Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Superfetch Mapper RPC Spooler Credential] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Superfetch Mapper RPC Spooler Credential] 'ImagePath' = 'C:\tvoswmmwbzeztq\qzhfzxtujrqu.exe'
Creates the following services
- 'Superfetch Mapper RPC Spooler Credential' C:\tvoswmmwbzeztq\qzhfzxtujrqu.exe
Modifies file system
Creates the following files
- %WINDIR%\tvoswmmwbzeztq\qcyushc9z4pz
- C:\tvoswmmwbzeztq\qcyushc9z4pz
- C:\tvoswmmwbzeztq\gqewnswoxbzowordxpe.exe
- C:\tvoswmmwbzeztq\qzhfzxtujrqu.exe
- C:\tvoswmmwbzeztq\mqnfrjv.exe
- C:\tvoswmmwbzeztq\aviiai
Sets the 'hidden' attribute to the following files
- C:\tvoswmmwbzeztq\qzhfzxtujrqu.exe
- C:\tvoswmmwbzeztq\mqnfrjv.exe
Deletes the following files
- %WINDIR%\tvoswmmwbzeztq\qcyushc9z4pz
- C:\tvoswmmwbzeztq\gqewnswoxbzowordxpe.exe
Substitutes the following files
- %WINDIR%\tvoswmmwbzeztq\qcyushc9z4pz
Network activity
Connects to
- 'le####xplain.net':80
- 'wi####nation.net':80
- 'mo####insoldier.net':80
- 'po####lenation.net':80
- 'si####nation.net':80
- 'se####condition.net':80
- 'sw###people.net':80
- 'fi####condition.net':80
- 'sw###brown.net':80
- 'wi####people.net':80
- 'wi###wready.net':80
- 'mo#####ndaughter.net':80
- 'mo####inpeople.net':80
- 'mo####inready.net':80
- 'mo####daughter.net':80
- 'pr####lyready.net':80
- 'sw###nation.net':80
TCP
HTTP GET requests
- http://le####xplain.net/index.php
- http://mo####daughter.net/index.php
- http://mo####inready.net/index.php
- http://mo####inpeople.net/index.php
- http://mo#####ndaughter.net/index.php
- http://wi###wready.net/index.php
- http://wi####people.net/index.php
- http://pr####lyready.net/index.php
- http://sw###people.net/index.php
- http://se####condition.net/index.php
- http://si####nation.net/index.php
- http://po####lenation.net/index.php
- http://mo####insoldier.net/index.php
- http://wi####nation.net/index.php
- http://fi####condition.net/index.php
- http://sw###nation.net/index.php
UDP
- DNS ASK si####explain.net
- DNS ASK pr#####ydaughter.net
- DNS ASK se####lready.net
- DNS ASK ma####already.net
- DNS ASK se####lbrown.net
- DNS ASK ma####albrown.net
- DNS ASK se####lpeople.net
- DNS ASK se####condition.net
- DNS ASK sw####aughter.net
- DNS ASK pr####lypeople.net
- DNS ASK se####nation.net
- DNS ASK la###nation.net
- DNS ASK se####soldier.net
- DNS ASK la####oldier.net
- DNS ASK se####please.net
- DNS ASK la###please.net
- DNS ASK ma####alpeople.net
- DNS ASK ma#####ldaughter.net
- DNS ASK wi####daughter.net
- DNS ASK se####ldaughter.net
- DNS ASK fi###hbrown.net
- DNS ASK su####tready.net
- DNS ASK wi###rbrown.net
- DNS ASK su####tbrown.net
- DNS ASK su####tpeople.net
- DNS ASK su####tdaughter.net
- DNS ASK fi###hready.net
- DNS ASK sw###brown.net
- DNS ASK sw###people.net
- DNS ASK pr####lybrown.net
- DNS ASK fi####people.net
- DNS ASK le###people.net
- DNS ASK fi####daughter.net
- DNS ASK le####aughter.net
- DNS ASK sw###ready.net
- DNS ASK pr####lyready.net
- DNS ASK le###ready.net
- DNS ASK le###brown.net
- DNS ASK wi###rready.net
- DNS ASK la####ondition.net
- DNS ASK mo####soldier.net
- DNS ASK wi####condition.net
- DNS ASK su####tnation.net
- DNS ASK su####tsoldier.net
- DNS ASK su####tplease.net
- DNS ASK su#####condition.net
- DNS ASK fi####nation.net
- DNS ASK wi####please.net
- DNS ASK pe#####condition.net
