Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\DCOM Secondary Media Experience Block Call] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\DCOM Secondary Media Experience Block Call] 'ImagePath' = 'C:\smvopvm\tfnfkxw.exe'
Creates the following services
- 'DCOM Secondary Media Experience Block Call' C:\smvopvm\tfnfkxw.exe
Modifies file system
Creates the following files
- %WINDIR%\smvopvm\mcup5c
- C:\smvopvm\mcup5c
- C:\smvopvm\lcqmlf4xvjqmknhhiv.exe
- C:\smvopvm\tfnfkxw.exe
- C:\smvopvm\itlxrrj.exe
Sets the 'hidden' attribute to the following files
- C:\smvopvm\tfnfkxw.exe
- C:\smvopvm\itlxrrj.exe
Deletes the following files
- %WINDIR%\smvopvm\mcup5c
- C:\smvopvm\lcqmlf4xvjqmknhhiv.exe
Substitutes the following files
- %WINDIR%\smvopvm\mcup5c
Network activity
Connects to
- 'va####sbetween.net':80
- 'fo####dmethod.net':80
- 'an####direct.net':80
- 'gl###direct.net':80
- 'or###direct.net':80
- 'le####direct.net':80
- 'he###action.net':80
- 'an###rwrite.net':80
TCP
HTTP GET requests
- http://va####sbetween.net/index.php
- http://fo####dmethod.net/index.php
- http://an####direct.net/index.php
- http://gl###direct.net/index.php
- http://or###direct.net/index.php
- http://he###action.net/index.php
UDP
- DNS ASK he####ucceed.net
- DNS ASK di####ultdirect.net
- DNS ASK he###direct.net
- DNS ASK di#####ltbrought.net
- DNS ASK he####rought.net
- DNS ASK pl####ntmethod.net
- DNS ASK di####ultaction.net
- DNS ASK he###action.net
- DNS ASK ne####arymethod.net
- DNS ASK pl####ntdirect.net
- DNS ASK ne####arydirect.net
- DNS ASK pl####ntbrought.net
- DNS ASK ne#####rybrought.net
- DNS ASK or###method.net
- DNS ASK pl####ntaction.net
- DNS ASK ne####aryaction.net
- DNS ASK he###method.net
- DNS ASK di####ultmethod.net
- DNS ASK gl####rought.net
- DNS ASK fo####dmethod.net
- DNS ASK de####action.net
- DNS ASK fo####daction.net
- DNS ASK de####direct.net
- DNS ASK fo####ddirect.net
- DNS ASK de####brought.net
- DNS ASK de####method.net
- DNS ASK fo####dbrought.net
- DNS ASK gl###method.net
- DNS ASK an####action.net
- DNS ASK gl###action.net
- DNS ASK an####direct.net
- DNS ASK gl###direct.net
- DNS ASK an####brought.net
- DNS ASK an####method.net
- DNS ASK re####emethod.net
- DNS ASK or###action.net
- DNS ASK re####eaction.net
- DNS ASK or###direct.net
- DNS ASK va####sdirect.net
- DNS ASK re####direct.net
- DNS ASK va####sbrought.net
- DNS ASK re####brought.net
- DNS ASK de###espeak.net
- DNS ASK fo####dspeak.net
- DNS ASK de###eniece.net
- DNS ASK fo####dniece.net
- DNS ASK de###ewrite.net
- DNS ASK fo####dwrite.net
- DNS ASK de####oclock.net
- DNS ASK fo####doclock.net
- DNS ASK an###rspeak.net
- DNS ASK gl###speak.net
- DNS ASK an###rniece.net
- DNS ASK re####action.net
- DNS ASK re####method.net
- DNS ASK va####saction.net
- DNS ASK va####smethod.net
- DNS ASK re####edirect.net
- DNS ASK or####rought.net
- DNS ASK re####ebrought.net
- DNS ASK le####method.net
- DNS ASK he####method.net
- DNS ASK le####action.net
- DNS ASK he####action.net
- DNS ASK le####direct.net
- DNS ASK he####direct.net
- DNS ASK le####brought.net
- DNS ASK he####brought.net
- DNS ASK ge####method.net
- DNS ASK ge####action.net
- DNS ASK ge####direct.net
- DNS ASK ge####brought.net
- DNS ASK gl###niece.net
- DNS ASK re###nworth.net
- DNS ASK va####sworth.net
- DNS ASK re####likely.net
- DNS ASK fo####dlikely.net
- DNS ASK de###eworth.net
- DNS ASK fo####dworth.net
- DNS ASK an###rround.net
- DNS ASK gl###round.net
- DNS ASK fo####dglossary.net
- DNS ASK de####likely.net
- DNS ASK an####glossary.net
- DNS ASK gl###likely.net
- DNS ASK an###rworth.net
- DNS ASK gl###worth.net
- DNS ASK di####ultround.net
- DNS ASK he###round.net
- DNS ASK gl####lossary.net
- DNS ASK an####likely.net
- DNS ASK de####glossary.net
- DNS ASK fo####dround.net
- DNS ASK de###eround.net
- DNS ASK he####etween.net
- DNS ASK ge####between.net
- DNS ASK he####roduce.net
- DNS ASK ge####produce.net
- DNS ASK he####tudent.net
- DNS ASK ge####student.net
- DNS ASK ge####succeed.net
- DNS ASK va####ssucceed.net
- DNS ASK va####sbetween.net
- DNS ASK re####between.net
- DNS ASK va####sproduce.net
- DNS ASK re####produce.net
- DNS ASK va####sstudent.net
- DNS ASK re####student.net
- DNS ASK re####succeed.net
- DNS ASK di#####ltglossary.net
- DNS ASK he####lossary.net
- DNS ASK di####ultlikely.net
- DNS ASK he###likely.net
- DNS ASK he###nround.net
- DNS ASK le####glossary.net
- DNS ASK he####glossary.net
- DNS ASK le####likely.net
- DNS ASK he####likely.net
- DNS ASK le###rworth.net
- DNS ASK he###nworth.net
- DNS ASK ge###eround.net
- DNS ASK ge####glossary.net
- DNS ASK ge####likely.net
- DNS ASK ge###eworth.net
- DNS ASK va####sround.net
- DNS ASK re###nround.net
- DNS ASK va####sglossary.net
- DNS ASK re####glossary.net
- DNS ASK le###rround.net
- DNS ASK or###worth.net
- DNS ASK re####eworth.net
- DNS ASK re####elikely.net
- DNS ASK di####ultworth.net
- DNS ASK he###worth.net
- DNS ASK pl####ntround.net
- DNS ASK ne####aryround.net
- DNS ASK pl#####tglossary.net
- DNS ASK ne#####ryglossary.net
- DNS ASK pl####ntlikely.net
- DNS ASK ne####arylikely.net
- DNS ASK pl####ntworth.net
- DNS ASK ne####aryworth.net
- DNS ASK or###round.net
- DNS ASK re####eround.net
- DNS ASK or####lossary.net
- DNS ASK re####eglossary.net
- DNS ASK or###likely.net
- DNS ASK va####slikely.net
- DNS ASK an###rwrite.net
Miscellaneous
Creates and executes the following
- 'C:\smvopvm\lcqmlf4xvjqmknhhiv.exe'
- 'C:\smvopvm\tfnfkxw.exe'
- 'C:\smvopvm\itlxrrj.exe' "c:\smvopvm\tfnfkxw.exe"
