Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Publication Defragmenter Files Server] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Publication Defragmenter Files Server] 'ImagePath' = 'C:\vls5ibs\tvky4hpjzbdp.exe'
Creates the following services
- 'Publication Defragmenter Files Server' C:\vls5ibs\tvky4hpjzbdp.exe
Modifies file system
Creates the following files
- %WINDIR%\vls5ibs\dau35mvvz
- C:\vls5ibs\dau35mvvz
- C:\vls5ibs\yyfzxa99h5svjofxmfqi.exe
- C:\vls5ibs\tvky4hpjzbdp.exe
- C:\vls5ibs\smusjrt3.exe
- C:\vls5ibs\pqwp5yywult5
Sets the 'hidden' attribute to the following files
- C:\vls5ibs\tvky4hpjzbdp.exe
- C:\vls5ibs\smusjrt3.exe
Deletes the following files
- %WINDIR%\vls5ibs\dau35mvvz
- C:\vls5ibs\yyfzxa99h5svjofxmfqi.exe
Substitutes the following files
- %WINDIR%\vls5ibs\dau35mvvz
Network activity
Connects to
- 'ga####liongrass.net':80
- 'tr#####anunderwood.net':80
- 'se#####eratterberry.net':80
- 'tr#####anatterberry.net':80
- 'se#####errichardson.net':80
- 'se#####narichardson.net':80
- 'ro#####ltanabella.net':80
- 'ro#####ltjosephina.net':80
- 'jo#####neanabella.net':80
- 'co#####erpatrickson.net':80
- 'ma#####neesmaralda.net':80
- 'do##bate.cn':80
- 'sp##tnav.ru':80
- 'ta#####pielenreiten.org':80
- 'si###ypeas.net':80
- 'un###lgrain.org':80
- 'sc####ainbow.net':80
- 'sc#####epuzzlechess.org':80
- 'ca#####eeitinthecup.org':80
- 'ra#####leamethyst.net':80
- 'se#####erunderwood.net':80
TCP
HTTP GET requests
- http://tr#####anamethyst.net/index.php
- http://ra#####femadelina.net/index.php
- http://jo#####neamethyst.net/index.php
- http://se#####najosephina.net/index.php
- http://co#####ermirabelle.net/index.php
- http://co#####eramethyst.net/index.php
- http://ra#####leesmaralda.net/index.php
- http://se#####naunderwood.net/index.php
- http://jo#####nerichardson.net/index.php
UDP
- DNS ASK ga####liongrass.net
- DNS ASK qu#####lachristians.net
- DNS ASK qu#####lachristians.ru
- DNS ASK qu######ashakesheave.net
- DNS ASK qu#####latimberlake.net
- DNS ASK ma#####netimberlake.ru
- DNS ASK qu######astainthorpe.net
- DNS ASK ra#####fechristians.net
- DNS ASK ro#####ltchristians.net
- DNS ASK ro######tshakesheave.net
- DNS ASK se#####napatrickson.net
- DNS ASK ra#####fetimberlake.net
- DNS ASK ro#####lttimberlake.net
- DNS ASK ro######tstainthorpe.net
- DNS ASK ro#####ltstainthorpe.ru
- DNS ASK co#####nechristians.net
- DNS ASK ka#####nechristians.net
- DNS ASK co######eshakesheave.net
- DNS ASK ra#####feshakesheave.ru
- DNS ASK sh######estainthorpe.net
- DNS ASK jo#####nerichardson.net
- DNS ASK co#####errichardson.net
- DNS ASK ra#####lepatrickson.net
- DNS ASK co#####erpatrickson.net
- DNS ASK se#####erunderwood.net
- DNS ASK tr#####anunderwood.net
- DNS ASK tr#####anunderwood.ru
- DNS ASK se#####eratterberry.net
- DNS ASK tr#####anatterberry.net
- DNS ASK ka######eshakesheave.net
- DNS ASK jo#####nepatrickson.net
- DNS ASK se#####erpatrickson.net
- DNS ASK se#####erpatrickson.ru
- DNS ASK tr#####anpatrickson.net
- DNS ASK se#####naunderwood.net
- DNS ASK jo#####neunderwood.net
- DNS ASK se#####naatterberry.net
- DNS ASK jo#####neatterberry.net
- DNS ASK jo#####neatterberry.ru
- DNS ASK tr#####anrichardson.net
- DNS ASK se#####narichardson.net
- DNS ASK co#####netimberlake.net
- DNS ASK co#####netimberlake.ru
- DNS ASK ka#####netimberlake.net
- DNS ASK se#####erchristians.net
