Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Computer Protection Telephony Microsoft Print] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Computer Protection Telephony Microsoft Print] 'ImagePath' = 'C:\jxyvaqfinclhfo\xdtihidohntk.exe'
Creates the following services
- 'Computer Protection Telephony Microsoft Print' C:\jxyvaqfinclhfo\xdtihidohntk.exe
Modifies file system
Creates the following files
- %WINDIR%\jxyvaqfinclhfo\bnpvfwefvfaf
- C:\jxyvaqfinclhfo\bnpvfwefvfaf
- C:\jxyvaqfinclhfo\pjtysm8pie5lwzpimyvp.exe
- C:\jxyvaqfinclhfo\xdtihidohntk.exe
- C:\jxyvaqfinclhfo\bltkukuowyrp.exe
- C:\jxyvaqfinclhfo\djyga2jh90w
Sets the 'hidden' attribute to the following files
- C:\jxyvaqfinclhfo\xdtihidohntk.exe
- C:\jxyvaqfinclhfo\bltkukuowyrp.exe
Deletes the following files
- %WINDIR%\jxyvaqfinclhfo\bnpvfwefvfaf
- C:\jxyvaqfinclhfo\pjtysm8pie5lwzpimyvp.exe
Substitutes the following files
- %WINDIR%\jxyvaqfinclhfo\bnpvfwefvfaf
Network activity
Connects to
- 'th####ttrain.net':80
- 'wa###train.net':80
- 'pa###train.net':80
- 'ex#####nceposition.net':80
- 'cr###strike.net':80
- 'be###spread.net':80
TCP
HTTP GET requests
- http://th####ttrain.net/index.php
- http://wa###train.net/index.php
- http://pa###train.net/index.php
- http://ex#####nceposition.net/index.php
- http://cr###strike.net/index.php
- http://be###spread.net/index.php
UDP
- DNS ASK ge####mantrain.net
- DNS ASK wa####osition.net
- DNS ASK th####tstrike.net
- DNS ASK wa###strike.net
- DNS ASK th####tpartial.net
- DNS ASK wa####artial.net
- DNS ASK wa###number.net
- DNS ASK th####tposition.net
- DNS ASK wo###number.net
- DNS ASK sm####osition.net
- DNS ASK wo###strike.net
- DNS ASK sm###strike.net
- DNS ASK wo####artial.net
- DNS ASK sm####artial.net
- DNS ASK sm###number.net
- DNS ASK wo####osition.net
- DNS ASK th####tnumber.net
- DNS ASK su####partial.net
- DNS ASK fi###number.net
- DNS ASK kn###number.net
- DNS ASK be####osition.net
- DNS ASK kn####osition.net
- DNS ASK be###strike.net
- DNS ASK kn###strike.net
- DNS ASK be####artial.net
- DNS ASK kn####artial.net
- DNS ASK su####number.net
- DNS ASK cr###number.net
- DNS ASK su####position.net
- DNS ASK cr####osition.net
- DNS ASK su####strike.net
- DNS ASK cr###strike.net
- DNS ASK pa###number.net
- DNS ASK me####partial.net
- DNS ASK cr####artial.net
- DNS ASK ex#####ncenumber.net
- DNS ASK pa####osition.net
- DNS ASK al####yspread.net
- DNS ASK fo####attempt.net
- DNS ASK me####attempt.net
- DNS ASK fo####square.net
- DNS ASK me####square.net
- DNS ASK fo####neighbor.net
- DNS ASK me####neighbor.net
- DNS ASK fo####spread.net
- DNS ASK me####spread.net
- DNS ASK be####ttempt.net
- DNS ASK kn####ttempt.net
- DNS ASK be###square.net
- DNS ASK kn###square.net
- DNS ASK be####eighbor.net
- DNS ASK kn####eighbor.net
- DNS ASK ge####manspread.net
- DNS ASK fo####partial.net
- DNS ASK be###number.net
- DNS ASK al####ysquare.net
