Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\software\microsoft\windows nt\currentversion\winlogon] 'userinit' = '<SYSTEM32>\userinit.exe,<Full path to file>,'
Modifies file system
Creates the following files
- %TEMP%\6bcd.tmp
- %TEMP%\1cca.tmp
Deletes the following files
- %TEMP%\6bcd.tmp
- %TEMP%\1cca.tmp
Network activity
Connects to
- 'bing.com':80
- 'ly##van.com':80
- 'pu##deq.com':80
- 'pu##cag.com':80
- 'ly##sor.com':80
- 'pk#.goog':80
- 'qe##hig.com':443
- 'ly##xor.com':80
- 'ga##qah.com':80
- 'qe##hig.com':80
- 'vo##pom.com':80
- 'ga##qaz.com':80
- 'vo##zit.com':80
- 'su####-smiles.com':80
- 'ly##fyj.com':80
- 'ly##xid.com':80
- 'ga##fus.com':80
- 'vo##qem.com':80
- 'pu##deq.com':443
- 'ly##van.com':443
TCP
HTTP GET requests
- http://su####-smiles.com/
- http://pk#.goog/gsr1/gsr1.crt
HTTP POST requests
- http://vo##qem.com/login.php
- http://ly##xid.com/login.php
- http://ly##fyj.com/login.php
- http://ga##qaz.com/login.php
- http://qe##fuv.com/login.php
- http://vo##pom.com/login.php
- http://qe##hig.com/login.php
- http://vo##zit.com/login.php
- http://ga##qah.com/login.php
- http://ly##xor.com/login.php
- http://ly##sor.com/login.php
- http://pu##deq.com/login.php
- http://ly##van.com/login.php
- http://pu##cag.com/login.php
Other
- 'qe##hig.com':443
- 'pu##deq.com':443
UDP
- DNS ASK bing.com
- DNS ASK qe##veg.com
- DNS ASK ga##nus.com
- DNS ASK ly##tux.com
- DNS ASK pu##joq.com
- DNS ASK vo##byf.com
- DNS ASK ga##veb.com
- DNS ASK qe##tup.com
- DNS ASK ly##jaj.com
- DNS ASK qe##sal.com
- DNS ASK ga##daw.com
- DNS ASK pu##byv.com
- DNS ASK vo##pit.com
- DNS ASK ly##lyn.com
- DNS ASK ga##keh.com
- DNS ASK qe##nuv.com
- DNS ASK ly##sor.com
- DNS ASK pu##lyg.com
- DNS ASK pu##mip.com
- DNS ASK vo##dek.com
- DNS ASK ga##zub.com
- DNS ASK qe##lug.com
- DNS ASK vo##mic.com
- DNS ASK qe##kaq.com
- DNS ASK ly##nud.com
- DNS ASK pu##pol.com
- DNS ASK vo##kem.com
- DNS ASK ga##piz.com
- DNS ASK ly##mox.com
- DNS ASK pu##deq.com
- DNS ASK ga##hiw.com
- DNS ASK pu##tup.com
- DNS ASK pu##xuq.com
- DNS ASK ly##van.com
- DNS ASK vo##dac.com
- DNS ASK ga##zuw.com
- DNS ASK vo##qaf.com
- DNS ASK pu##mig.com
- DNS ASK qe##qog.com
- DNS ASK ly##fex.com
- DNS ASK ga##fyz.com
- DNS ASK qe##xiq.com
- DNS ASK ga##coh.com
- DNS ASK qe##lyl.com
- DNS ASK ly##min.com
- DNS ASK pu##dep.com
- DNS ASK vo##zuk.com
- DNS ASK ga##qob.com
- DNS ASK qe##fyp.com
- DNS ASK ly##xij.com
- DNS ASK pu##wav.com
- DNS ASK vo##gut.com
- DNS ASK qe##rev.com
- DNS ASK ly##gur.com
- DNS ASK pu##cag.com
- DNS ASK ly##wed.com
- DNS ASK pu##gul.com
- DNS ASK vo##mum.com
- DNS ASK vo##com.com
- DNS ASK vo##ryc.com
- DNS ASK ga##das.com
- DNS ASK ga##rys.com
- DNS ASK qe##hil.com
- DNS ASK pk#.goog
- DNS ASK vo##jok.com
- DNS ASK su####-smiles.com
- DNS ASK ly##xid.com
- DNS ASK pu##wel.com
- DNS ASK vo##gum.com
- DNS ASK ga##cos.com
- DNS ASK ly##gin.com
- DNS ASK pu##cap.com
- DNS ASK vo##ruk.com
- DNS ASK ga##hob.com
- DNS ASK qe##vep.com
- DNS ASK ga##fus.com
- DNS ASK ly##fyd.com
- DNS ASK qe##qaq.com
- DNS ASK pu##moq.com
- DNS ASK ga##zuz.com
- DNS ASK ly##lux.com
- DNS ASK vo##kyc.com
- DNS ASK qe##sag.com
- DNS ASK ga##niw.com
- DNS ASK pu##pog.com
- DNS ASK qe##kev.com
- DNS ASK ly##nur.com
- DNS ASK vo##byt.com
- DNS ASK ga##pih.com
- DNS ASK pu##jav.com
- DNS ASK qe##lup.com
- DNS ASK ly##fyj.com
- DNS ASK vo##qem.com
- DNS ASK ly##tuj.com
- DNS ASK ly##moj.com
- DNS ASK pu##dyv.com
- DNS ASK qe##ryl.com
- DNS ASK qe##fyq.com
- DNS ASK vo##def.com
- DNS ASK qe##fuv.com
- DNS ASK qe##tiq.com
- DNS ASK pu##xil.com
- DNS ASK pu##xiv.com
- DNS ASK vo##qat.com
- DNS ASK ga##fuh.com
- DNS ASK qe##xov.com
- DNS ASK ly##wer.com
- DNS ASK pu##gug.com
- DNS ASK ga##ryw.com
- DNS ASK vo##cac.com
- DNS ASK qe##hig.com
- DNS ASK ly##vex.com
- DNS ASK pu##tuq.com
- DNS ASK vo##jof.com
- DNS ASK pu##bul.com
- DNS ASK ga##vyz.com
- DNS ASK vo##zit.com
- DNS ASK ly##jad.com
- DNS ASK vo##pom.com
- DNS ASK ga##qah.com
- DNS ASK ga##kes.com
- DNS ASK qe##nul.com
- DNS ASK ly##san.com
- DNS ASK pu##lyp.com
- DNS ASK vo##mik.com
- DNS ASK ly##xor.com
- DNS ASK ga##deb.com
- DNS ASK vo##zuf.com
- DNS ASK ga##qaz.com
- DNS ASK qe##qop.com
- DNS ASK ly##lyr.com
