Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Extender Peer Resolution Discovery Bus] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Extender Peer Resolution Discovery Bus] 'ImagePath' = 'C:\icolyoqpiwkpwg\tksznuvuhcib.exe'
Creates the following services
- 'Extender Peer Resolution Discovery Bus' C:\icolyoqpiwkpwg\tksznuvuhcib.exe
Modifies file system
Creates the following files
- %WINDIR%\icolyoqpiwkpwg\riibn4uil
- C:\icolyoqpiwkpwg\riibn4uil
- C:\icolyoqpiwkpwg\xnx2h78zkr5ze2gj0d.exe
- C:\icolyoqpiwkpwg\tksznuvuhcib.exe
- C:\icolyoqpiwkpwg\mcitkblfgcqr.exe
Sets the 'hidden' attribute to the following files
- C:\icolyoqpiwkpwg\tksznuvuhcib.exe
- C:\icolyoqpiwkpwg\mcitkblfgcqr.exe
Deletes the following files
- %WINDIR%\icolyoqpiwkpwg\riibn4uil
- C:\icolyoqpiwkpwg\xnx2h78zkr5ze2gj0d.exe
Substitutes the following files
- %WINDIR%\icolyoqpiwkpwg\riibn4uil
Network activity
Connects to
- 'he###notice.net':80
- 'gl####eneral.net':80
- 'an####include.net':80
- 'he####nclude.net':80
- 'ge###eclear.net':80
- 're####equarter.net':80
- 'he####quarter.net':80
TCP
HTTP GET requests
- http://he###notice.net/index.php
- http://gl####eneral.net/index.php
- http://an####include.net/index.php
- http://he####nclude.net/index.php
- http://ge###eclear.net/index.php
- http://re####equarter.net/index.php
- http://he####quarter.net/index.php
UDP
- DNS ASK gl###indeed.net
- DNS ASK re####general.net
- DNS ASK va####sinclude.net
- DNS ASK re####include.net
- DNS ASK va####snorth.net
- DNS ASK re###nnorth.net
- DNS ASK de####branch.net
- DNS ASK ge###enorth.net
- DNS ASK fo####dbranch.net
- DNS ASK fo####dbelieve.net
- DNS ASK de####receive.net
- DNS ASK fo####dreceive.net
- DNS ASK de####quarter.net
- DNS ASK fo####dquarter.net
- DNS ASK an####branch.net
- DNS ASK re###nclear.net
- DNS ASK va####sgeneral.net
- DNS ASK va####sclear.net
- DNS ASK ge####include.net
- DNS ASK an####believe.net
- DNS ASK or####nclude.net
- DNS ASK re####einclude.net
- DNS ASK or###north.net
- DNS ASK re####enorth.net
- DNS ASK le###rclear.net
- DNS ASK gl###branch.net
- DNS ASK or####eneral.net
- DNS ASK de####believe.net
- DNS ASK he###nclear.net
- DNS ASK he####include.net
- DNS ASK le###rnorth.net
- DNS ASK he###nnorth.net
- DNS ASK ge###eclear.net
- DNS ASK ge####general.net
- DNS ASK le####general.net
- DNS ASK he####general.net
- DNS ASK le####include.net
- DNS ASK de####general.net
- DNS ASK gl####elieve.net
- DNS ASK re####ebranch.net
- DNS ASK or####elieve.net
- DNS ASK re####ebelieve.net
- DNS ASK or####eceive.net
- DNS ASK re####ereceive.net
- DNS ASK or####uarter.net
- DNS ASK re####equarter.net
- DNS ASK or###branch.net
- DNS ASK re####eclear.net
- DNS ASK ne#####ryquarter.net
- DNS ASK he####believe.net
- DNS ASK le####receive.net
- DNS ASK he####receive.net
- DNS ASK le####quarter.net
- DNS ASK he####quarter.net
- DNS ASK ge####branch.net
- DNS ASK he####branch.net
- DNS ASK le####branch.net
- DNS ASK re####egeneral.net
- DNS ASK ne#####ryreceive.net
