Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Controls Software Quality Group CNG Audio] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Controls Software Quality Group CNG Audio] 'ImagePath' = 'C:\pbnltjbxir\kaakbdsof.exe'
Modifies file system
Creates the following files
- %WINDIR%\pbnltjbxir\pvyqjihp6jer
- C:\pbnltjbxir\pvyqjihp6jer
- C:\pbnltjbxir\bpn2v0y5tky4rwk.exe
- C:\pbnltjbxir\kaakbdsof.exe
- C:\pbnltjbxir\ahsistwhgg.exe
Sets the 'hidden' attribute to the following files
- C:\pbnltjbxir\kaakbdsof.exe
- C:\pbnltjbxir\ahsistwhgg.exe
Deletes the following files
- %WINDIR%\pbnltjbxir\pvyqjihp6jer
- C:\pbnltjbxir\bpn2v0y5tky4rwk.exe
Substitutes the following files
- %WINDIR%\pbnltjbxir\pvyqjihp6jer
Network activity
TCP
HTTP GET requests
- http://ge####stream.net/index.php
- http://de####business.net/index.php
- http://gl###manner.net/index.php
- http://or###manner.net/index.php
- http://re####emanner.net/index.php
- http://or####usiness.net/index.php
- http://le####manner.net/index.php
- http://le####business.net/index.php
- http://fo####dinstead.net/index.php
- http://de####explain.net/index.php
- http://pl####ntinside.net/index.php
- http://he####inside.net/index.php
- http://va####sbright.net/index.php
UDP
- DNS ASK le####stream.net
- DNS ASK di####ultbright.net
- DNS ASK he###bright.net
- DNS ASK di####ultinside.net
- DNS ASK he###inside.net
- DNS ASK pl####ntinstead.net
- DNS ASK ne#####ryinstead.net
- DNS ASK di#####ltexplain.net
- DNS ASK he####xplain.net
- DNS ASK pl####ntexplain.net
- DNS ASK ne####arybright.net
- DNS ASK pl####ntinside.net
- DNS ASK ne####aryinside.net
- DNS ASK or####nstead.net
- DNS ASK re####einstead.net
- DNS ASK or####xplain.net
- DNS ASK ne#####ryexplain.net
- DNS ASK pl####ntbright.net
- DNS ASK or###bright.net
- DNS ASK re####eexplain.net
- DNS ASK gl###inside.net
- DNS ASK fo####dinstead.net
- DNS ASK de####explain.net
- DNS ASK fo####dexplain.net
- DNS ASK de####bright.net
- DNS ASK fo####dbright.net
- DNS ASK di#####ltinstead.net
- DNS ASK re####appear.net
- DNS ASK he####nstead.net
- DNS ASK de####inside.net
- DNS ASK an####explain.net
- DNS ASK gl####xplain.net
- DNS ASK an####bright.net
- DNS ASK gl###bright.net
- DNS ASK an####inside.net
- DNS ASK fo####dinside.net
- DNS ASK an####instead.net
- DNS ASK gl####nstead.net
- DNS ASK di####ultmanner.net
- DNS ASK re####ebright.net
- DNS ASK de###eready.net
- DNS ASK de###ebrown.net
- DNS ASK fo####dbrown.net
- DNS ASK de####people.net
- DNS ASK fo####dpeople.net
- DNS ASK de####daughter.net
- DNS ASK re####inside.net
- DNS ASK fo####ddaughter.net
- DNS ASK fo####dready.net
- DNS ASK gl###ready.net
- DNS ASK gl###brown.net
- DNS ASK an####people.net
- DNS ASK gl###people.net
- DNS ASK an####daughter.net
- DNS ASK gl####aughter.net
- DNS ASK an###rready.net
- DNS ASK va####sinside.net
- DNS ASK an###rbrown.net
- DNS ASK re####bright.net
- DNS ASK va####sbright.net
- DNS ASK re####einside.net
- DNS ASK he####instead.net
