Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Netlogon IP Modules Encrypting Web Software] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Netlogon IP Modules Encrypting Web Software] 'ImagePath' = 'C:\iwhuiuleh\wiaykuzrvmq.exe'
Creates the following services
- 'Netlogon IP Modules Encrypting Web Software' C:\iwhuiuleh\wiaykuzrvmq.exe
Modifies file system
Creates the following files
- %WINDIR%\iwhuiuleh\tsahejvoe
- C:\iwhuiuleh\tsahejvoe
- C:\iwhuiuleh\xt8yslvp2cvwmng2dg.exe
- C:\iwhuiuleh\wiaykuzrvmq.exe
- C:\iwhuiuleh\nffhslf.exe
- C:\iwhuiuleh\htqakzvpulhx
Sets the 'hidden' attribute to the following files
- C:\iwhuiuleh\wiaykuzrvmq.exe
- C:\iwhuiuleh\nffhslf.exe
Deletes the following files
- %WINDIR%\iwhuiuleh\tsahejvoe
- C:\iwhuiuleh\xt8yslvp2cvwmng2dg.exe
Substitutes the following files
- %WINDIR%\iwhuiuleh\tsahejvoe
Network activity
Connects to
- 'wa####orever.net':80
- 'wo###being.net':80
- 'pa####orever.net':80
- 'fi####orever.net':80
- 'fr###flower.net':80
- 'fr###corner.net':80
- 'ge####manminute.net':80
- 'fo####flower.net':80
- 'be####pecial.net':80
- 'wa###flower.net':80
TCP
HTTP GET requests
- http://wa####orever.net/index.php
- http://wo###being.net/index.php
- http://pa####orever.net/index.php
- http://fi####orever.net/index.php
- http://fr###flower.net/index.php
- http://fr###corner.net/index.php
- http://ge####manminute.net/index.php
- http://fo####flower.net/index.php
- http://be####pecial.net/index.php
UDP
- DNS ASK kn###bottom.net
- DNS ASK be####pecial.net
- DNS ASK kn###minute.net
- DNS ASK be###minute.net
- DNS ASK kn###flower.net
- DNS ASK be###flower.net
- DNS ASK me####corner.net
- DNS ASK fo####corner.net
- DNS ASK me####special.net
- DNS ASK fo####special.net
- DNS ASK me####minute.net
- DNS ASK fo####minute.net
- DNS ASK me####flower.net
- DNS ASK fo####flower.net
- DNS ASK al####ycorner.net
- DNS ASK ge####mancorner.net
- DNS ASK al####yspecial.net
- DNS ASK ge#####anspecial.net
- DNS ASK ge####manminute.net
- DNS ASK al####yminute.net
- DNS ASK kn####pecial.net
- DNS ASK be###corner.net
- DNS ASK wo###flower.net
- DNS ASK wa###corner.net
- DNS ASK th####tcorner.net
- DNS ASK wa####pecial.net
- DNS ASK th####tspecial.net
- DNS ASK wa###minute.net
- DNS ASK th####tminute.net
- DNS ASK wa###flower.net
- DNS ASK cr###corner.net
- DNS ASK fi####orever.net
- DNS ASK su####corner.net
- DNS ASK cr####pecial.net
- DNS ASK su####special.net
- DNS ASK cr###minute.net
- DNS ASK su####minute.net
- DNS ASK cr###flower.net
- DNS ASK su####flower.net
- DNS ASK kn###corner.net
- DNS ASK al####yflower.net
- DNS ASK ge####manflower.net
- DNS ASK ex#####ncecorner.net
- DNS ASK wa###bottom.net
- DNS ASK th####tbottom.net
- DNS ASK wa####orever.net
- DNS ASK th####tforever.net
- DNS ASK wa###being.net
- DNS ASK th####tbeing.net
- DNS ASK wa###beyond.net
- DNS ASK th####tbeyond.net
- DNS ASK cr###bottom.net
- DNS ASK su####bottom.net
- DNS ASK cr####orever.net
- DNS ASK su####forever.net
- DNS ASK cr###being.net
- DNS ASK su###rbeing.net
- DNS ASK cr###beyond.net
- DNS ASK su####beyond.net
- DNS ASK sm###beyond.net
- DNS ASK wo###being.net
- DNS ASK wo###beyond.net
- DNS ASK sm###being.net
- DNS ASK fr###corner.net
- DNS ASK wo####orever.net
- DNS ASK ex#####ncespecial.net
- DNS ASK fr####pecial.net
- DNS ASK ex#####nceminute.net
- DNS ASK fr###minute.net
- DNS ASK ex#####nceflower.net
- DNS ASK fr###flower.net
- DNS ASK fi###bottom.net
- DNS ASK th####tflower.net
- DNS ASK sm###flower.net
- DNS ASK pa####orever.net
- DNS ASK fi###being.net
- DNS ASK pa###being.net
- DNS ASK fi###beyond.net
- DNS ASK pa###beyond.net
- DNS ASK sm###bottom.net
- DNS ASK wo###bottom.net
- DNS ASK sm####orever.net
- DNS ASK pa###bottom.net
- DNS ASK wo###minute.net
Miscellaneous
Creates and executes the following
- 'C:\iwhuiuleh\xt8yslvp2cvwmng2dg.exe'
- 'C:\iwhuiuleh\wiaykuzrvmq.exe'
- 'C:\iwhuiuleh\nffhslf.exe' "c:\iwhuiuleh\wiaykuzrvmq.exe"
