Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Function Remote Machine Background] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Function Remote Machine Background] 'ImagePath' = 'C:\ygozcpskyrxw\ohlfuvgevqu.exe'
Creates the following services
- 'Function Remote Machine Background' C:\ygozcpskyrxw\ohlfuvgevqu.exe
Modifies file system
Creates the following files
- %WINDIR%\ygozcpskyrxw\p8bnmlzu
- C:\ygozcpskyrxw\p8bnmlzu
- C:\ygozcpskyrxw\lfjgvvkjbjho5wgm.exe
- C:\ygozcpskyrxw\ohlfuvgevqu.exe
- C:\ygozcpskyrxw\ennscfmhjgw.exe
Sets the 'hidden' attribute to the following files
- C:\ygozcpskyrxw\ohlfuvgevqu.exe
- C:\ygozcpskyrxw\ennscfmhjgw.exe
Deletes the following files
- %WINDIR%\ygozcpskyrxw\p8bnmlzu
- C:\ygozcpskyrxw\lfjgvvkjbjho5wgm.exe
Substitutes the following files
- %WINDIR%\ygozcpskyrxw\p8bnmlzu
Network activity
Connects to
- 'be###short.net':80
- 'cr###short.net':80
- 'fr###office.net':80
- 'ex#####nceoffice.net':80
- 'me####office.net':80
- 'kn####istance.net':80
- 'cr###supply.net':80
- 'su####office.net':80
- 'cr###office.net':80
TCP
HTTP GET requests
- http://cr###short.net/index.php
- http://fr###office.net/index.php
- http://me####office.net/index.php
- http://kn####istance.net/index.php
- http://cr###supply.net/index.php
- http://su####office.net/index.php
- http://cr###office.net/index.php
UDP
- DNS ASK ex#####nceopinion.net
- DNS ASK ge####manoffice.net
- DNS ASK al####ydistance.net
- DNS ASK ge#####andistance.net
- DNS ASK al####ysupply.net
- DNS ASK ge####mansupply.net
- DNS ASK ex#####ncearrive.net
- DNS ASK fr###arrive.net
- DNS ASK ex#####nceoffice.net
- DNS ASK fr###office.net
- DNS ASK ex#####ncedistance.net
- DNS ASK fr####istance.net
- DNS ASK ex#####ncesupply.net
- DNS ASK fr###supply.net
- DNS ASK fi####romise.net
- DNS ASK pa####romise.net
- DNS ASK fi####pinion.net
- DNS ASK pa####pinion.net
- DNS ASK fi###short.net
- DNS ASK pa###short.net
- DNS ASK fi###should.net
- DNS ASK pa###should.net
- DNS ASK al####yoffice.net
- DNS ASK al####yarrive.net
- DNS ASK su####arrive.net
- DNS ASK fo####supply.net
- DNS ASK cr###office.net
- DNS ASK su####office.net
- DNS ASK cr####istance.net
- DNS ASK su####distance.net
- DNS ASK cr###supply.net
- DNS ASK su####supply.net
- DNS ASK kn###arrive.net
- DNS ASK be###arrive.net
- DNS ASK kn###office.net
- DNS ASK be###office.net
- DNS ASK kn####istance.net
- DNS ASK be####istance.net
- DNS ASK kn###supply.net
- DNS ASK be###supply.net
- DNS ASK me####arrive.net
- DNS ASK fo####arrive.net
- DNS ASK me####office.net
- DNS ASK fo####office.net
- DNS ASK me####distance.net
- DNS ASK fo####distance.net
- DNS ASK me####supply.net
- DNS ASK sm####romise.net
- DNS ASK ge####manarrive.net
- DNS ASK wo####romise.net
- DNS ASK be####pinion.net
- DNS ASK be###short.net
- DNS ASK kn###should.net
- DNS ASK be###should.net
- DNS ASK me####promise.net
- DNS ASK fo####promise.net
- DNS ASK me####opinion.net
- DNS ASK fo####opinion.net
- DNS ASK me###rshort.net
- DNS ASK fo###wshort.net
- DNS ASK me####should.net
- DNS ASK fo####should.net
- DNS ASK al####ypromise.net
- DNS ASK ge#####anpromise.net
- DNS ASK al####yopinion.net
- DNS ASK ge#####anopinion.net
- DNS ASK al####yshort.net
- DNS ASK ge####manshort.net
- DNS ASK al####yshould.net
- DNS ASK ge####manshould.net
- DNS ASK ex#####ncepromise.net
- DNS ASK fr####romise.net
- DNS ASK kn###short.net
- DNS ASK kn####pinion.net
- DNS ASK wo####pinion.net
- DNS ASK be####romise.net
- DNS ASK sm###short.net
- DNS ASK wo###short.net
- DNS ASK sm###should.net
- DNS ASK wo###should.net
- DNS ASK wa####romise.net
- DNS ASK th####tpromise.net
- DNS ASK wa####pinion.net
- DNS ASK th####topinion.net
- DNS ASK wa###short.net
- DNS ASK th####tshort.net
- DNS ASK wa###should.net
- DNS ASK th####tshould.net
- DNS ASK cr####romise.net
- DNS ASK su####promise.net
- DNS ASK cr####pinion.net
- DNS ASK su####opinion.net
- DNS ASK cr###short.net
- DNS ASK su###rshort.net
- DNS ASK cr###should.net
- DNS ASK su####should.net
- DNS ASK kn####romise.net
- DNS ASK sm####pinion.net
- DNS ASK cr###arrive.net
Miscellaneous
Creates and executes the following
- 'C:\ygozcpskyrxw\lfjgvvkjbjho5wgm.exe'
- 'C:\ygozcpskyrxw\ohlfuvgevqu.exe'
- 'C:\ygozcpskyrxw\ennscfmhjgw.exe' "c:\ygozcpskyrxw\ohlfuvgevqu.exe"