- DNS ASK le###nation.net
- DNS ASK fi####please.net
- DNS ASK le###please.net
- DNS ASK fi####condition.net
- DNS ASK le####ondition.net
- DNS ASK sw###nation.net
- DNS ASK pr####lynation.net
- DNS ASK fi####soldier.net
- DNS ASK le####oldier.net
- DNS ASK mo####nation.net
- DNS ASK si####nation.net
- DNS ASK pe####ssoldier.net
- DNS ASK si####please.net
- DNS ASK mo####please.net
- DNS ASK si####condition.net
- DNS ASK mo####condition.net
- DNS ASK mo####innation.net
- DNS ASK wi####soldier.net
- DNS ASK si####soldier.net
- DNS ASK pe####splease.net
- DNS ASK po####lenation.net
- DNS ASK po####leplease.net
- DNS ASK mo#####ncondition.net
- DNS ASK po#####econdition.net
- DNS ASK pe####snation.net
- DNS ASK wi####nation.net
- DNS ASK mo####insoldier.net
- DNS ASK po####lesoldier.net
- DNS ASK mo####inplease.net
- DNS ASK pe####sdaughter.net
- DNS ASK wi####people.net
- DNS ASK pe####speople.net
- DNS ASK su####tinstead.net
- DNS ASK su####texplain.net
- DNS ASK su####tbright.net
- DNS ASK su####tinside.net
- DNS ASK fi####instead.net
- DNS ASK le####nstead.net
- DNS ASK pe####sinside.net
- DNS ASK pr####lyexplain.net
- DNS ASK wi####bright.net
- DNS ASK le###bright.net
- DNS ASK fi####inside.net
- DNS ASK le###inside.net
- DNS ASK sw####nstead.net
- DNS ASK pr####lyinstead.net
- DNS ASK sw####xplain.net
- DNS ASK le####xplain.net
- DNS ASK fi####explain.net
- DNS ASK fi####bright.net
- DNS ASK wi####explain.net
- DNS ASK mo####inbright.net
- DNS ASK si####bright.net
- DNS ASK mo####bright.net
- DNS ASK si####inside.net
- DNS ASK mo####inside.net
- DNS ASK mo####ininstead.net
- DNS ASK po####leinstead.net
- DNS ASK pe####sbright.net
- DNS ASK sw###bright.net
- DNS ASK mo####explain.net
- DNS ASK po####lebright.net
- DNS ASK mo####ininside.net
- DNS ASK po####leinside.net
- DNS ASK pe####sinstead.net
- DNS ASK wi####instead.net
- DNS ASK pe####s##plain.net
- DNS ASK po####leexplain.net
- DNS ASK mo####inexplain.net
- DNS ASK wi####inside.net
- DNS ASK pr####lybright.net
- DNS ASK si####people.net
- DNS ASK si####daughter.net
- DNS ASK mo####daughter.net
- DNS ASK mo####inready.net
- DNS ASK po####leready.net
- DNS ASK mo####inbrown.net
- DNS ASK mo###rbrown.net
- DNS ASK mo###rready.net
- DNS ASK mo####people.net
- DNS ASK po####lebrown.net
- DNS ASK po#####edaughter.net
- DNS ASK pe####sready.net
- DNS ASK wi###wready.net
- DNS ASK pe####sbrown.net
- DNS ASK wi###wbrown.net
- DNS ASK mo####inpeople.net
- DNS ASK po####lepeople.net
- DNS ASK mo#####ndaughter.net
- DNS ASK si###ebrown.net
- DNS ASK si###eready.net
- DNS ASK sw###inside.net
- DNS ASK se####linstead.net
- DNS ASK ma####alinstead.net
- DNS ASK se####lexplain.net
- DNS ASK ma####alexplain.net
- DNS ASK se####lbright.net
- DNS ASK ma####albright.net
- DNS ASK se####linside.net
- DNS ASK pr####lyinside.net
- DNS ASK ma####alinside.net
- DNS ASK la###ready.net
- DNS ASK se###abrown.net
- DNS ASK la###brown.net
- DNS ASK se####people.net
- DNS ASK la###people.net
- DNS ASK se####daughter.net
- DNS ASK la####aughter.net
- DNS ASK se###aready.net
- DNS ASK sw####oldier.net
- DNS ASK pr####lysoldier.net
Miscellaneous
Creates and executes the following
- 'C:\tvoswmmwbzeztq\gqewnswoxbzowordxpe.exe'
- 'C:\tvoswmmwbzeztq\qzhfzxtujrqu.exe'
- 'C:\tvoswmmwbzeztq\mqnfrjv.exe' "c:\tvoswmmwbzeztq\qzhfzxtujrqu.exe"