- DNS ASK co#####erchristians.net
- DNS ASK ra######eshakesheave.net
- DNS ASK co######rshakesheave.net
- DNS ASK ra#####letimberlake.net
- DNS ASK co#####ertimberlake.net
- DNS ASK co#####ertimberlake.ru
- DNS ASK ra######estainthorpe.net
- DNS ASK ra#####lerichardson.ru
- DNS ASK ra#####lechristians.net
- DNS ASK tr#####anchristians.net
- DNS ASK se######rshakesheave.net
- DNS ASK se#####ershakesheave.ru
- DNS ASK tr######nshakesheave.net
- DNS ASK se#####ertimberlake.net
- DNS ASK tr#####antimberlake.net
- DNS ASK se######rstainthorpe.net
- DNS ASK tr######nstainthorpe.net
- DNS ASK co######rstainthorpe.net
- DNS ASK se#####errichardson.net
- DNS ASK co######sstainthorpe.net
- DNS ASK ma#####netimberlake.net
- DNS ASK ma######estainthorpe.net
- DNS ASK co######estainthorpe.net
- DNS ASK ka######estainthorpe.net
- DNS ASK sh#####nechristians.net
- DNS ASK ch#####aschristians.net
- DNS ASK ch#####aschristians.ru
- DNS ASK sh######eshakesheave.net
- DNS ASK ch######sshakesheave.net
- DNS ASK co#####ustimberlake.net
- DNS ASK sh#####netimberlake.net
- DNS ASK ra#####lechristians.ru
- DNS ASK sh#####nestainthorpe.ru
- DNS ASK ch######sstainthorpe.net
- DNS ASK ma#####nechristians.net
- DNS ASK co#####uschristians.net
- DNS ASK ma######eshakesheave.net
- DNS ASK co######sshakesheave.net
- DNS ASK co#####usshakesheave.ru
- DNS ASK ch#####astimberlake.net
- DNS ASK co#####neunderwood.net
- DNS ASK ch#####nebertrand.net
- DNS ASK ra#####leatterberry.net
- DNS ASK al#####rafrederica.net
- DNS ASK ma#####nafrederica.net
- DNS ASK ma#####nafrederica.ru
- DNS ASK al#####rapleasance.net
- DNS ASK ma#####napleasance.net
- DNS ASK al#####erbertrand.net
- DNS ASK ka#####nebertrand.net
- DNS ASK al#####erphilander.net
- DNS ASK ka#####nephilander.net
- DNS ASK al#####raphilander.net
- DNS ASK al#####erfrederica.net
- DNS ASK ka#####nefrederica.net
- DNS ASK al#####erpleasance.net
- DNS ASK ka#####nepleasance.net
- DNS ASK ka#####nepleasance.ru
- DNS ASK qu#####launderwood.net
- DNS ASK qu#####laatterberry.net
- DNS ASK al#####erphilander.ru
- DNS ASK ra#####lerichardson.net
- DNS ASK ma#####nabertrand.net
- DNS ASK ch#####nebertrand.ru
- DNS ASK sh#####lephilander.net
- DNS ASK ch#####nephilander.net
- DNS ASK sh#####lefrederica.net
- DNS ASK ch#####nefrederica.net
- DNS ASK sh#####lepleasance.net
- DNS ASK sh#####lepleasance.ru
- DNS ASK ch#####nepleasance.net
- DNS ASK qu#####larichardson.net
- DNS ASK ma#####naphilander.net
- DNS ASK ce#####nephilander.net
- DNS ASK am#####nephilander.net
- DNS ASK am#####nephilander.ru
- DNS ASK ce#####nefrederica.net
- DNS ASK am#####nefrederica.net
- DNS ASK ce#####nepleasance.net
- DNS ASK am#####nepleasance.net
- DNS ASK al#####rabertrand.net
- DNS ASK am#####nebertrand.net
- DNS ASK al#####rabertrand.ru
- DNS ASK qu#####larichardson.ru
- DNS ASK qu#####lapatrickson.net
- DNS ASK ra#####feunderwood.net
- DNS ASK ma#####neatterberry.ru
- DNS ASK sh#####nerichardson.net
- DNS ASK ch#####asrichardson.net
- DNS ASK ch#####asrichardson.ru
- DNS ASK sh#####nepatrickson.net
- DNS ASK ch#####aspatrickson.net
- DNS ASK ma#####neunderwood.net
- DNS ASK co#####usunderwood.net
- DNS ASK co#####eratterberry.net
- DNS ASK sh#####neatterberry.net
- DNS ASK co#####usatterberry.net
- DNS ASK ma#####nerichardson.net
- DNS ASK co#####usrichardson.net
