Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\DNS Time Foundation Store Superfetch] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\DNS Time Foundation Store Superfetch] 'ImagePath' = 'C:\nziiljjeec\ldwpjqqhs.exe'
Creates the following services
- 'DNS Time Foundation Store Superfetch' C:\nziiljjeec\ldwpjqqhs.exe
Modifies file system
Creates the following files
- %WINDIR%\nziiljjeec\hfmorulnwq9q
- C:\nziiljjeec\hfmorulnwq9q
- C:\nziiljjeec\inqbaorqcir0tyv.exe
- C:\nziiljjeec\ldwpjqqhs.exe
- C:\nziiljjeec\bdvbtkxueu.exe
Sets the 'hidden' attribute to the following files
- C:\nziiljjeec\ldwpjqqhs.exe
- C:\nziiljjeec\bdvbtkxueu.exe
Deletes the following files
- %WINDIR%\nziiljjeec\hfmorulnwq9q
- C:\nziiljjeec\inqbaorqcir0tyv.exe
Substitutes the following files
- %WINDIR%\nziiljjeec\hfmorulnwq9q
Network activity
Connects to
- 'en####hlanguage.net':80
- 'ex####success.net':80
- 'pe####success.net':80
- 'fa###yfound.net':80
- 'fa####success.net':80
- 'en####hfound.net':80
- 'ma####eguard.net':80
- 'ri###guard.net':80
- 'fa###yguard.net':80
- 'fa###yfence.net':80
- 'bu#####gtogether.net':80
- 'bu####ngcontrol.net':80
- 'mi###spent.net':80
- 'st####ogether.net':80
- 'st####ontrol.net':80
TCP
HTTP GET requests
- http://en####hlanguage.net/index.php
- http://ex####success.net/index.php
- http://pe####success.net/index.php
- http://fa###yfound.net/index.php
- http://fa####success.net/index.php
- http://en####hfound.net/index.php
- http://ma####eguard.net/index.php
- http://ri###guard.net/index.php
- http://fa###yguard.net/index.php
- http://fa###yfence.net/index.php
- http://bu#####gtogether.net/index.php
- http://bu####ngcontrol.net/index.php
- http://mi###spent.net/index.php
- http://st####ogether.net/index.php
- http://st####ontrol.net/index.php
UDP
- DNS ASK ch####ensettle.net
- DNS ASK ri###guard.net
- DNS ASK wh####rfence.net
- DNS ASK ri###fence.net
- DNS ASK fi####airplane.net
- DNS ASK th####airplane.net
- DNS ASK fi####straight.net
- DNS ASK th####straight.net
- DNS ASK pi####efence.net
- DNS ASK fi###eguard.net
- DNS ASK fi###efence.net
- DNS ASK th###hfence.net
- DNS ASK pi####eairplane.net
- DNS ASK ci#####teairplane.net
- DNS ASK pi####estraight.net
- DNS ASK ci#####testraight.net
- DNS ASK pi####eguard.net
- DNS ASK ri####traight.net
- DNS ASK wh####rguard.net
- DNS ASK th###hguard.net
- DNS ASK ci####tteguard.net
- DNS ASK wh####rairplane.net
- DNS ASK ma####eairplane.net
- DNS ASK pe####straight.net
- DNS ASK ma####estraight.net
- DNS ASK pe###nguard.net
- DNS ASK ma####eguard.net
- DNS ASK pe###nfence.net
- DNS ASK ma####efence.net
- DNS ASK su####airplane.net
- DNS ASK fo####nairplane.net
- DNS ASK su####straight.net
- DNS ASK fo####nstraight.net
- DNS ASK su###nguard.net
- DNS ASK fo####nguard.net
- DNS ASK su###nfence.net
- DNS ASK fo####nfence.net
- DNS ASK ri####irplane.net
- DNS ASK be####efence.net
- DNS ASK wh####rstraight.net
- DNS ASK th####success.net
- DNS ASK ci####ttefence.net
- DNS ASK ou####econtrol.net
- DNS ASK ev####gmatter.net
- DNS ASK bu####ngspent.net
- DNS ASK ev####gspent.net
- DNS ASK bu#####gtogether.net
- DNS ASK ev####gtogether.net
- DNS ASK bu####ngcontrol.net
- DNS ASK ev####gcontrol.net
- DNS ASK ch#####nairplane.net
- DNS ASK st###matter.net
- DNS ASK st###spent.net
- DNS ASK mi###spent.net
- DNS ASK st####ogether.net
- DNS ASK mi####ogether.net
