Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\CNG Session Authentication] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\CNG Session Authentication] 'ImagePath' = 'C:\zmnkdjgnmxxo\vsqtnsuu.exe'
Creates the following services
- 'CNG Session Authentication' C:\zmnkdjgnmxxo\vsqtnsuu.exe
Modifies file system
Creates the following files
- %WINDIR%\zmnkdjgnmxxo\m7p2bfyny2
- C:\zmnkdjgnmxxo\m7p2bfyny2
- C:\zmnkdjgnmxxo\ca5zwmnpherdarhpikg1m.exe
- C:\zmnkdjgnmxxo\vsqtnsuu.exe
- C:\zmnkdjgnmxxo\vpky8qmg.exe
- C:\zmnkdjgnmxxo\biujdyb
Sets the 'hidden' attribute to the following files
- C:\zmnkdjgnmxxo\vsqtnsuu.exe
- C:\zmnkdjgnmxxo\vpky8qmg.exe
Deletes the following files
- %WINDIR%\zmnkdjgnmxxo\m7p2bfyny2
- C:\zmnkdjgnmxxo\ca5zwmnpherdarhpikg1m.exe
Substitutes the following files
- %WINDIR%\zmnkdjgnmxxo\m7p2bfyny2
Network activity
Connects to
- 'am#####nebethanie.net':80
TCP
HTTP GET requests
- http://am#####nebethanie.net/index.php
UDP
- DNS ASK am######edwerryhouse.net
- DNS ASK al#####rakatherine.net
- DNS ASK ma#####nakatherine.net
- DNS ASK al#####raterrence.net
- DNS ASK ma#####naterrence.net
- DNS ASK al#####rajohnathon.net
- DNS ASK ma#####najohnathon.net
- DNS ASK al#####erbethanie.net
- DNS ASK ka#####nebethanie.net
- DNS ASK al#####erkatherine.net
- DNS ASK ka#####nekatherine.net
- DNS ASK al#####erterrence.net
- DNS ASK ka#####neterrence.net
- DNS ASK al#####erjohnathon.net
- DNS ASK ka#####nejohnathon.net
- DNS ASK ch#####anauttenberg.net
- DNS ASK gw#####reauttenberg.net
- DNS ASK ch######nwitherspoon.net
- DNS ASK ma#####nabethanie.net
- DNS ASK am#####nejohnathon.net
- DNS ASK za#####ahterrence.net
- DNS ASK ce#####nejohnathon.net
- DNS ASK ar#####ldterrence.net
- DNS ASK za#####ahjohnathon.net
- DNS ASK ar#####ldjohnathon.net
- DNS ASK sh#####lebethanie.net
- DNS ASK ch#####nebethanie.net
- DNS ASK sh#####lekatherine.net
- DNS ASK ch#####nekatherine.net
- DNS ASK sh#####leterrence.net
- DNS ASK ch#####neterrence.net
- DNS ASK sh#####lejohnathon.net
- DNS ASK ch#####nejohnathon.net
- DNS ASK ce#####nebethanie.net
- DNS ASK am#####nebethanie.net
- DNS ASK ce#####nekatherine.net
- DNS ASK am#####nekatherine.net
- DNS ASK ce#####neterrence.net
- DNS ASK am#####neterrence.net
- DNS ASK gw######ewitherspoon.net
- DNS ASK al#####rabethanie.net
- DNS ASK ch#####antollemache.net
- DNS ASK za#####ahtollemache.net
- DNS ASK za######hdwerryhouse.net
- DNS ASK ar######ddwerryhouse.net
- DNS ASK sh#####leauttenberg.net
- DNS ASK ch#####neauttenberg.net
- DNS ASK sh######ewitherspoon.net
- DNS ASK ch######ewitherspoon.net
- DNS ASK sh#####letollemache.net
- DNS ASK ch#####netollemache.net
- DNS ASK sh######edwerryhouse.net
- DNS ASK ch######edwerryhouse.net
- DNS ASK ce#####neauttenberg.net
- DNS ASK am#####neauttenberg.net
- DNS ASK ce######ewitherspoon.net
- DNS ASK am######ewitherspoon.net
- DNS ASK ce#####netollemache.net
- DNS ASK am#####netollemache.net
- DNS ASK ce######edwerryhouse.net
- DNS ASK ar#####ldtollemache.net
- DNS ASK ar######dwitherspoon.net
- DNS ASK ch######ndwerryhouse.net
- DNS ASK za######hwitherspoon.net
- DNS ASK gw######edwerryhouse.net
- DNS ASK gu#####enauttenberg.net
- DNS ASK an#####leauttenberg.net
- DNS ASK gu######nwitherspoon.net
- DNS ASK an######ewitherspoon.net
- DNS ASK gu#####entollemache.net
- DNS ASK an#####letollemache.net
- DNS ASK gu######ndwerryhouse.net
- DNS ASK an######edwerryhouse.net
- DNS ASK ch#####leauttenberg.net
- DNS ASK ge#####naauttenberg.net
- DNS ASK ge######awitherspoon.net
- DNS ASK ch#####letollemache.net
- DNS ASK ge#####natollemache.net
- DNS ASK ge######adwerryhouse.net
- DNS ASK za#####ahauttenberg.net
- DNS ASK ar#####ldauttenberg.net
- DNS ASK gw#####retollemache.net
- DNS ASK ar#####ldkatherine.net
Miscellaneous
Creates and executes the following
- 'C:\zmnkdjgnmxxo\ca5zwmnpherdarhpikg1m.exe'
- 'C:\zmnkdjgnmxxo\vsqtnsuu.exe'
- 'C:\zmnkdjgnmxxo\vpky8qmg.exe' "c:\zmnkdjgnmxxo\vsqtnsuu.exe"