- DNS ASK ma#####nepatrickson.net
- DNS ASK co#####uspatrickson.net
- DNS ASK co#####uspatrickson.ru
- DNS ASK ra#####leunderwood.net
- DNS ASK co#####erunderwood.net
- DNS ASK ma#####neatterberry.net
- DNS ASK tr#####anstainthorpe.ru
- DNS ASK ch#####asunderwood.net
- DNS ASK ka#####nepatrickson.net
- DNS ASK sh#####neunderwood.ru
- DNS ASK ro#####ltunderwood.net
- DNS ASK ro#####ltunderwood.ru
- DNS ASK ra#####featterberry.net
- DNS ASK ro#####ltatterberry.net
- DNS ASK ra#####ferichardson.net
- DNS ASK ro#####ltrichardson.net
- DNS ASK ra#####fepatrickson.net
- DNS ASK sh#####neunderwood.net
- DNS ASK ra#####fepatrickson.ru
- DNS ASK ch#####asatterberry.net
- DNS ASK ka#####neunderwood.net
- DNS ASK co#####neatterberry.net
- DNS ASK ka#####neatterberry.net
- DNS ASK ka#####neatterberry.ru
- DNS ASK co#####nerichardson.net
- DNS ASK ka#####nerichardson.net
- DNS ASK co#####nepatrickson.net
- DNS ASK ro#####ltpatrickson.net
- DNS ASK ce#####nebertrand.net
- DNS ASK se#####nachristians.net
- DNS ASK qu#####laferdinand.net
- DNS ASK sh#####nemadelina.net
- DNS ASK ch#####asmadelina.net
- DNS ASK sh#####nemirabelle.net
- DNS ASK ch#####asmirabelle.net
- DNS ASK ma#####neamethyst.net
- DNS ASK ma#####neamethyst.ru
- DNS ASK co#####usamethyst.net
- DNS ASK ma#####neesmaralda.net
- DNS ASK ma#####nemadelina.net
- DNS ASK ch#####asesmaralda.net
- DNS ASK co#####usmadelina.net
- DNS ASK co#####usmadelina.ru
- DNS ASK ma#####nemirabelle.net
- DNS ASK co#####usmirabelle.net
- DNS ASK ra#####leamethyst.net
- DNS ASK co#####eramethyst.net
- DNS ASK ra#####leesmaralda.net
- DNS ASK co#####usesmaralda.net
- DNS ASK tr#####anmadelina.net
- DNS ASK sh#####neesmaralda.net
- DNS ASK ra#####feesmaralda.net
- DNS ASK ro#####ltesmaralda.net
- DNS ASK ra#####femadelina.net
- DNS ASK ra#####femadelina.ru
- DNS ASK ro#####ltmadelina.net
- DNS ASK ra#####femirabelle.net
- DNS ASK ro#####ltmirabelle.net
- DNS ASK co#####neamethyst.net
- DNS ASK ra#####leesmaralda.ru
- DNS ASK ch#####asesmaralda.ru
- DNS ASK co#####neesmaralda.net
- DNS ASK ka#####neesmaralda.net
- DNS ASK co#####nemadelina.net
- DNS ASK ka#####nemadelina.net
- DNS ASK co#####nemirabelle.net
- DNS ASK co#####nemirabelle.ru
- DNS ASK ka#####nemirabelle.net
- DNS ASK sh#####neamethyst.net
- DNS ASK ka#####neamethyst.ru
- DNS ASK ch#####asamethyst.net
- DNS ASK co#####eresmaralda.net
- DNS ASK ra#####lemadelina.net
- DNS ASK co#####ermadelina.net
- DNS ASK pi##asia.cn
- DNS ASK ka#######ayajivayapriroda.ru
- DNS ASK so####ryducks.com
- DNS ASK si###ypeas.net
- DNS ASK un###lgrain.org
- DNS ASK ag#####anabolics.com
- DNS ASK ch####isportsmen.ru
- DNS ASK sc####ainbow.net
- DNS ASK ro#####ltamethyst.net
- DNS ASK ta#####pielenreiten.org
- DNS ASK sc#####epuzzlechess.org
- DNS ASK pr####anabolikov.ru
- DNS ASK to###tosales.ru
- DNS ASK pr##card.ru
- DNS ASK ye####gdongwu.cn
- DNS ASK ha####nhalflion.net
- DNS ASK ca#####eeitinthecup.org
- DNS ASK ga#####yundongyuan.cn
- DNS ASK gu##155.cn
- DNS ASK ka#####neamethyst.net
- DNS ASK sp##tnav.ru
- DNS ASK cl#####ortswomen.com
- DNS ASK do##bate.cn
- DNS ASK ra#####lemirabelle.net
- DNS ASK co#####ermirabelle.net
- DNS ASK co#####ermirabelle.ru
- DNS ASK se#####eramethyst.net
- DNS ASK tr#####anamethyst.net
- DNS ASK se#####eresmaralda.net
- DNS ASK tr#####anesmaralda.net
- DNS ASK gr###factory.cn
