Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Initiator Storage SSDP Trap Gateway] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Initiator Storage SSDP Trap Gateway] 'ImagePath' = 'C:\mevlkohchc\nlwsffdatdfp.exe'
Creates the following services
- 'Initiator Storage SSDP Trap Gateway' C:\mevlkohchc\nlwsffdatdfp.exe
Modifies file system
Creates the following files
- %WINDIR%\mevlkohchc\styejc6nmx
- C:\mevlkohchc\styejc6nmx
- C:\mevlkohchc\ezarjsjdoftkgzkaou.exe
- C:\mevlkohchc\nlwsffdatdfp.exe
- C:\mevlkohchc\aotjndk.exe
- C:\mevlkohchc\jiwsemaryx
Sets the 'hidden' attribute to the following files
- C:\mevlkohchc\nlwsffdatdfp.exe
- C:\mevlkohchc\aotjndk.exe
Deletes the following files
- %WINDIR%\mevlkohchc\styejc6nmx
- C:\mevlkohchc\ezarjsjdoftkgzkaou.exe
Substitutes the following files
- %WINDIR%\mevlkohchc\styejc6nmx
Network activity
Connects to
- 'mo####inmodern.net':80
- 'wi####modern.net':80
- 'sw###escape.net':80
- 'si####silver.net':80
- 'mo####invalley.net':80
- 'wi####valley.net':80
- 'sw###sister.net':80
- 'sw###valley.net':80
- 'ma####alsister.net':80
TCP
HTTP GET requests
- http://mo####inmodern.net/index.php
- http://wi####modern.net/index.php
- http://sw###escape.net/index.php
- http://si####silver.net/index.php
- http://mo####invalley.net/index.php
- http://sw###sister.net/index.php
- http://sw###valley.net/index.php
- http://ma####alsister.net/index.php
UDP
- DNS ASK mo####inanimal.net
- DNS ASK sw###labor.net
- DNS ASK pr####lyvalley.net
- DNS ASK sw###valley.net
- DNS ASK pr####lysister.net
- DNS ASK sw###sister.net
- DNS ASK pr####lysilver.net
- DNS ASK sw###silver.net
- DNS ASK le###labor.net
- DNS ASK fi###hlabor.net
- DNS ASK le###valley.net
- DNS ASK fi####valley.net
- DNS ASK le###sister.net
- DNS ASK fi####sister.net
- DNS ASK pr####lylabor.net
- DNS ASK le###silver.net
- DNS ASK su####tlabor.net
- DNS ASK wi###rlabor.net
- DNS ASK su####tvalley.net
- DNS ASK su####tsister.net
- DNS ASK su####tsilver.net
- DNS ASK wi###wlabor.net
- DNS ASK pe####slabor.net
- DNS ASK wi####valley.net
- DNS ASK pe####svalley.net
- DNS ASK wi####sister.net
- DNS ASK pe####ssister.net
- DNS ASK wi####silver.net
- DNS ASK pe####ssilver.net
- DNS ASK fi####silver.net
- DNS ASK se####lsilver.net
- DNS ASK ma####alsilver.net
- DNS ASK se####lsister.net
- DNS ASK po####leshout.net
- DNS ASK mo####inshout.net
- DNS ASK po####ledemand.net
- DNS ASK mo####indemand.net
- DNS ASK po####lelisten.net
- DNS ASK mo####inlisten.net
- DNS ASK po####lebring.net
- DNS ASK mo####inbring.net
- DNS ASK mo###rshout.net
- DNS ASK si###eshout.net
- DNS ASK mo####demand.net
- DNS ASK si####demand.net
- DNS ASK mo####listen.net
- DNS ASK si####listen.net
- DNS ASK mo###rbring.net
- DNS ASK si###ebring.net
- DNS ASK la###shout.net
- DNS ASK se###ashout.net
- DNS ASK la###demand.net
- DNS ASK se####demand.net
- DNS ASK la###listen.net
- DNS ASK se####listen.net
- DNS ASK la###bring.net
- DNS ASK se###abring.net
- DNS ASK ma####allabor.net
- DNS ASK se####llabor.net
- DNS ASK ma####alvalley.net
- DNS ASK se####lvalley.net
- DNS ASK ma####alsister.net
- DNS ASK po####lelabor.net
- DNS ASK pe####sbring.net
- DNS ASK mo####inlabor.net
- DNS ASK mo####invalley.net
- DNS ASK sw###animal.net
- DNS ASK pr####lyescape.net
- DNS ASK sw###escape.net
- DNS ASK le###modern.net
- DNS ASK fi####modern.net
- DNS ASK le####roblem.net
- DNS ASK fi####problem.net
- DNS ASK le###animal.net
- DNS ASK fi####animal.net
- DNS ASK le###escape.net
- DNS ASK fi####escape.net
- DNS ASK su####tmodern.net
- DNS ASK su####tproblem.net
- DNS ASK pr####lyanimal.net
- DNS ASK su####tanimal.net
- DNS ASK wi####modern.net
- DNS ASK pe####smodern.net
- DNS ASK wi####problem.net
- DNS ASK pe####sproblem.net
- DNS ASK wi####animal.net
- DNS ASK pe####sanimal.net
- DNS ASK wi####escape.net
- DNS ASK pe####sescape.net
- DNS ASK po####lemodern.net
- DNS ASK mo####inmodern.net
- DNS ASK po####leproblem.net
- DNS ASK mo####inproblem.net
- DNS ASK po####leanimal.net
- DNS ASK su####tescape.net
- DNS ASK sw####roblem.net
- DNS ASK pr####lyproblem.net
- DNS ASK sw###modern.net
- DNS ASK po####lesister.net
- DNS ASK mo####insister.net
- DNS ASK po####lesilver.net
- DNS ASK mo####insilver.net
- DNS ASK mo###rlabor.net
- DNS ASK si###elabor.net
- DNS ASK mo####valley.net
- DNS ASK si####valley.net
- DNS ASK mo####sister.net
- DNS ASK si####sister.net
- DNS ASK mo####silver.net
- DNS ASK si####silver.net
- DNS ASK la###labor.net
- DNS ASK se###alabor.net
- DNS ASK la###valley.net
- DNS ASK se####valley.net
- DNS ASK la###sister.net
- DNS ASK se####sister.net
- DNS ASK la###silver.net
- DNS ASK se####silver.net
- DNS ASK ma####almodern.net
- DNS ASK se####lmodern.net
- DNS ASK ma####alproblem.net
- DNS ASK se####lproblem.net
- DNS ASK ma####alanimal.net
- DNS ASK se####lanimal.net
- DNS ASK ma####alescape.net
- DNS ASK se####lescape.net
- DNS ASK pr####lymodern.net
- DNS ASK po####levalley.net
- DNS ASK wi###wbring.net
Miscellaneous
Creates and executes the following
- 'C:\mevlkohchc\ezarjsjdoftkgzkaou.exe'
- 'C:\mevlkohchc\nlwsffdatdfp.exe'
- 'C:\mevlkohchc\aotjndk.exe' "c:\mevlkohchc\nlwsffdatdfp.exe"
