Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Solutions Now Microsoft Scheduler Support] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Solutions Now Microsoft Scheduler Support] 'ImagePath' = 'C:\nyttabaowmsz\atla4xnqll.exe'
Creates the following services
- 'Solutions Now Microsoft Scheduler Support' C:\nyttabaowmsz\atla4xnqll.exe
Modifies file system
Creates the following files
- %WINDIR%\nyttabaowmsz\nlunbjvima
- C:\nyttabaowmsz\nlunbjvima
- C:\nyttabaowmsz\ozetxyljrx8mhpchbhoqv.exe
- C:\nyttabaowmsz\atla4xnqll.exe
- C:\nyttabaowmsz\h80slor.exe
- C:\nyttabaowmsz\pjcnmcfi4y
Sets the 'hidden' attribute to the following files
- C:\nyttabaowmsz\atla4xnqll.exe
- C:\nyttabaowmsz\h80slor.exe
Deletes the following files
- %WINDIR%\nyttabaowmsz\nlunbjvima
- C:\nyttabaowmsz\ozetxyljrx8mhpchbhoqv.exe
Substitutes the following files
- %WINDIR%\nyttabaowmsz\nlunbjvima
Network activity
Connects to
- 'sp##tnav.ru':80
TCP
HTTP GET requests
- http://sp##tnav.ru/index.php
UDP
- DNS ASK ta#####pielenreiten.org
- DNS ASK ce#####neauttenberg.net
- DNS ASK am#####neauttenberg.net
- DNS ASK am######ewitherspoon.net
- DNS ASK ce######ewitherspoon.net
- DNS ASK ce#####netollemache.net
- DNS ASK ce#####netollemache.ru
- DNS ASK am#####netollemache.net
- DNS ASK ce######edwerryhouse.net
- DNS ASK al#####raauttenberg.net
- DNS ASK am######edwerryhouse.net
- DNS ASK ma#####naauttenberg.ru
- DNS ASK ma#####naauttenberg.net
- DNS ASK al######awitherspoon.net
- DNS ASK ma######awitherspoon.net
- DNS ASK al#####ratollemache.net
- DNS ASK ma#####natollemache.net
- DNS ASK al######adwerryhouse.net
- DNS ASK al#####radwerryhouse.ru
- DNS ASK ka#####neauttenberg.net
- DNS ASK ma######adwerryhouse.net
- DNS ASK al#####erauttenberg.net
- DNS ASK al######rwitherspoon.net
- DNS ASK ka#####newitherspoon.ru
- DNS ASK ch#####nedwerryhouse.ru
- DNS ASK sh######edwerryhouse.net
- DNS ASK an######edwerryhouse.net
- DNS ASK ch#####netollemache.net
- DNS ASK ch#####leauttenberg.net
- DNS ASK ge#####naauttenberg.net
- DNS ASK ge#####nawitherspoon.ru
- DNS ASK ge######awitherspoon.net
- DNS ASK ch#####letollemache.net
- DNS ASK ge#####natollemache.net
- DNS ASK ge######adwerryhouse.net
- DNS ASK za#####ahauttenberg.net
- DNS ASK ar#####ldauttenberg.net
- DNS ASK za#####ahauttenberg.ru
- DNS ASK ar######dwitherspoon.net
- DNS ASK za######hwitherspoon.net
- DNS ASK za#####ahtollemache.net
- DNS ASK ar#####ldtollemache.net
- DNS ASK ar#####ldtollemache.ru
- DNS ASK za######hdwerryhouse.net
- DNS ASK ar######ddwerryhouse.net
- DNS ASK sh#####leauttenberg.net
- DNS ASK ch#####neauttenberg.net
- DNS ASK sh#####lewitherspoon.ru
- DNS ASK sh######ewitherspoon.net
- DNS ASK ch######ewitherspoon.net
- DNS ASK sh#####letollemache.net
- DNS ASK ka######ewitherspoon.net
- DNS ASK ch######edwerryhouse.net
- DNS ASK al#####ertollemache.net
- DNS ASK bu####rmansion.com
- DNS ASK si###ypeas.net
- DNS ASK ha####nhalflion.net
- DNS ASK sc####ainbow.net
- DNS ASK gu##155.cn
- DNS ASK ch####isportsmen.ru
- DNS ASK pr##card.ru
- DNS ASK ag#####anabolics.com
- DNS ASK pi##asia.cn
- DNS ASK to###tosales.ru
- DNS ASK sp##tnav.ru
- DNS ASK so####ryducks.com
- DNS ASK ye####gdongwu.cn
- DNS ASK cl#####ortswomen.com
- DNS ASK pr####anabolikov.ru
- DNS ASK un###lgrain.org
- DNS ASK ga#####yundongyuan.cn
- DNS ASK sc#####epuzzlechess.org
- DNS ASK do##bate.cn
- DNS ASK ca#####eeitinthecup.org
- DNS ASK ga####liongrass.net
- DNS ASK gr###factory.cn
- DNS ASK cl####portsmen.com
- DNS ASK na##top.ru
- DNS ASK ka#######ayajivayapriroda.ru
- DNS ASK ch######echristophers.net
- DNS ASK al######rdwerryhouse.net
- DNS ASK ge######achristophers.net
- DNS ASK ka######edwerryhouse.net
- DNS ASK ch#####anmerrickson.net
- DNS ASK gw#####remerrickson.net
- DNS ASK ch#####anmerrickson.ru
- DNS ASK ch######nchristophers.net
- DNS ASK gw######echristophers.net
- DNS ASK ch#####anhuddleston.net
- DNS ASK gw#####rehuddleston.ru
- DNS ASK gw#####rehuddleston.net
- DNS ASK an#####lemerrickson.net
- DNS ASK ch######nmiddlesworth.net
- DNS ASK gu#####enmerrickson.net
- DNS ASK gw######emiddlesworth.net
- DNS ASK gu######nchristophers.net
- DNS ASK gu#####enhuddleston.net
- DNS ASK gu######nchristophers.ru
- DNS ASK an######echristophers.net
- DNS ASK an#####lehuddleston.net
- DNS ASK gu######nmiddlesworth.net
- DNS ASK an######emiddlesworth.ru
- DNS ASK an######emiddlesworth.net
- DNS ASK ch#####lemerrickson.net
- DNS ASK ge#####namerrickson.net
- DNS ASK ka#####netollemache.net
- DNS ASK gu#####endwerryhouse.ru
Miscellaneous
Creates and executes the following
- 'C:\nyttabaowmsz\ozetxyljrx8mhpchbhoqv.exe'
- 'C:\nyttabaowmsz\atla4xnqll.exe'
- 'C:\nyttabaowmsz\h80slor.exe' "c:\nyttabaowmsz\atla4xnqll.exe"
