Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Visual Scheduler Process Office] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Visual Scheduler Process Office] 'ImagePath' = 'C:\jcivimfopobgqya\llcoydkki.exe'
Modifies file system
Creates the following files
- %WINDIR%\jcivimfopobgqya\goahdb
- C:\jcivimfopobgqya\goahdb
- C:\jcivimfopobgqya\ifwazn955ajahuooaeza.exe
- C:\jcivimfopobgqya\llcoydkki.exe
- C:\jcivimfopobgqya\fzpdrldqahmh.exe
Sets the 'hidden' attribute to the following files
- C:\jcivimfopobgqya\llcoydkki.exe
- C:\jcivimfopobgqya\fzpdrldqahmh.exe
Deletes the following files
- %WINDIR%\jcivimfopobgqya\goahdb
- C:\jcivimfopobgqya\ifwazn955ajahuooaeza.exe
Substitutes the following files
- %WINDIR%\jcivimfopobgqya\goahdb
Network activity
TCP
HTTP GET requests
- http://re####period.net/index.php
- http://qu####lthough.net/index.php
- http://be####charge.net/index.php
- http://fl###single.net/index.php
UDP
- DNS ASK ca####nchoose.net
- DNS ASK el#####cdifference.net
- DNS ASK re#####ifference.net
- DNS ASK el####iccharge.net
- DNS ASK re####charge.net
- DNS ASK el####icsingle.net
- DNS ASK re####single.net
- DNS ASK ca####nevery.net
- DNS ASK la###every.net
- DNS ASK ca#####difference.net
- DNS ASK la####ifference.net
- DNS ASK el####icevery.net
- DNS ASK re###devery.net
- DNS ASK ca####nsingle.net
- DNS ASK la###single.net
- DNS ASK de###eevery.net
- DNS ASK ni###every.net
- DNS ASK de#####ifference.net
- DNS ASK ni####ifference.net
- DNS ASK de####charge.net
- DNS ASK ni###charge.net
- DNS ASK de####single.net
- DNS ASK ni###single.net
- DNS ASK ca####ncharge.net
- DNS ASK ga####although.net
- DNS ASK st####single.net
- DNS ASK qu###single.net
- DNS ASK br###every.net
- DNS ASK fl###every.net
- DNS ASK br####ifference.net
- DNS ASK fl####ifference.net
- DNS ASK br###charge.net
- DNS ASK fl###charge.net
- DNS ASK br###single.net
- DNS ASK fl###single.net
- DNS ASK ga###revery.net
- DNS ASK be###revery.net
- DNS ASK ga#####ifference.net
- DNS ASK be#####ifference.net
- DNS ASK ga####charge.net
- DNS ASK be####charge.net
- DNS ASK ga####single.net
- DNS ASK be####single.net
- DNS ASK tr###every.net
- DNS ASK st###tevery.net
- DNS ASK tr####ifference.net
- DNS ASK st#####ifference.net
- DNS ASK tr###charge.net
- DNS ASK st####charge.net
- DNS ASK do###every.net
- DNS ASK la###charge.net
- DNS ASK ag####tevery.net
- DNS ASK do####ifference.net
- DNS ASK ag#####difference.net
- DNS ASK el####icperiod.net
- DNS ASK tr####owever.net
- DNS ASK st####however.net
- DNS ASK tr###period.net
- DNS ASK st####period.net
- DNS ASK tr####lthough.net
- DNS ASK st####although.net
- DNS ASK tr###choose.net
- DNS ASK st####choose.net
- DNS ASK el####ichowever.net
- DNS ASK re####however.net
- DNS ASK re####period.net
- DNS ASK ga####choose.net
- DNS ASK el#####calthough.net
- DNS ASK re####although.net
- DNS ASK el####icchoose.net
- DNS ASK re####choose.net
- DNS ASK ca####nhowever.net
- DNS ASK la####owever.net
- DNS ASK ca####nperiod.net
- DNS ASK la###period.net
- DNS ASK ca####nalthough.net
- DNS ASK la####lthough.net
- DNS ASK se####single.net
- DNS ASK tr###single.net
- DNS ASK be####although.net
- DNS ASK ga####period.net
- DNS ASK be####choose.net
- DNS ASK do###charge.net
- DNS ASK ag####tcharge.net
- DNS ASK do###single.net
- DNS ASK ag####tsingle.net
- DNS ASK se####however.net
- DNS ASK qu####owever.net
- DNS ASK se####period.net
- DNS ASK qu###period.net
- DNS ASK se####although.net
- DNS ASK qu####lthough.net
- DNS ASK se####choose.net
- DNS ASK qu###choose.net
- DNS ASK br####owever.net
- DNS ASK fl####owever.net
- DNS ASK br###period.net
- DNS ASK fl###period.net
- DNS ASK br####lthough.net
- DNS ASK fl####lthough.net
- DNS ASK br###choose.net
- DNS ASK fl###choose.net
- DNS ASK ga####however.net
- DNS ASK be####however.net
- DNS ASK be####period.net
- DNS ASK qu###charge.net
Miscellaneous
Creates and executes the following
- 'C:\jcivimfopobgqya\ifwazn955ajahuooaeza.exe'
- 'C:\jcivimfopobgqya\llcoydkki.exe'
- 'C:\jcivimfopobgqya\fzpdrldqahmh.exe' "c:\jcivimfopobgqya\llcoydkki.exe"
