Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Notification Block Compatibility] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Notification Block Compatibility] 'ImagePath' = 'C:\hdedhzv\athaxfeswey.exe'
Creates the following services
- 'Notification Block Compatibility' C:\hdedhzv\athaxfeswey.exe
Modifies file system
Creates the following files
- %WINDIR%\hdedhzv\feabj3ftkjv
- C:\hdedhzv\feabj3ftkjv
- C:\hdedhzv\xkdsuqqorpprspa.exe
- C:\hdedhzv\athaxfeswey.exe
- C:\hdedhzv\tegyadzyqq.exe
- C:\hdedhzv\yzmnwzcxy
Sets the 'hidden' attribute to the following files
- C:\hdedhzv\athaxfeswey.exe
- C:\hdedhzv\tegyadzyqq.exe
Deletes the following files
- %WINDIR%\hdedhzv\feabj3ftkjv
- C:\hdedhzv\xkdsuqqorpprspa.exe
Substitutes the following files
- %WINDIR%\hdedhzv\feabj3ftkjv
Network activity
Connects to
- 'st###length.net':80
- 'mi###length.net':80
- 'do####length.net':80
- 'st####thlength.net':80
- 'mo####ntgeneral.net':80
- 'do###eclear.net':80
- 're###tclear.net':80
- 're####include.net':80
- 'ou####equarter.net':80
- 'mi###branch.net':80
- 'do####branch.net':80
- 'fe####quarter.net':80
TCP
HTTP GET requests
- http://st###length.net/index.php
- http://mi###length.net/index.php
- http://do####length.net/index.php
- http://st####thlength.net/index.php
- http://mo####ntgeneral.net/index.php
- http://do###eclear.net/index.php
- http://re###tclear.net/index.php
- http://re####include.net/index.php
- http://ou####equarter.net/index.php
- http://mi###branch.net/index.php
- http://do####branch.net/index.php
- http://fe####quarter.net/index.php
UDP
- DNS ASK ev####gnotice.net
- DNS ASK de###enorth.net
- DNS ASK st####thclear.net
- DNS ASK st####thgeneral.net
- DNS ASK st####thinclude.net
- DNS ASK st####thnorth.net
- DNS ASK mo####ntbranch.net
- DNS ASK ou####ebranch.net
- DNS ASK mo####ntbelieve.net
- DNS ASK ou####ebelieve.net
- DNS ASK mo####ntreceive.net
- DNS ASK ou####ereceive.net
- DNS ASK mo####ntquarter.net
- DNS ASK ou####equarter.net
- DNS ASK bu####ngbranch.net
- DNS ASK ev####gbranch.net
- DNS ASK pr####enorth.net
- DNS ASK fe###wclear.net
- DNS ASK de####include.net
- DNS ASK de####general.net
- DNS ASK fe####general.net
- DNS ASK fe####include.net
- DNS ASK fe###wnorth.net
- DNS ASK do###enorth.net
- DNS ASK br###nclear.net
- DNS ASK re###tclear.net
- DNS ASK br####general.net
- DNS ASK re####general.net
- DNS ASK br####include.net
- DNS ASK re####include.net
- DNS ASK br###nnorth.net
- DNS ASK re###tnorth.net
- DNS ASK pr####eclear.net
- DNS ASK de###eclear.net
- DNS ASK pr####egeneral.net
- DNS ASK pr####einclude.net
- DNS ASK do###eclear.net
- DNS ASK bu####ngbelieve.net
- DNS ASK bu####ngquarter.net
- DNS ASK fe####believe.net
- DNS ASK fe####receive.net
- DNS ASK fe####quarter.net
- DNS ASK br####branch.net
- DNS ASK re####branch.net
- DNS ASK br####believe.net
- DNS ASK mo####ntgeneral.net
- DNS ASK re####believe.net
- DNS ASK re####receive.net
- DNS ASK br####quarter.net
- DNS ASK re####quarter.net