- DNS ASK pa###strike.net
- DNS ASK fi###strike.net
- DNS ASK pa####artial.net
- DNS ASK fi####artial.net
- DNS ASK fr####ttempt.net
- DNS ASK ex#####nceattempt.net
- DNS ASK fr###square.net
- DNS ASK ex#####ncesquare.net
- DNS ASK fr####eighbor.net
- DNS ASK ex#####nceneighbor.net
- DNS ASK fr###spread.net
- DNS ASK ex#####ncespread.net
- DNS ASK ge#####anattempt.net
- DNS ASK al####yattempt.net
- DNS ASK ge####mansquare.net
- DNS ASK ge#####anneighbor.net
- DNS ASK fi####osition.net
- DNS ASK me####strike.net
- DNS ASK fo####strike.net
- DNS ASK me####position.net
- DNS ASK su####borrow.net
- DNS ASK cr###borrow.net
- DNS ASK su###rtrain.net
- DNS ASK cr###train.net
- DNS ASK su#####lectricity.net
- DNS ASK cr#####ectricity.net
- DNS ASK su####delight.net
- DNS ASK cr####elight.net
- DNS ASK th####tborrow.net
- DNS ASK wa###borrow.net
- DNS ASK th####ttrain.net
- DNS ASK wa###train.net
- DNS ASK th#####electricity.net
- DNS ASK kn#####ectricity.net
- DNS ASK kn###train.net
- DNS ASK kn####elight.net
- DNS ASK be###spread.net
- DNS ASK wa#####ectricity.net
- DNS ASK be###train.net
- DNS ASK ge######nelectricity.net
- DNS ASK al#####electricity.net
- DNS ASK ge#####andelight.net
- DNS ASK al####ydelight.net
- DNS ASK fo####borrow.net
- DNS ASK me####borrow.net
- DNS ASK al####ytrain.net
- DNS ASK fo###wtrain.net
- DNS ASK fo#####lectricity.net
- DNS ASK me#####lectricity.net
- DNS ASK fo####delight.net
- DNS ASK me####delight.net
- DNS ASK be###borrow.net
- DNS ASK kn###borrow.net
- DNS ASK me###rtrain.net
- DNS ASK be#####ectricity.net
- DNS ASK al####yneighbor.net
- DNS ASK th####tdelight.net
- DNS ASK sm###borrow.net
- DNS ASK ex#####ncestrike.net
- DNS ASK fr####artial.net
- DNS ASK ex#####ncepartial.net
- DNS ASK ge####mannumber.net
- DNS ASK al####ynumber.net
- DNS ASK ge#####anposition.net
- DNS ASK al####yposition.net
- DNS ASK ge####manstrike.net
- DNS ASK al####ystrike.net
- DNS ASK ge#####anpartial.net
- DNS ASK al####ypartial.net
- DNS ASK fo####number.net
- DNS ASK me####number.net
- DNS ASK fo####position.net
- DNS ASK wa####elight.net
- DNS ASK fr###strike.net
- DNS ASK wo###borrow.net
- DNS ASK ex#####nceposition.net
- DNS ASK be####elight.net
- DNS ASK wo###train.net
- DNS ASK sm###train.net
- DNS ASK wo#####ectricity.net
- DNS ASK sm#####ectricity.net
- DNS ASK wo####elight.net
- DNS ASK sm####elight.net
- DNS ASK pa###borrow.net
- DNS ASK fi###borrow.net
- DNS ASK pa###train.net
- DNS ASK fi###train.net
- DNS ASK pa#####ectricity.net
- DNS ASK fi#####ectricity.net
- DNS ASK pa####elight.net
- DNS ASK fi####elight.net
- DNS ASK fr###number.net
- DNS ASK fr####osition.net
- DNS ASK kn###spread.net
Miscellaneous
Creates and executes the following
- 'C:\jxyvaqfinclhfo\pjtysm8pie5lwzpimyvp.exe'
- 'C:\jxyvaqfinclhfo\xdtihidohntk.exe'
- 'C:\jxyvaqfinclhfo\bltkukuowyrp.exe' "c:\jxyvaqfinclhfo\xdtihidohntk.exe"