- DNS ASK di#####ltquarter.net
- DNS ASK an####quarter.net
- DNS ASK gl####uarter.net
- DNS ASK di####ultbranch.net
- DNS ASK he###branch.net
- DNS ASK di#####ltbelieve.net
- DNS ASK he####elieve.net
- DNS ASK pl####ntquarter.net
- DNS ASK an####receive.net
- DNS ASK gl####eceive.net
- DNS ASK he####uarter.net
- DNS ASK pl####ntbranch.net
- DNS ASK ne####arybranch.net
- DNS ASK pl####ntbelieve.net
- DNS ASK ne#####rybelieve.net
- DNS ASK pl####ntreceive.net
- DNS ASK he####eceive.net
- DNS ASK di#####ltreceive.net
- DNS ASK or###clear.net
- DNS ASK ne####arynorth.net
- DNS ASK pl####ntnorth.net
- DNS ASK or###indeed.net
- DNS ASK re####eindeed.net
- DNS ASK or###during.net
- DNS ASK re####eduring.net
- DNS ASK le####length.net
- DNS ASK re####elength.net
- DNS ASK di####ultduring.net
- DNS ASK re####enotice.net
- DNS ASK he####length.net
- DNS ASK he####indeed.net
- DNS ASK le####during.net
- DNS ASK he####during.net
- DNS ASK ge####length.net
- DNS ASK ge####notice.net
- DNS ASK le####notice.net
- DNS ASK he####notice.net
- DNS ASK le####indeed.net
- DNS ASK ge####believe.net
- DNS ASK ge####indeed.net
- DNS ASK pl####ntduring.net
- DNS ASK gl###during.net
- DNS ASK di####ultlength.net
- DNS ASK he###length.net
- DNS ASK di####ultnotice.net
- DNS ASK he###notice.net
- DNS ASK di####ultindeed.net
- DNS ASK ne####aryduring.net
- DNS ASK or###length.net
- DNS ASK he###indeed.net
- DNS ASK pl####ntlength.net
- DNS ASK ne####arylength.net
- DNS ASK pl####ntnotice.net
- DNS ASK ne####arynotice.net
- DNS ASK pl####ntindeed.net
- DNS ASK ne####aryindeed.net
- DNS ASK an####during.net
- DNS ASK he###during.net
- DNS ASK le####believe.net
- DNS ASK ge####during.net
- DNS ASK va####snotice.net
- DNS ASK gl###north.net
- DNS ASK di####ultclear.net
- DNS ASK he###clear.net
- DNS ASK di#####ltgeneral.net
- DNS ASK he####eneral.net
- DNS ASK di#####ltinclude.net
- DNS ASK va####slength.net
- DNS ASK an###rnorth.net
- DNS ASK gl####nclude.net
- DNS ASK pl####ntclear.net
- DNS ASK ne####aryclear.net
- DNS ASK pl####ntgeneral.net
- DNS ASK ne#####rygeneral.net
- DNS ASK pl####ntinclude.net
- DNS ASK ne#####ryinclude.net
- DNS ASK he####nclude.net
- DNS ASK he###north.net
- DNS ASK re####length.net
- DNS ASK di####ultnorth.net
- DNS ASK or###notice.net
- DNS ASK re####notice.net
- DNS ASK va####sindeed.net
- DNS ASK re####indeed.net
- DNS ASK va####sduring.net
- DNS ASK re####during.net
- DNS ASK de###eclear.net
- DNS ASK an####general.net
- DNS ASK an####include.net
- DNS ASK gl####eneral.net
- DNS ASK de####include.net
- DNS ASK fo####dinclude.net
- DNS ASK de###enorth.net
- DNS ASK fo####dnorth.net
- DNS ASK an###rclear.net
- DNS ASK gl###clear.net
- DNS ASK fo####dclear.net
- DNS ASK fo####dgeneral.net
- DNS ASK ge####receive.net
Miscellaneous
Creates and executes the following
- 'C:\icolyoqpiwkpwg\xnx2h78zkr5ze2gj0d.exe'
- 'C:\icolyoqpiwkpwg\tksznuvuhcib.exe'
- 'C:\icolyoqpiwkpwg\mcitkblfgcqr.exe' "c:\icolyoqpiwkpwg\tksznuvuhcib.exe"
