Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Name Service Port Plug Configuration] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Name Service Port Plug Configuration] 'ImagePath' = 'C:\gjrjkxoubvde\unlsoyp.exe'
Creates the following services
- 'Name Service Port Plug Configuration' C:\gjrjkxoubvde\unlsoyp.exe
Modifies file system
Creates the following files
- %WINDIR%\gjrjkxoubvde\qyzyatb
- C:\gjrjkxoubvde\qyzyatb
- C:\gjrjkxoubvde\xnjqyzngbzssibt.exe
- C:\gjrjkxoubvde\unlsoyp.exe
- C:\gjrjkxoubvde\hjhzkdgawab.exe
Sets the 'hidden' attribute to the following files
- C:\gjrjkxoubvde\unlsoyp.exe
- C:\gjrjkxoubvde\hjhzkdgawab.exe
Deletes the following files
- %WINDIR%\gjrjkxoubvde\qyzyatb
- C:\gjrjkxoubvde\xnjqyzngbzssibt.exe
Substitutes the following files
- %WINDIR%\gjrjkxoubvde\qyzyatb
Network activity
Connects to
- 'fr####ervice.net':80
- 'fr###river.net':80
- 'localhost':80
- 'me####service.net':80
TCP
HTTP GET requests
- http://fr####ervice.net/index.php
- http://fr###river.net/index.php
- http://me####service.net/index.php
UDP
- DNS ASK th#####understand.net
- DNS ASK pa####ifteen.net
- DNS ASK fi###dried.net
- DNS ASK pa###dried.net
- DNS ASK sm####rticle.net
- DNS ASK wo####rticle.net
- DNS ASK sm###angry.net
- DNS ASK wo###angry.net
- DNS ASK sm####ifteen.net
- DNS ASK wo####ifteen.net
- DNS ASK sm###dried.net
- DNS ASK wo###dried.net
- DNS ASK cr###dried.net
- DNS ASK wa####rticle.net
- DNS ASK wa###angry.net
- DNS ASK th####tangry.net
- DNS ASK wa####ifteen.net
- DNS ASK th####tfifteen.net
- DNS ASK wa###dried.net
- DNS ASK th####tdried.net
- DNS ASK cr####rticle.net
- DNS ASK su####article.net
- DNS ASK cr###angry.net
- DNS ASK su###rangry.net
- DNS ASK cr####ifteen.net
- DNS ASK th####tarticle.net
- DNS ASK su####fifteen.net
- DNS ASK fi####ifteen.net
- DNS ASK al####ymister.net
- DNS ASK me####service.net
- DNS ASK fo####service.net
- DNS ASK me####suppose.net
- DNS ASK fo####suppose.net
- DNS ASK me####mister.net
- DNS ASK fo####mister.net
- DNS ASK al####yriver.net
- DNS ASK ge####manriver.net
- DNS ASK al####yservice.net
- DNS ASK ge#####anservice.net
- DNS ASK al####ysuppose.net
- DNS ASK fi###angry.net
- DNS ASK pa###angry.net
- DNS ASK ge####manmister.net
- DNS ASK ex####enceriver.net
- DNS ASK fr###river.net
- DNS ASK ex#####nceservice.net
- DNS ASK fr####ervice.net
- DNS ASK ex#####ncesuppose.net
- DNS ASK fr####uppose.net
- DNS ASK ex#####ncemister.net
- DNS ASK fr###mister.net
- DNS ASK fi####rticle.net
- DNS ASK pa####rticle.net
- DNS ASK ge#####ansuppose.net
- DNS ASK su###rdried.net
- DNS ASK kn####rticle.net
- DNS ASK be####rticle.net
- DNS ASK fi###butter.net
- DNS ASK pa###butter.net
- DNS ASK fi###behind.net
- DNS ASK pa###behind.net
- DNS ASK fi###broad.net
- DNS ASK pa###broad.net
- DNS ASK fi####nderstand.net
- DNS ASK pa####nderstand.net
- DNS ASK sm###butter.net
- DNS ASK wo###butter.net
- DNS ASK ex####encedried.net
- DNS ASK sm###behind.net
- DNS ASK sm###broad.net
- DNS ASK wo###broad.net
- DNS ASK sm####nderstand.net
- DNS ASK wo####nderstand.net
- DNS ASK wa###butter.net
- DNS ASK th####tbutter.net
- DNS ASK wa###behind.net
- DNS ASK th####tbehind.net
- DNS ASK wa###broad.net
- DNS ASK th####tbroad.net
- DNS ASK wa####nderstand.net
- DNS ASK wo###behind.net
- DNS ASK fr####ifteen.net
- DNS ASK fr###dried.net
- DNS ASK ex#####ncefifteen.net
- DNS ASK kn###angry.net
- DNS ASK me###rdried.net
- DNS ASK be###angry.net
- DNS ASK kn####ifteen.net
- DNS ASK be####ifteen.net
- DNS ASK kn###dried.net
- DNS ASK be###dried.net
- DNS ASK me####article.net
- DNS ASK fo####article.net
- DNS ASK me###rangry.net
- DNS ASK fo###wangry.net
- DNS ASK me####fifteen.net
- DNS ASK fo####fifteen.net
- DNS ASK fo###wdried.net
- DNS ASK fr###angry.net
- DNS ASK al####yarticle.net
- DNS ASK ge#####anarticle.net
- DNS ASK al####yangry.net
- DNS ASK ge####manangry.net
- DNS ASK al####yfifteen.net
- DNS ASK ge#####anfifteen.net
- DNS ASK al####ydried.net
- DNS ASK ge####mandried.net
- DNS ASK ex#####ncearticle.net
- DNS ASK fr####rticle.net
- DNS ASK ex####enceangry.net
- DNS ASK fo###wriver.net
- DNS ASK me###rriver.net
Miscellaneous
Creates and executes the following
- 'C:\gjrjkxoubvde\xnjqyzngbzssibt.exe'
- 'C:\gjrjkxoubvde\unlsoyp.exe'
- 'C:\gjrjkxoubvde\hjhzkdgawab.exe' "c:\gjrjkxoubvde\unlsoyp.exe"
