Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\File Color Manager Defender] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\File Color Manager Defender] 'ImagePath' = 'C:\mxxzdriv\ligjrdrrl.exe'
Creates the following services
- 'File Color Manager Defender' C:\mxxzdriv\ligjrdrrl.exe
Modifies file system
Creates the following files
- %WINDIR%\mxxzdriv\ypkmdaiu
- C:\mxxzdriv\ypkmdaiu
- C:\mxxzdriv\fjj2sflxzgrawhnf.exe
- C:\mxxzdriv\ligjrdrrl.exe
- C:\mxxzdriv\opibwor.exe
Sets the 'hidden' attribute to the following files
- C:\mxxzdriv\ligjrdrrl.exe
- C:\mxxzdriv\opibwor.exe
Deletes the following files
- %WINDIR%\mxxzdriv\ypkmdaiu
- C:\mxxzdriv\fjj2sflxzgrawhnf.exe
Substitutes the following files
- %WINDIR%\mxxzdriv\ypkmdaiu
Network activity
Connects to
- 'fr###clean.net':80
- 'fr###paint.net':80
- 'fr###women.net':80
- 'su####course.net':80
- 'wa###clean.net':80
- 'wa###course.net':80
- 'wa###women.net':80
- 'sm###clean.net':80
- 'pa###paint.net':80
- 'fr###stream.net':80
- 'ex#####ncestream.net':80
- 'ex#####ncedivide.net':80
TCP
HTTP GET requests
- http://fr###clean.net/index.php
- http://fr###paint.net/index.php
- http://fr###women.net/index.php
- http://su####course.net/index.php
- http://wa###clean.net/index.php
- http://wa###course.net/index.php
- http://wa###women.net/index.php
- http://sm###clean.net/index.php
- http://pa###paint.net/index.php
- http://fr###stream.net/index.php
- http://ex#####ncestream.net/index.php
- http://ex#####ncedivide.net/index.php
UDP
- DNS ASK sw###catch.net
- DNS ASK fi###paint.net
- DNS ASK pa###paint.net
- DNS ASK fi###clean.net
- DNS ASK pa###clean.net
- DNS ASK sm###women.net
- DNS ASK wo###women.net
- DNS ASK sm###course.net
- DNS ASK wo###course.net
- DNS ASK sm###paint.net
- DNS ASK wo###paint.net
- DNS ASK pa###course.net
- DNS ASK sm###clean.net
- DNS ASK wa###women.net
- DNS ASK th####twomen.net
- DNS ASK wa###course.net
- DNS ASK th####tcourse.net
- DNS ASK wa###paint.net
- DNS ASK th####tpaint.net
- DNS ASK wa###clean.net
- DNS ASK th####tclean.net
- DNS ASK cr###women.net
- DNS ASK su###rwomen.net
- DNS ASK wo###clean.net
- DNS ASK fi###course.net
- DNS ASK pa###women.net
- DNS ASK fi###women.net
- DNS ASK fo####divide.net
- DNS ASK me####bottle.net
- DNS ASK fo####bottle.net
- DNS ASK me####nothing.net
- DNS ASK fo####nothing.net
- DNS ASK me####stream.net
- DNS ASK fo####stream.net
- DNS ASK al####ydivide.net
- DNS ASK ge####mandivide.net
- DNS ASK al####ybottle.net
- DNS ASK ge####manbottle.net
- DNS ASK al####ynothing.net
- DNS ASK ge#####annothing.net
- DNS ASK al####ystream.net
- DNS ASK ge####manstream.net
- DNS ASK ex#####ncedivide.net
- DNS ASK fr###divide.net
- DNS ASK ex#####ncebottle.net
- DNS ASK fr###bottle.net
- DNS ASK ex#####ncenothing.net
- DNS ASK fr####othing.net
- DNS ASK ex#####ncestream.net
- DNS ASK fr###stream.net
- DNS ASK cr###course.net
- DNS ASK me####divide.net
- DNS ASK su####course.net
- DNS ASK su###rpaint.net
- DNS ASK fr###women.net
- DNS ASK ex#####ncecourse.net
- DNS ASK fr###course.net
- DNS ASK ex####encepaint.net
- DNS ASK fr###paint.net
- DNS ASK ex####enceclean.net
- DNS ASK fr###clean.net
- DNS ASK ma####aldress.net
- DNS ASK se####ldress.net
- DNS ASK ma####alpublic.net
- DNS ASK ex####encewomen.net
- DNS ASK se####lpublic.net
- DNS ASK se####leearly.net
- DNS ASK ma####alcatch.net
- DNS ASK se####lcatch.net
- DNS ASK pr####lydress.net
- DNS ASK sw###dress.net
- DNS ASK pr####lypublic.net
- DNS ASK sw###public.net
- DNS ASK pr####lyeearly.net
- DNS ASK sw###eearly.net
- DNS ASK pr####lycatch.net
- DNS ASK ma####aleearly.net
- DNS ASK ge####manclean.net
- DNS ASK al####yclean.net
- DNS ASK ge####manpaint.net
- DNS ASK cr###clean.net
- DNS ASK su###rclean.net
- DNS ASK kn###women.net
- DNS ASK be###women.net
- DNS ASK kn###course.net
- DNS ASK be###course.net
- DNS ASK kn###paint.net
- DNS ASK be###paint.net
- DNS ASK kn###clean.net
- DNS ASK be###clean.net
- DNS ASK me###rwomen.net
- DNS ASK fo###wwomen.net
- DNS ASK me####course.net
- DNS ASK fo####course.net
- DNS ASK me###rpaint.net
- DNS ASK fo###wpaint.net
- DNS ASK me###rclean.net
- DNS ASK fo###wclean.net
- DNS ASK al####ywomen.net
- DNS ASK ge####manwomen.net
- DNS ASK al####ycourse.net
- DNS ASK ge####mancourse.net
- DNS ASK al####ypaint.net
- DNS ASK cr###paint.net
- DNS ASK be###stream.net
Miscellaneous
Creates and executes the following
- 'C:\mxxzdriv\fjj2sflxzgrawhnf.exe'
- 'C:\mxxzdriv\ligjrdrrl.exe'
- 'C:\mxxzdriv\opibwor.exe' "c:\mxxzdriv\ligjrdrrl.exe"