- DNS ASK pr####ebranch.net
- DNS ASK de####branch.net
- DNS ASK pr####ebelieve.net
- DNS ASK pr####quarter.net
- DNS ASK fe####branch.net
- DNS ASK bu####ngreceive.net
- DNS ASK ev####gbelieve.net
- DNS ASK do####receive.net
- DNS ASK ev####gquarter.net
- DNS ASK st###branch.net
- DNS ASK mi###branch.net
- DNS ASK st####elieve.net
- DNS ASK mi####elieve.net
- DNS ASK st####eceive.net
- DNS ASK mi####eceive.net
- DNS ASK st####uarter.net
- DNS ASK mi####uarter.net
- DNS ASK do####branch.net
- DNS ASK pr####branch.net
- DNS ASK do####believe.net
- DNS ASK pr####believe.net
- DNS ASK pr####receive.net
- DNS ASK ev####greceive.net
- DNS ASK do####quarter.net
- DNS ASK pr###ynorth.net
- DNS ASK do###rnorth.net
- DNS ASK pr####include.net
- DNS ASK fe####length.net
- DNS ASK fe####notice.net
- DNS ASK fe####indeed.net
- DNS ASK fe####during.net
- DNS ASK br####length.net
- DNS ASK re####length.net
- DNS ASK br####notice.net
- DNS ASK re####notice.net
- DNS ASK br####indeed.net
- DNS ASK re####indeed.net
- DNS ASK br####during.net
- DNS ASK re####during.net
- DNS ASK pr####elength.net
- DNS ASK de####length.net
- DNS ASK do####during.net
- DNS ASK pr####enotice.net
- DNS ASK pr####indeed.net
- DNS ASK pr####notice.net
- DNS ASK bu####ngindeed.net
- DNS ASK ev####gindeed.net
- DNS ASK bu####ngduring.net
- DNS ASK ev####gduring.net
- DNS ASK st###length.net
- DNS ASK mi###length.net
- DNS ASK st###notice.net
- DNS ASK mi###notice.net
- DNS ASK st###indeed.net
- DNS ASK mi###indeed.net
- DNS ASK st###during.net
- DNS ASK mi###during.net
- DNS ASK do####length.net
- DNS ASK pr####length.net
- DNS ASK do####notice.net
- DNS ASK do####indeed.net
- DNS ASK de####notice.net
- DNS ASK pr####during.net
- DNS ASK pr####eindeed.net
- DNS ASK bu####ngnorth.net
- DNS ASK st###clear.net
- DNS ASK mi###clear.net
- DNS ASK st####eneral.net
- DNS ASK mi####eneral.net
- DNS ASK st####nclude.net
- DNS ASK mi####nclude.net
- DNS ASK st###north.net
- DNS ASK mi###north.net
- DNS ASK do###rclear.net
- DNS ASK pr###yclear.net
- DNS ASK do####general.net
- DNS ASK pr####general.net
- DNS ASK do####include.net
- DNS ASK ev####ginclude.net
- DNS ASK ev####ggeneral.net
- DNS ASK ev####gnorth.net
- DNS ASK bu####nginclude.net
- DNS ASK bu####nggeneral.net
- DNS ASK de####indeed.net
- DNS ASK de####during.net
- DNS ASK st####thlength.net
- DNS ASK st####thnotice.net
- DNS ASK st####thindeed.net
- DNS ASK st####thduring.net
- DNS ASK mo####ntclear.net
- DNS ASK de####believe.net
- DNS ASK br####receive.net
- DNS ASK ou####eclear.net
- DNS ASK mo####ntinclude.net
- DNS ASK ou####einclude.net
- DNS ASK mo####ntnorth.net
- DNS ASK ou####enorth.net
- DNS ASK bu####ngclear.net
- DNS ASK ev####gclear.net
- DNS ASK pr####eduring.net
- DNS ASK ou####egeneral.net
- DNS ASK pr####ereceive.net
Miscellaneous
Creates and executes the following
- 'C:\hdedhzv\xkdsuqqorpprspa.exe'
- 'C:\hdedhzv\athaxfeswey.exe'
- 'C:\hdedhzv\tegyadzyqq.exe' "c:\hdedhzv\athaxfeswey.exe"