- DNS ASK se#####ermadelina.net
- DNS ASK na##top.ru
- DNS ASK se#####ermirabelle.net
- DNS ASK tr#####anmirabelle.net
- DNS ASK se#####naamethyst.net
- DNS ASK jo#####neamethyst.net
- DNS ASK jo#####neamethyst.ru
- DNS ASK bu####rmansion.com
- DNS ASK cl####portsmen.com
- DNS ASK se#####ermadelina.ru
- DNS ASK co#####ersharlene.ru
- DNS ASK se######ashakesheave.net
- DNS ASK qu#####lamirabelle.net
- DNS ASK co#####nesharlene.ru
- DNS ASK ka#####nesharlene.net
- DNS ASK co#####neferdinand.net
- DNS ASK ka#####neferdinand.net
- DNS ASK co#####neanabella.net
- DNS ASK ka#####neanabella.net
- DNS ASK ka#####neanabella.ru
- DNS ASK co#####nejosephina.net
- DNS ASK sh#####nesharlene.net
- DNS ASK ro#####ltjosephina.net
- DNS ASK ch#####assharlene.net
- DNS ASK sh#####neferdinand.net
- DNS ASK sh#####neferdinand.ru
- DNS ASK ch#####asferdinand.net
- DNS ASK sh#####neanabella.net
- DNS ASK ch#####asanabella.net
- DNS ASK sh#####nejosephina.net
- DNS ASK ka#####nejosephina.net
- DNS ASK ra#####feamethyst.net
- DNS ASK ra#####fejosephina.net
- DNS ASK jo######eshakesheave.net
- DNS ASK se#####natimberlake.net
- DNS ASK se#####natimberlake.ru
- DNS ASK jo#####netimberlake.net
- DNS ASK se######astainthorpe.net
- DNS ASK jo######estainthorpe.net
- DNS ASK qu#####lasharlene.net
- DNS ASK ma#####nesharlene.ru
- DNS ASK ch#####asjosephina.net
- DNS ASK co#####nesharlene.net
- DNS ASK qu#####lajosephina.net
- DNS ASK qu#####lajosephina.ru
- DNS ASK ra#####fesharlene.net
- DNS ASK ro#####ltsharlene.net
- DNS ASK ra#####feferdinand.net
- DNS ASK ro#####ltferdinand.net
- DNS ASK ro#####ltferdinand.ru
- DNS ASK ra#####feanabella.net
- DNS ASK qu#####laanabella.net
- DNS ASK ro#####ltanabella.net
- DNS ASK ch#####asjosephina.ru
- DNS ASK ma#####nesharlene.net
- DNS ASK co#####ussharlene.net
- DNS ASK se#####naanabella.net
- DNS ASK tr#####ananabella.net
- DNS ASK se#####erjosephina.net
- DNS ASK tr#####anjosephina.net
- DNS ASK se#####nasharlene.net
- DNS ASK se#####nasharlene.ru
- DNS ASK jo#####nesharlene.net
- DNS ASK se#####naferdinand.net
- DNS ASK ma#####nemirabelle.ru
- DNS ASK tr#####anferdinand.ru
- DNS ASK jo#####neanabella.net
- DNS ASK jo#####neanabella.ru
- DNS ASK se#####najosephina.net
- DNS ASK jo#####nejosephina.net
- DNS ASK qu#####laamethyst.net
- DNS ASK qu#####laesmaralda.net
- DNS ASK qu#####laesmaralda.ru
- DNS ASK qu#####lamadelina.net
- DNS ASK jo#####neferdinand.net
- DNS ASK jo#####nechristians.net
- DNS ASK tr#####anferdinand.net
- DNS ASK se#####ersharlene.net
- DNS ASK se#####erferdinand.net
- DNS ASK ma#####neferdinand.net
- DNS ASK co#####usferdinand.net
- DNS ASK ma#####neanabella.net
- DNS ASK ma#####neanabella.ru
- DNS ASK co#####usanabella.net
- DNS ASK ma#####nejosephina.net
- DNS ASK co#####usjosephina.net
- DNS ASK tr#####ansharlene.net
- DNS ASK ra#####lesharlene.net
- DNS ASK se#####eranabella.net
- DNS ASK ra#####leferdinand.net
- DNS ASK co#####erferdinand.net
- DNS ASK ra#####leanabella.net
- DNS ASK co#####eranabella.net
- DNS ASK ra#####lejosephina.net
- DNS ASK ra#####lejosephina.ru
- DNS ASK co#####erjosephina.net
- DNS ASK co#####ersharlene.net
- DNS ASK sh#####lebertrand.net
Miscellaneous
Creates and executes the following
- 'C:\vls5ibs\yyfzxa99h5svjofxmfqi.exe'
- 'C:\vls5ibs\tvky4hpjzbdp.exe'
- 'C:\vls5ibs\smusjrt3.exe' "c:\vls5ibs\tvky4hpjzbdp.exe"
