Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Storage Class Transfer Collector Smart' = 'C:\nxcyorzllmew\ajksderkxk.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Layer Link Engine Socket Driver Compatibility] 'ImagePath' = 'C:\nxcyorzllmew\ajksderkxk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Layer Link Engine Socket Driver Compatibility] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- C:\nxcyorzllmew\ajksderkxk.exe
- C:\nxcyorzllmew\oakyklxxajj.exe
- C:\nxcyorzllmew\tcqakm6cn
- %WINDIR%\nxcyorzllmew\g8dlgqpuf
- C:\nxcyorzllmew\g8dlgqpuf
- C:\nxcyorzllmew\ik2epjoeqlvqnlufbv.exe
Sets the 'hidden' attribute to the following files:
- C:\nxcyorzllmew\oakyklxxajj.exe
- C:\nxcyorzllmew\ajksderkxk.exe
Deletes the following files:
- C:\nxcyorzllmew\ik2epjoeqlvqnlufbv.exe
- %WINDIR%\nxcyorzllmew\g8dlgqpuf
Substitutes the following files:
- %WINDIR%\nxcyorzllmew\g8dlgqpuf
Network activity:
Connects to:
- 're###tpower.net':80
- 'br###npower.net':80
- 'br####country.net':80
- 'pr####ecentury.net':80
- 're####country.net':80
- 're####famous.net':80
- 'fe####country.net':80
- 'do###epower.net':80
- 'br####century.net':80
- 'br####famous.net':80
- 're####century.net':80
- 'de####century.net':80
- 'st####thfamous.net':80
- 'st####thcentury.net':80
- 'st####thpower.net':80
- 'mo#####tsurprise.net':80
- 'st####thcountry.net':80
- 'de####country.net':80
- 'de####famous.net':80
- 'pr####efamous.net':80
- 'pr####epower.net':80
- 'pr####ecountry.net':80
- 'de###epower.net':80
- 'fe###wpower.net':80
- 'st###famous.net':80
- 'mi####entury.net':80
- 'mi###famous.net':80
- 'mi###power.net':80
- 'st###power.net':80
- 'st####entury.net':80
- 'bu####ngpower.net':80
- 'ev####gfamous.net':80
- 'ev####gpower.net':80
- 'ev####gcountry.net':80
- 'bu####ngcountry.net':80
- 'st####ountry.net':80
- 'do####country.net':80
- 'pr###ypower.net':80
- 'pr####country.net':80
- 'fe####famous.net':80
- 'fe####century.net':80
- 'do###rpower.net':80
- 'do####century.net':80
- 'mi####ountry.net':80
- 'pr####century.net':80
- 'pr####famous.net':80
- 'do####famous.net':80
TCP:
HTTP GET requests:
- http://re###tpower.net/index.php
- http://br###npower.net/index.php
- http://br####country.net/index.php
- http://pr####ecentury.net/index.php
- http://re####country.net/index.php
- http://re####famous.net/index.php
- http://fe####country.net/index.php
- http://do###epower.net/index.php
- http://br####century.net/index.php
- http://br####famous.net/index.php
- http://re####century.net/index.php
- http://de####century.net/index.php
- http://st####thfamous.net/index.php
- http://st####thcentury.net/index.php
- http://st####thpower.net/index.php
- http://mo#####tsurprise.net/index.php
- http://st####thcountry.net/index.php
- http://de####country.net/index.php
- http://de####famous.net/index.php
- http://pr####efamous.net/index.php
- http://pr####epower.net/index.php
- http://pr####ecountry.net/index.php
- http://de###epower.net/index.php
- http://fe###wpower.net/index.php
- http://st###famous.net/index.php
- http://mi####entury.net/index.php
- http://mi###famous.net/index.php
- http://mi###power.net/index.php
- http://st###power.net/index.php
- http://st####entury.net/index.php
- http://bu####ngpower.net/index.php
- http://ev####gfamous.net/index.php
- http://ev####gpower.net/index.php
- http://ev####gcountry.net/index.php
- http://bu####ngcountry.net/index.php
- http://st####ountry.net/index.php
- http://do####country.net/index.php
- http://pr###ypower.net/index.php
- http://pr####country.net/index.php
- http://fe####famous.net/index.php
- http://fe####century.net/index.php
- http://do###rpower.net/index.php
- http://do####century.net/index.php
- http://mi####ountry.net/index.php
- http://pr####century.net/index.php
- http://pr####famous.net/index.php
- http://do####famous.net/index.php
UDP:
- DNS ASK br####country.net
- DNS ASK re###tpower.net
- DNS ASK br###npower.net
- DNS ASK de####century.net
- DNS ASK pr####ecentury.net
- DNS ASK re####country.net
- DNS ASK br####century.net
- DNS ASK fe####country.net
- DNS ASK do###epower.net
- DNS ASK re####famous.net
- DNS ASK br####famous.net
- DNS ASK re####century.net
- DNS ASK st####thpower.net
- DNS ASK st####thfamous.net
- DNS ASK st####thcentury.net
- DNS ASK ou####esurprise.net
- DNS ASK mo#####tsurprise.net
- DNS ASK st####thcountry.net
- DNS ASK pr####epower.net
- DNS ASK de####famous.net
- DNS ASK pr####efamous.net
- DNS ASK de####country.net
- DNS ASK pr####ecountry.net
- DNS ASK de###epower.net
- DNS ASK mi###famous.net
- DNS ASK st###famous.net
- DNS ASK mi####entury.net
- DNS ASK st####ountry.net
- DNS ASK mi###power.net
- DNS ASK st###power.net
- DNS ASK ev####gpower.net
- DNS ASK bu####ngpower.net
- DNS ASK ev####gfamous.net
- DNS ASK st####entury.net
- DNS ASK ev####gcountry.net
- DNS ASK bu####ngcountry.net
- DNS ASK pr####country.net
- DNS ASK do####country.net
- DNS ASK pr###ypower.net
- DNS ASK fe###wpower.net
- DNS ASK fe####famous.net
- DNS ASK fe####century.net
- DNS ASK pr####century.net
- DNS ASK do####century.net
- DNS ASK mi####ountry.net
- DNS ASK do###rpower.net
- DNS ASK pr####famous.net
- DNS ASK do####famous.net
Miscellaneous:
Creates and executes the following:
- 'C:\nxcyorzllmew\oakyklxxajj.exe' "c:\nxcyorzllmew\ajksderkxk.exe"
- 'C:\nxcyorzllmew\ajksderkxk.exe'
- 'C:\nxcyorzllmew\ik2epjoeqlvqnlufbv.exe'
