
- C:\htyotrpbpqfeyx\mff6x2hu5yaiywxh.exe
Substitutes the following files
- %WINDIR%\htyotrpbpqfeyx\vwefp4s4qzm
Network activity
Connects to
- 'be####strong.net':80
- 'th####rouble.net':80
- 'de####ymaster.net':80
- 'li####wonder.net':80
- 'be####continue.net':80
TCP
HTTP GET requests
- http://be####strong.net/index.php
- http://th####rouble.net/index.php
- http://de####ymaster.net/index.php
- http://li####wonder.net/index.php
- http://be####continue.net/index.php
UDP
- DNS ASK li####strong.net
- DNS ASK hu####dmaster.net
- DNS ASK jo####ymaster.net
- DNS ASK hu####dcontinue.net
- DNS ASK jo####ycontinue.net
- DNS ASK re####ercaught.net
- DNS ASK wo###caught.net
- DNS ASK re#####rpresident.net
- DNS ASK fo####trouble.net
- DNS ASK wo####resident.net
- DNS ASK wo####rouble.net
- DNS ASK re####erstrong.net
- DNS ASK wo###strong.net
- DNS ASK in####secaught.net
- DNS ASK fo####caught.net
- DNS ASK in#####epresident.net
- DNS ASK fo####president.net
- DNS ASK re####ertrouble.net
- DNS ASK in####setrouble.net
- DNS ASK jo####ywonder.net
- DNS ASK de####ydiscover.net
- DNS ASK ri####discover.net
- DNS ASK be####wonder.net
- DNS ASK ri####wonder.net
- DNS ASK be####master.net
- DNS ASK ri####master.net
- DNS ASK be####continue.net
- DNS ASK ri####continue.net
- DNS ASK jo####ydiscover.net
- DNS ASK hu####dwonder.net
- DNS ASK li####wonder.net
- DNS ASK de####ywonder.net
- DNS ASK li####master.net
- DNS ASK de####ymaster.net
- DNS ASK li####continue.net
- DNS ASK de####ycontinue.net
- DNS ASK hu####ddiscover.net
- DNS ASK li####discover.net
- DNS ASK in####sestrong.net
- DNS ASK fo####strong.net
- DNS ASK th####hcaught.net
- DNS ASK ch###strong.net
- DNS ASK be####caught.net
- DNS ASK ri####caught.net
- DNS ASK be####president.net
- DNS ASK ri####president.net
- DNS ASK be####trouble.net
- DNS ASK ch####rouble.net
- DNS ASK ri####trouble.net
- DNS ASK ri####strong.net
- DNS ASK li####caught.net
- DNS ASK de####ycaught.net
- DNS ASK li####president.net
- DNS ASK de#####president.net
- DNS ASK li####trouble.net
- DNS ASK de####ytrouble.net
- DNS ASK be####strong.net
- DNS ASK th####rouble.net
- DNS ASK th###strong.net
- DNS ASK ch####resident.net
- DNS ASK ef####caught.net
- DNS ASK wi####caught.net
- DNS ASK th#####president.net
- DNS ASK ef####president.net
- DNS ASK th####htrouble.net
- DNS ASK ef####trouble.net
- DNS ASK th####hstrong.net
- DNS ASK ef####strong.net
- DNS ASK su####caught.net
- DNS ASK su####president.net
- DNS ASK th####resident.net
- DNS ASK wi####president.net
- DNS ASK su####trouble.net
- DNS ASK wi####trouble.net
- DNS ASK su####strong.net
- DNS ASK wi####strong.net
- DNS ASK th###caught.net
- DNS ASK ch###caught.net
- DNS ASK be####discover.net
- DNS ASK ch####ontinue.net
Miscellaneous
Creates and executes the following
- 'C:\htyotrpbpqfeyx\mff6x2hu5yaiywxh.exe'
- 'C:\htyotrpbpqfeyx\xbdphsemq.exe'
- 'C:\htyotrpbpqfeyx\vkydeuopcjqz.exe' "c:\htyotrpbpqfeyx\xbdphsemq.exe"
