Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Log Adapter Redirector Ordering' = 'C:\sloifljm\iiwogbscqct.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Audio Protocol Color RPC Locator] 'ImagePath' = 'C:\sloifljm\iiwogbscqct.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Audio Protocol Color RPC Locator] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- C:\sloifljm\iiwogbscqct.exe
- C:\sloifljm\emufuymipehx.exe
- C:\sloifljm\gwqvs3emhsgyhtnurz.exe
- %WINDIR%\sloifljm\htqxets2tyb
- C:\sloifljm\htqxets2tyb
Sets the 'hidden' attribute to the following files:
- C:\sloifljm\emufuymipehx.exe
- C:\sloifljm\iiwogbscqct.exe
Deletes the following files:
- C:\sloifljm\gwqvs3emhsgyhtnurz.exe
- %WINDIR%\sloifljm\htqxets2tyb
Substitutes the following files:
- %WINDIR%\sloifljm\htqxets2tyb
Network activity:
Connects to:
- 'hu####dclean.net':80
- 'jo####yclean.net':80
- 're###ndress.net':80
- 'jo####ycourse.net':80
- 'hu####dpaint.net':80
- 'jo####ypaint.net':80
- 're####eearly.net':80
- 'va####seearly.net':80
- 're###ncatch.net':80
- 'va####sdress.net':80
- 're####public.net':80
- 'va####spublic.net':80
- 'hu####dcourse.net':80
- 'de####ywomen.net':80
- 'li####course.net':80
- 'de####ycourse.net':80
- 'be###gclean.net':80
- 'ri###nclean.net':80
- 'li###ewomen.net':80
- 'de####yclean.net':80
- 'hu####dwomen.net':80
- 'jo####ywomen.net':80
- 'li###epaint.net':80
- 'de####ypaint.net':80
- 'li###eclean.net':80
- 'va####scatch.net':80
- 're####edress.net':80
- 'or###dress.net':80
- 're####epublic.net':80
- 'le####eearly.net':80
- 'he###ncatch.net':80
- 'le###rcatch.net':80
- 're####ecatch.net':80
- 'or###catch.net':80
- 'ne####arydress.net':80
- 'or###public.net':80
- 're####eeearly.net':80
- 'or###eearly.net':80
- 'he####eearly.net':80
- 'he###public.net':80
- 'ge####eearly.net':80
- 'he###eearly.net':80
- 'ge###edress.net':80
- 'he###dress.net':80
- 'ge####public.net':80
- 'le###rdress.net':80
- 'he####public.net':80
- 'le####public.net':80
- 'ge###ecatch.net':80
- 'he###catch.net':80
- 'he###ndress.net':80
TCP:
HTTP GET requests:
- http://hu####dclean.net/index.php
- http://jo####yclean.net/index.php
- http://re###ndress.net/index.php
- http://jo####ycourse.net/index.php
- http://hu####dpaint.net/index.php
- http://jo####ypaint.net/index.php
- http://re####eearly.net/index.php
- http://va####seearly.net/index.php
- http://re###ncatch.net/index.php
- http://va####sdress.net/index.php
- http://re####public.net/index.php
- http://va####spublic.net/index.php
- http://hu####dcourse.net/index.php
- http://de####ywomen.net/index.php
- http://li####course.net/index.php
- http://de####ycourse.net/index.php
- http://be###gclean.net/index.php
- http://ri###nclean.net/index.php
- http://li###ewomen.net/index.php
- http://de####yclean.net/index.php
- http://hu####dwomen.net/index.php
- http://jo####ywomen.net/index.php
- http://li###epaint.net/index.php
- http://de####ypaint.net/index.php
- http://li###eclean.net/index.php
- http://va####scatch.net/index.php
- http://re####edress.net/index.php
- http://or###dress.net/index.php
- http://re####epublic.net/index.php
- http://le####eearly.net/index.php
- http://he###ncatch.net/index.php
- http://le###rcatch.net/index.php
- http://re####ecatch.net/index.php
- http://or###catch.net/index.php
- http://ne####arydress.net/index.php
- http://or###public.net/index.php
- http://re####eeearly.net/index.php
- http://or###eearly.net/index.php
- http://he####eearly.net/index.php
- http://he###public.net/index.php
- http://ge####eearly.net/index.php
- http://he###eearly.net/index.php
- http://ge###edress.net/index.php
- http://he###dress.net/index.php
- http://ge####public.net/index.php
- http://le###rdress.net/index.php
- http://he####public.net/index.php
- http://le####public.net/index.php
- http://ge###ecatch.net/index.php
- http://he###catch.net/index.php
- http://he###ndress.net/index.php
UDP:
- DNS ASK jo####ypaint.net
- DNS ASK hu####dclean.net
- DNS ASK jo####yclean.net
- DNS ASK hu####dcourse.net
- DNS ASK jo####ycourse.net
- DNS ASK hu####dpaint.net
- DNS ASK re###ndress.net
- DNS ASK re####eearly.net
- DNS ASK va####seearly.net
- DNS ASK re###ncatch.net
- DNS ASK va####sdress.net
- DNS ASK re####public.net
- DNS ASK va####spublic.net
- DNS ASK li###ewomen.net
- DNS ASK de####ywomen.net
- DNS ASK li####course.net
- DNS ASK ri###npaint.net
- DNS ASK be###gclean.net
- DNS ASK ri###nclean.net
- DNS ASK de####ycourse.net
- DNS ASK de####yclean.net
- DNS ASK hu####dwomen.net
- DNS ASK jo####ywomen.net
- DNS ASK li###epaint.net
- DNS ASK de####ypaint.net
- DNS ASK li###eclean.net
- DNS ASK le###rcatch.net
- DNS ASK re####edress.net
- DNS ASK or###dress.net
- DNS ASK he####eearly.net
- DNS ASK le####eearly.net
- DNS ASK he###ncatch.net
- DNS ASK re####epublic.net
- DNS ASK re####ecatch.net
- DNS ASK or###catch.net
- DNS ASK ne####arydress.net
- DNS ASK or###public.net
- DNS ASK re####eeearly.net
- DNS ASK or###eearly.net
- DNS ASK ge####public.net
- DNS ASK he###public.net
- DNS ASK ge####eearly.net
- DNS ASK va####scatch.net
- DNS ASK ge###edress.net
- DNS ASK he###dress.net
- DNS ASK he###eearly.net
- DNS ASK le###rdress.net
- DNS ASK he####public.net
- DNS ASK le####public.net
- DNS ASK ge###ecatch.net
- DNS ASK he###catch.net
- DNS ASK he###ndress.net
Miscellaneous:
Creates and executes the following:
- 'C:\sloifljm\emufuymipehx.exe' "c:\sloifljm\iiwogbscqct.exe"
- 'C:\sloifljm\iiwogbscqct.exe'
- 'C:\sloifljm\gwqvs3emhsgyhtnurz.exe'