- DNS ASK le####explain.net
- DNS ASK he####explain.net
- DNS ASK le####bright.net
- DNS ASK he####bright.net
- DNS ASK le####inside.net
- DNS ASK he####inside.net
- DNS ASK le####instead.net
- DNS ASK ge####instead.net
- DNS ASK ge####bright.net
- DNS ASK ge####inside.net
- DNS ASK va####sinstead.net
- DNS ASK re####instead.net
- DNS ASK va####sexplain.net
- DNS ASK re####explain.net
- DNS ASK va####sappear.net
- DNS ASK ge####explain.net
- DNS ASK de####instead.net
- DNS ASK re####business.net
- DNS ASK va####sbusiness.net
- DNS ASK re####another.net
- DNS ASK de####manner.net
- DNS ASK fo####dmanner.net
- DNS ASK de####another.net
- DNS ASK fo####danother.net
- DNS ASK de####business.net
- DNS ASK re####bottle.net
- DNS ASK re####nothing.net
- DNS ASK re####divide.net
- DNS ASK fo####dbusiness.net
- DNS ASK gl###manner.net
- DNS ASK an####another.net
- DNS ASK gl####nother.net
- DNS ASK an####business.net
- DNS ASK gl####usiness.net
- DNS ASK de####appear.net
- DNS ASK fo####dappear.net
- DNS ASK an####manner.net
- DNS ASK va####sbottle.net
- DNS ASK va####snothing.net
- DNS ASK an####appear.net
- DNS ASK le####nothing.net
- DNS ASK he####nothing.net
- DNS ASK le####bottle.net
- DNS ASK he####bottle.net
- DNS ASK le####divide.net
- DNS ASK he####divide.net
- DNS ASK he###stream.net
- DNS ASK he####stream.net
- DNS ASK ge####stream.net
- DNS ASK ge####nothing.net
- DNS ASK he###bottle.net
- DNS ASK ge####bottle.net
- DNS ASK he###divide.net
- DNS ASK ge####divide.net
- DNS ASK va####sstream.net
- DNS ASK re####stream.net
- DNS ASK he####othing.net
- DNS ASK di####ultready.net
- DNS ASK or###inside.net
- DNS ASK gl###appear.net
- DNS ASK he####nother.net
- DNS ASK he####manner.net
- DNS ASK le####another.net
- DNS ASK he####another.net
- DNS ASK le####business.net
- DNS ASK he####business.net
- DNS ASK or###appear.net
- DNS ASK le####appear.net
- DNS ASK le####manner.net
- DNS ASK ge####manner.net
- DNS ASK ge####business.net
- DNS ASK ge####appear.net
- DNS ASK va####smanner.net
- DNS ASK re####manner.net
- DNS ASK va####sanother.net
- DNS ASK he####appear.net
- DNS ASK va####sdivide.net
- DNS ASK ge####another.net
- DNS ASK re####eappear.net
- DNS ASK re####ebusiness.net
- DNS ASK or####usiness.net
- DNS ASK di#####ltbusiness.net
- DNS ASK he####usiness.net
- DNS ASK di####ultappear.net
- DNS ASK he###appear.net
- DNS ASK pl####ntmanner.net
- DNS ASK ne####arymanner.net
- DNS ASK di#####ltanother.net
- DNS ASK pl####ntanother.net
- DNS ASK pl#####tbusiness.net
- DNS ASK ne#####rybusiness.net
- DNS ASK pl####ntappear.net
- DNS ASK ne####aryappear.net
- DNS ASK or###manner.net
- DNS ASK re####emanner.net
- DNS ASK or####nother.net
- DNS ASK ne#####ryanother.net
- DNS ASK re####eanother.net
- DNS ASK he###manner.net
- DNS ASK he###ready.net
Miscellaneous
Creates and executes the following
- 'C:\pbnltjbxir\bpn2v0y5tky4rwk.exe'
- 'C:\pbnltjbxir\kaakbdsof.exe'
- 'C:\pbnltjbxir\ahsistwhgg.exe' "c:\pbnltjbxir\kaakbdsof.exe"
