Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\WebClient Interactive File Client] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\WebClient Interactive File Client] 'ImagePath' = 'C:\kskaeozi\orgactcevop.exe'
Creates the following services
- 'WebClient Interactive File Client' C:\kskaeozi\orgactcevop.exe
Modifies file system
Creates the following files
- %WINDIR%\kskaeozi\ahhefbg
- C:\kskaeozi\ahhefbg
- C:\kskaeozi\jjjxk1tisuvqakaofs.exe
- C:\kskaeozi\orgactcevop.exe
- C:\kskaeozi\ifxgrazy.exe
Sets the 'hidden' attribute to the following files
- C:\kskaeozi\orgactcevop.exe
- C:\kskaeozi\ifxgrazy.exe
Deletes the following files
- %WINDIR%\kskaeozi\ahhefbg
- C:\kskaeozi\jjjxk1tisuvqakaofs.exe
Substitutes the following files
- %WINDIR%\kskaeozi\ahhefbg
Network activity
Connects to
- 'an####govern.net':80
- 'va####senough.net':80
- 'fo####dcompany.net':80
- 'gl###cover.net':80
- 'gl####ompany.net':80
- 'or####ompany.net':80
- 'le####company.net':80
- 'ge####further.net':80
- 'he###cover.net':80
- 'he####ompany.net':80
- 'ge####company.net':80
- 'he###finger.net':80
TCP
HTTP GET requests
- http://an####govern.net/index.php
- http://va####senough.net/index.php
- http://fo####dcompany.net/index.php
- http://gl###cover.net/index.php
- http://gl####ompany.net/index.php
- http://or####ompany.net/index.php
- http://le####company.net/index.php
- http://ge####further.net/index.php
- http://he###cover.net/index.php
- http://he####ompany.net/index.php
- http://ge####company.net/index.php
- http://he###finger.net/index.php
UDP
- DNS ASK va####scomplete.net
- DNS ASK or###cover.net
- DNS ASK re####ecover.net
- DNS ASK or###become.net
- DNS ASK re####ebecome.net
- DNS ASK or####ompany.net
- DNS ASK re####ecompany.net
- DNS ASK le####further.net
- DNS ASK he####further.net
- DNS ASK le###rcover.net
- DNS ASK he###ncover.net
- DNS ASK le####become.net
- DNS ASK he####become.net
- DNS ASK le####company.net
- DNS ASK he####company.net
- DNS ASK ge####further.net
- DNS ASK re####efurther.net
- DNS ASK ge###ecover.net
- DNS ASK or####urther.net
- DNS ASK pl####ntcompany.net
- DNS ASK gl####ompany.net
- DNS ASK di#####ltfurther.net
- DNS ASK he####urther.net
- DNS ASK di####ultcover.net
- DNS ASK he###cover.net
- DNS ASK di####ultbecome.net
- DNS ASK he###become.net
- DNS ASK di#####ltcompany.net
- DNS ASK he####ompany.net
- DNS ASK pl####ntfurther.net
- DNS ASK ne#####ryfurther.net
- DNS ASK pl####ntcover.net
- DNS ASK ne####arycover.net
- DNS ASK pl####ntbecome.net
- DNS ASK ne####arybecome.net
- DNS ASK ne#####rycompany.net
- DNS ASK gl###until.net
- DNS ASK ne####aryabove.net
- DNS ASK va####sfurther.net
- DNS ASK an####shoulder.net
- DNS ASK gl####houlder.net
- DNS ASK an####finger.net
- DNS ASK gl###finger.net
- DNS ASK di####ultuntil.net
- DNS ASK he###until.net
- DNS ASK di####ultabove.net
- DNS ASK he###above.net
- DNS ASK di#####ltshoulder.net
- DNS ASK he####houlder.net
- DNS ASK di####ultfinger.net