- DNS ASK st####ontrol.net
- DNS ASK mi####ontrol.net
- DNS ASK mo####ntcontrol.net
- DNS ASK ou####etogether.net
- DNS ASK bu####ngmatter.net
- DNS ASK mo#####ttogether.net
- DNS ASK ou####espent.net
- DNS ASK fa####airplane.net
- DNS ASK fa####straight.net
- DNS ASK ch####enguard.net
- DNS ASK fa###yguard.net
- DNS ASK ch####enfence.net
- DNS ASK fa###yfence.net
- DNS ASK ei####airplane.net
- DNS ASK ex###tfence.net
- DNS ASK en####hairplane.net
- DNS ASK pe####airplane.net
- DNS ASK en####hstraight.net
- DNS ASK en####hguard.net
- DNS ASK ei###rfence.net
- DNS ASK en####hfence.net
- DNS ASK mo####ntmatter.net
- DNS ASK ou####ematter.net
- DNS ASK mo####ntspent.net
- DNS ASK ei####straight.net
- DNS ASK ch#####nstraight.net
- DNS ASK ei###rguard.net
- DNS ASK be####eguard.net
- DNS ASK ex###tguard.net
- DNS ASK be####estraight.net
- DNS ASK ma####efound.net
- DNS ASK pe####spring.net
- DNS ASK ma####espring.net
- DNS ASK pe####success.net
- DNS ASK ma####esuccess.net
- DNS ASK pe####banker.net
- DNS ASK ma####ebanker.net
- DNS ASK su###nfound.net
- DNS ASK fo####nfound.net
- DNS ASK su####spring.net
- DNS ASK fo####nspring.net
- DNS ASK su####success.net
- DNS ASK fo####nsuccess.net
- DNS ASK su####banker.net
- DNS ASK fo####nbanker.net
- DNS ASK ex####banker.net
- DNS ASK ex####success.net
- DNS ASK pe###nfound.net
- DNS ASK be####esuccess.net
- DNS ASK be####espring.net
- DNS ASK ei####language.net
- DNS ASK ch#####nlanguage.net
- DNS ASK fa####language.net
- DNS ASK ch####endevice.net
- DNS ASK fa####device.net
- DNS ASK ch####enbefore.net
- DNS ASK fa####before.net
- DNS ASK ei####settle.net
- DNS ASK wh####rfound.net
- DNS ASK do####matter.net
- DNS ASK en####hsettle.net
- DNS ASK ei####device.net
- DNS ASK en####hdevice.net
- DNS ASK ei####before.net
- DNS ASK en####hbefore.net
- DNS ASK ex###tfound.net
- DNS ASK be####efound.net
- DNS ASK ex####spring.net
- DNS ASK fa####settle.net
- DNS ASK en####hlanguage.net
- DNS ASK mi###matter.net
- DNS ASK ri###found.net
- DNS ASK ri####uccess.net
- DNS ASK ch####ensuccess.net
- DNS ASK fa####success.net
- DNS ASK ch####enbanker.net
- DNS ASK fa####banker.net
- DNS ASK ei###rfound.net
- DNS ASK en####hfound.net
- DNS ASK be####ebanker.net
- DNS ASK ei####spring.net
- DNS ASK ei####success.net
- DNS ASK en####hsuccess.net
- DNS ASK ei####banker.net
- DNS ASK en####hbanker.net
- DNS ASK ex####airplane.net
- DNS ASK be####eairplane.net
- DNS ASK ex####straight.net
- DNS ASK fa###yfound.net
- DNS ASK en####hspring.net
- DNS ASK fa####spring.net
- DNS ASK ch####enspring.net
- DNS ASK ch####enfound.net
- DNS ASK ci####ttebanker.net
- DNS ASK wh####rbanker.net
- DNS ASK ri###banker.net
- DNS ASK fi###efound.net
- DNS ASK th###hfound.net
- DNS ASK fi####spring.net
- DNS ASK th####spring.net
- DNS ASK wh####rspring.net
- DNS ASK fi####success.net
- DNS ASK ri###spring.net
- DNS ASK fi####banker.net
- DNS ASK pi####efound.net
- DNS ASK ci####ttefound.net
- DNS ASK pi####espring.net
- DNS ASK ci####ttespring.net
- DNS ASK pi####esuccess.net
- DNS ASK ci#####tesuccess.net
- DNS ASK wh####rsuccess.net
- DNS ASK pi####ebanker.net
- DNS ASK th####banker.net
- DNS ASK pr####matter.net
Miscellaneous
Creates and executes the following
- 'C:\nziiljjeec\inqbaorqcir0tyv.exe'
- 'C:\nziiljjeec\ldwpjqqhs.exe'
- 'C:\nziiljjeec\bdvbtkxueu.exe' "c:\nziiljjeec\ldwpjqqhs.exe"
