Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Background System Web Collector SPP] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Background System Web Collector SPP] 'ImagePath' = 'C:\iwicddj\yljbouizlfcb.exe'
Creates the following services
- 'Background System Web Collector SPP' C:\iwicddj\yljbouizlfcb.exe
Modifies file system
Creates the following files
- %WINDIR%\iwicddj\hkvdtonxktuu
- C:\iwicddj\hkvdtonxktuu
- C:\iwicddj\coam8hn474fyk8uswwqmyy.exe
- C:\iwicddj\yljbouizlfcb.exe
- C:\iwicddj\qoleonvdg7.exe
- C:\iwicddj\mkiarmupm
Sets the 'hidden' attribute to the following files
- C:\iwicddj\yljbouizlfcb.exe
- C:\iwicddj\qoleonvdg7.exe
Deletes the following files
- %WINDIR%\iwicddj\hkvdtonxktuu
- C:\iwicddj\coam8hn474fyk8uswwqmyy.exe
Substitutes the following files
- %WINDIR%\iwicddj\hkvdtonxktuu
Network activity
Connects to
- 'sp##tnav.ru':80
- 'co#####uscassarah.net':80
TCP
HTTP GET requests
- http://sp##tnav.ru/index.php
UDP
- DNS ASK ka#######ayajivayapriroda.ru
- DNS ASK ch#####ascassarah.ru
- DNS ASK sh#####neharrison.net
- DNS ASK ch#####asharrison.net
- DNS ASK ch#####asangelica.net
- DNS ASK sh#####neangelica.net
- DNS ASK ma#####neviviette.net
- DNS ASK ma#####neharrison.net
- DNS ASK ma#####neviviette.ru
- DNS ASK co#####usviviette.net
- DNS ASK co#####uscassarah.net
- DNS ASK ma#####necassarah.net
- DNS ASK co#####usharrison.net
- DNS ASK co#####usharrison.ru
- DNS ASK ma#####neangelica.net
- DNS ASK co#####usangelica.net
- DNS ASK co#####erharrison.net
- DNS ASK ra#####leviviette.net
- DNS ASK co#####erviviette.net
- DNS ASK ra#####lecassarah.net
- DNS ASK ra#####lecassarah.ru
- DNS ASK co#####ercassarah.net
- DNS ASK ch#####ascassarah.net
- DNS ASK ch#####asviviette.net
- DNS ASK qu#####laharrison.net
- DNS ASK ka#####neangelica.net
- DNS ASK qu#####laangelica.net
- DNS ASK ma#####neangelica.ru
- DNS ASK ra#####feviviette.net
- DNS ASK ra#####feangelica.net
- DNS ASK ro#####ltviviette.net
- DNS ASK ra#####fecassarah.net
- DNS ASK ro#####ltcassarah.net
- DNS ASK ra#####feharrison.net
- DNS ASK ro#####ltharrison.net
- DNS ASK ra#####feharrison.ru
- DNS ASK ro#####ltangelica.net
- DNS ASK ka#####neviviette.ru
- DNS ASK co#####neviviette.net
- DNS ASK ka#####neviviette.net
- DNS ASK co#####neharrison.net
- DNS ASK co#####necassarah.net
- DNS ASK ka#####necassarah.net
- DNS ASK ka#####neharrison.net
- DNS ASK co#####neangelica.net
- DNS ASK co#####neangelica.ru
- DNS ASK sh#####neviviette.net
- DNS ASK ra#####leharrison.net
- DNS ASK sh#####necassarah.net
- DNS ASK ra#####leangelica.net
- DNS ASK sc#####epuzzlechess.org
- DNS ASK ye####gdongwu.cn
- DNS ASK na##top.ru
- DNS ASK sp##tnav.ru
- DNS ASK to###tosales.ru
- DNS ASK so####ryducks.com
- DNS ASK sc####ainbow.net
- DNS ASK ta#####pielenreiten.org
- DNS ASK cl#####ortswomen.com
- DNS ASK bu####rmansion.com
- DNS ASK ga#####yundongyuan.cn
- DNS ASK ca#####eeitinthecup.org
- DNS ASK ch####isportsmen.ru
- DNS ASK si###ypeas.net
- DNS ASK do##bate.cn
- DNS ASK pr##card.ru
- DNS ASK ha####nhalflion.net
- DNS ASK ga####liongrass.net
- DNS ASK gr###factory.cn
- DNS ASK pr####anabolikov.ru
- DNS ASK ag#####anabolics.com
- DNS ASK gu##155.cn
- DNS ASK pi##asia.cn
- DNS ASK cl####portsmen.com
- DNS ASK co#####erangelica.ru
- DNS ASK un###lgrain.org
- DNS ASK se#####erviviette.net
- DNS ASK tr#####anviviette.net
- DNS ASK se#####erharrison.net
- DNS ASK tr#####ancassarah.net
- DNS ASK se#####ercassarah.net
- DNS ASK se#####erharrison.ru
- DNS ASK tr#####anharrison.net
- DNS ASK se#####naviviette.net
- DNS ASK se#####erangelica.net
- DNS ASK tr#####anangelica.net
- DNS ASK jo#####neharrison.net
- DNS ASK jo#####neviviette.ru
- DNS ASK jo#####neviviette.net
- DNS ASK se#####naharrison.net
- DNS ASK se#####nacassarah.net
- DNS ASK jo#####necassarah.net
- DNS ASK se#####naangelica.net
- DNS ASK se#####naangelica.ru
- DNS ASK ga#####leseabrooke.net
- DNS ASK jo#####neangelica.net
- DNS ASK an#####laseabrooke.net
- DNS ASK co#####erangelica.net
- DNS ASK qu#####lacassarah.ru
Miscellaneous
Creates and executes the following
- 'C:\iwicddj\coam8hn474fyk8uswwqmyy.exe'
- 'C:\iwicddj\yljbouizlfcb.exe'
- 'C:\iwicddj\qoleonvdg7.exe' "c:\iwicddj\yljbouizlfcb.exe"