- DNS ASK he###finger.net
- DNS ASK pl####ntuntil.net
- DNS ASK ne####aryuntil.net
- DNS ASK pl####ntabove.net
- DNS ASK gl###above.net
- DNS ASK an####company.net
- DNS ASK an###rabove.net
- DNS ASK an###runtil.net
- DNS ASK re####further.net
- DNS ASK va####scover.net
- DNS ASK re###ncover.net
- DNS ASK va####sbecome.net
- DNS ASK re####become.net
- DNS ASK va####scompany.net
- DNS ASK re####company.net
- DNS ASK de###euntil.net
- DNS ASK fo####duntil.net
- DNS ASK de###eabove.net
- DNS ASK fo####dabove.net
- DNS ASK de####shoulder.net
- DNS ASK fo####dshoulder.net
- DNS ASK de####finger.net
- DNS ASK fo####dfinger.net
- DNS ASK ge####become.net
- DNS ASK ge####company.net
- DNS ASK gl###become.net
- DNS ASK re####eneedle.net
- DNS ASK di####ultneedle.net
- DNS ASK he###needle.net
- DNS ASK di####ultenough.net
- DNS ASK he###enough.net
- DNS ASK di####ultgovern.net
- DNS ASK he###govern.net
- DNS ASK pl####ntnature.net
- DNS ASK ne####arynature.net
- DNS ASK pl####ntneedle.net
- DNS ASK ne####aryneedle.net
- DNS ASK pl####ntenough.net
- DNS ASK ne####aryenough.net
- DNS ASK pl####ntgovern.net
- DNS ASK ne####arygovern.net
- DNS ASK or###nature.net
- DNS ASK he###nature.net
- DNS ASK re####enature.net
- DNS ASK di####ultnature.net
- DNS ASK an####govern.net
- DNS ASK re####complete.net
- DNS ASK de####nature.net
- DNS ASK fo####dnature.net
- DNS ASK de####needle.net
- DNS ASK fo####dneedle.net
- DNS ASK de####enough.net
- DNS ASK fo####denough.net
- DNS ASK de####govern.net
- DNS ASK fo####dgovern.net
- DNS ASK an####nature.net
- DNS ASK gl###nature.net
- DNS ASK an####needle.net
- DNS ASK gl###needle.net
- DNS ASK an####enough.net
- DNS ASK gl###enough.net
- DNS ASK gl###govern.net
- DNS ASK re####nature.net
- DNS ASK gl###cover.net
- DNS ASK or###enough.net
- DNS ASK va####senough.net
- DNS ASK re####enough.net
- DNS ASK va####sgovern.net
- DNS ASK re####govern.net
- DNS ASK de####further.net
- DNS ASK fo####dfurther.net
- DNS ASK de###ecover.net
- DNS ASK fo####dcover.net
- DNS ASK de####become.net
- DNS ASK fo####dbecome.net
- DNS ASK de####company.net
- DNS ASK fo####dcompany.net
- DNS ASK an####further.net
- DNS ASK gl####urther.net
- DNS ASK an###rcover.net
- DNS ASK re####needle.net
- DNS ASK an####become.net
- DNS ASK va####sneedle.net
- DNS ASK va####snature.net
- DNS ASK re####eenough.net
- DNS ASK or###govern.net
- DNS ASK re####egovern.net
- DNS ASK le####nature.net
- DNS ASK he####nature.net
- DNS ASK le####needle.net
- DNS ASK he####needle.net
- DNS ASK le####enough.net
- DNS ASK he####enough.net
- DNS ASK le####govern.net
- DNS ASK he####govern.net
- DNS ASK ge####nature.net
- DNS ASK ge####needle.net
- DNS ASK ge####enough.net
- DNS ASK ge####govern.net
- DNS ASK or###needle.net
- DNS ASK pl#####tshoulder.net
Miscellaneous
Creates and executes the following
- 'C:\kskaeozi\jjjxk1tisuvqakaofs.exe'
- 'C:\kskaeozi\orgactcevop.exe'
- 'C:\kskaeozi\ifxgrazy.exe' "c:\kskaeozi\orgactcevop.exe"
