Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Block Trap Telephony Framework] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Block Trap Telephony Framework] 'ImagePath' = 'C:\rnodvdx\suqvdlvibwy.exe'
Creates the following services
- 'Block Trap Telephony Framework' C:\rnodvdx\suqvdlvibwy.exe
Modifies file system
Creates the following files
- %WINDIR%\rnodvdx\lv7ybefb5ke
- C:\rnodvdx\lv7ybefb5ke
- C:\rnodvdx\opzxod3gltpdxpedb.exe
- C:\rnodvdx\suqvdlvibwy.exe
- C:\rnodvdx\obaraiezhpxe.exe
- C:\rnodvdx\gjzrgnodqc
Sets the 'hidden' attribute to the following files
- C:\rnodvdx\suqvdlvibwy.exe
- C:\rnodvdx\obaraiezhpxe.exe
Deletes the following files
- %WINDIR%\rnodvdx\lv7ybefb5ke
- C:\rnodvdx\opzxod3gltpdxpedb.exe
Substitutes the following files
- %WINDIR%\rnodvdx\lv7ybefb5ke
Network activity
Connects to
- 'fr###shake.net':80
- 'ex####enceshare.net':80
- 'kn###share.net':80
- 'su###rshare.net':80
- 'cr###share.net':80
- 'wa###share.net':80
- 'fr####roduce.net':80
- 'pa####tudent.net':80
- 'fi####tudent.net':80
TCP
HTTP GET requests
- http://fr###shake.net/index.php
- http://ex####enceshare.net/index.php
- http://kn###share.net/index.php
- http://su###rshare.net/index.php
- http://cr###share.net/index.php
- http://wa###share.net/index.php
- http://fr####roduce.net/index.php
- http://pa####tudent.net/index.php
- http://fi####tudent.net/index.php
UDP
- DNS ASK fi###river.net
- DNS ASK su####succeed.net
- DNS ASK kn####tudent.net
- DNS ASK be####tudent.net
- DNS ASK kn####roduce.net
- DNS ASK be####roduce.net
- DNS ASK kn####etween.net
- DNS ASK be####etween.net
- DNS ASK kn####ucceed.net
- DNS ASK be####ucceed.net
- DNS ASK me####student.net
- DNS ASK fo####student.net
- DNS ASK me####produce.net
- DNS ASK fo####produce.net
- DNS ASK me####between.net
- DNS ASK me####succeed.net
- DNS ASK su####between.net
- DNS ASK fo####succeed.net
- DNS ASK al####ystudent.net
- DNS ASK ge#####anstudent.net
- DNS ASK al####yproduce.net
- DNS ASK ge#####anproduce.net
- DNS ASK al####ybetween.net
- DNS ASK ge#####anbetween.net
- DNS ASK al####ysucceed.net
- DNS ASK ge#####ansucceed.net
- DNS ASK ex#####ncestudent.net
- DNS ASK fr####tudent.net
- DNS ASK ex#####nceproduce.net
- DNS ASK fr####roduce.net
- DNS ASK fo####between.net
- DNS ASK wo###nearly.net
- DNS ASK cr####etween.net
- DNS ASK fr####lossary.net
- DNS ASK ex####enceround.net
- DNS ASK fr###round.net
- DNS ASK fi####tudent.net
- DNS ASK pa####tudent.net
- DNS ASK fi####roduce.net
- DNS ASK pa####roduce.net
- DNS ASK fi####etween.net
- DNS ASK pa####etween.net
- DNS ASK fi####ucceed.net
- DNS ASK pa####ucceed.net
- DNS ASK sm####tudent.net
- DNS ASK wo####tudent.net
- DNS ASK sm####roduce.net
- DNS ASK ex#####ncebetween.net
- DNS ASK cr####ucceed.net
- DNS ASK wo####etween.net
- DNS ASK sm####ucceed.net
- DNS ASK wo####ucceed.net
- DNS ASK wa####tudent.net
- DNS ASK th####tstudent.net
- DNS ASK wa####roduce.net
- DNS ASK th####tproduce.net
- DNS ASK wa####etween.net
- DNS ASK th####tbetween.net
- DNS ASK wa####ucceed.net
- DNS ASK th####tsucceed.net
- DNS ASK cr####tudent.net
- DNS ASK su####student.net
- DNS ASK cr####roduce.net
- DNS ASK sm####etween.net
- DNS ASK su####produce.net
- DNS ASK fr####etween.net
- DNS ASK ex#####ncesucceed.net
- DNS ASK fr####ucceed.net
- DNS ASK ge####manshare.net
- DNS ASK be###shake.net
- DNS ASK kn###happen.net
- DNS ASK be###happen.net
- DNS ASK kn###nearly.net
- DNS ASK be###nearly.net
- DNS ASK me###rshare.net
- DNS ASK fo###wshare.net
- DNS ASK me###rshake.net
- DNS ASK fo###wshake.net
- DNS ASK me####happen.net
- DNS ASK fo####happen.net
- DNS ASK me####nearly.net
- DNS ASK fo####nearly.net
- DNS ASK ex#####nceglossary.net
- DNS ASK be###share.net
- DNS ASK al####yshake.net
- DNS ASK ge####manshake.net
- DNS ASK al####yhappen.net
- DNS ASK ge####manhappen.net
- DNS ASK al####ynearly.net
- DNS ASK ge####mannearly.net
- DNS ASK ex####enceshare.net
- DNS ASK fr###share.net
- DNS ASK ex####enceshake.net
- DNS ASK fr###shake.net
- DNS ASK ex#####ncehappen.net
- DNS ASK fr###happen.net
- DNS ASK ex#####ncenearly.net
- DNS ASK fr###nearly.net
- DNS ASK al####yshare.net
- DNS ASK wo####roduce.net
- DNS ASK kn###share.net
- DNS ASK su####happen.net
- DNS ASK su####nearly.net
- DNS ASK fi###share.net
- DNS ASK pa###share.net
- DNS ASK fi###shake.net
- DNS ASK pa###shake.net
- DNS ASK fi###happen.net
- DNS ASK pa###happen.net
- DNS ASK fi###nearly.net
- DNS ASK pa###nearly.net
- DNS ASK sm###share.net
- DNS ASK wo###share.net
- DNS ASK sm###shake.net
- DNS ASK wo###shake.net
- DNS ASK sm###happen.net
- DNS ASK cr###nearly.net
- DNS ASK wo###happen.net
- DNS ASK kn###shake.net
- DNS ASK wa###share.net
- DNS ASK th####tshare.net
- DNS ASK wa###shake.net
- DNS ASK th####tshake.net
- DNS ASK wa###happen.net
- DNS ASK th####thappen.net
- DNS ASK wa###nearly.net
- DNS ASK th####tnearly.net
- DNS ASK cr###share.net
- DNS ASK su###rshare.net
- DNS ASK cr###shake.net
- DNS ASK su###rshake.net
- DNS ASK cr###happen.net
- DNS ASK sm###nearly.net
- DNS ASK fr###likely.net
Miscellaneous
Creates and executes the following
- 'C:\rnodvdx\opzxod3gltpdxpedb.exe'
- 'C:\rnodvdx\suqvdlvibwy.exe'
- 'C:\rnodvdx\obaraiezhpxe.exe' "c:\rnodvdx\suqvdlvibwy.exe"
