Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Config Themes Tablet Defender Driver] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Config Themes Tablet Defender Driver] 'ImagePath' = 'C:\flsuubla\fytvgpd.exe'
Creates the following services
- 'Config Themes Tablet Defender Driver' C:\flsuubla\fytvgpd.exe
Modifies file system
Creates the following files
- %WINDIR%\flsuubla\oe6izss
- C:\flsuubla\oe6izss
- C:\flsuubla\ghyen3t9fetftgibelopw.exe
- C:\flsuubla\fytvgpd.exe
- C:\flsuubla\lddggqfau.exe
- C:\flsuubla\qqtlybgcusep
Sets the 'hidden' attribute to the following files
- C:\flsuubla\fytvgpd.exe
- C:\flsuubla\lddggqfau.exe
Deletes the following files
- %WINDIR%\flsuubla\oe6izss
- C:\flsuubla\ghyen3t9fetftgibelopw.exe
Substitutes the following files
- %WINDIR%\flsuubla\oe6izss
Network activity
Connects to
- 'me####system.net':80
TCP
HTTP GET requests
- http://wa###clear.net/index.php
- http://pa####eneral.net/index.php
- http://ge#####anquarter.net/index.php
- http://su####quarter.net/index.php
- http://ex#####ncesystem.net/index.php
UDP
- DNS ASK ex####encenorth.net
- DNS ASK su####believe.net
- DNS ASK cr####elieve.net
- DNS ASK su####receive.net
- DNS ASK cr####eceive.net
- DNS ASK su####quarter.net
- DNS ASK cr####uarter.net
- DNS ASK wa###branch.net
- DNS ASK wo###branch.net
- DNS ASK th####tbelieve.net
- DNS ASK wa####elieve.net
- DNS ASK th####treceive.net
- DNS ASK wa####eceive.net
- DNS ASK th####tquarter.net
- DNS ASK wa####uarter.net
- DNS ASK cr###branch.net
- DNS ASK th####tbranch.net
- DNS ASK su####branch.net
- DNS ASK fo####quarter.net
- DNS ASK fo####branch.net
- DNS ASK me####branch.net
- DNS ASK fo####believe.net
- DNS ASK me####believe.net
- DNS ASK fo####receive.net
- DNS ASK me####receive.net
- DNS ASK me####quarter.net
- DNS ASK be####uarter.net
- DNS ASK be###branch.net
- DNS ASK kn###branch.net
- DNS ASK be####elieve.net
- DNS ASK kn####elieve.net
- DNS ASK be####eceive.net
- DNS ASK kn####eceive.net
- DNS ASK kn####uarter.net
- DNS ASK fi####elieve.net
- DNS ASK fo####system.net
- DNS ASK sm####elieve.net
- DNS ASK fr###trust.net
- DNS ASK ex####encetrust.net
- DNS ASK ge####manhonor.net
- DNS ASK al####yhonor.net
- DNS ASK ge#####anneither.net
- DNS ASK al####yneither.net
- DNS ASK al####ysystem.net
- DNS ASK wo####elieve.net
- DNS ASK ge####mantrust.net
- DNS ASK al####ytrust.net
- DNS ASK fo###whonor.net
- DNS ASK me###rhonor.net
- DNS ASK fo####neither.net
- DNS ASK me####neither.net
- DNS ASK ex#####ncesystem.net
- DNS ASK al####yquarter.net
- DNS ASK fr###system.net
- DNS ASK pa####elieve.net
- DNS ASK wo####eceive.net
- DNS ASK sm####eceive.net
- DNS ASK wo####uarter.net
- DNS ASK sm####uarter.net
- DNS ASK pa###branch.net
- DNS ASK fi###branch.net
- DNS ASK sm###branch.net
- DNS ASK fr####either.net
- DNS ASK pa####eceive.net
- DNS ASK fi####eceive.net
- DNS ASK pa####uarter.net
- DNS ASK fi####uarter.net
- DNS ASK fr###honor.net
- DNS ASK ex####encehonor.net
- DNS ASK ex#####nceneither.net
- DNS ASK ge####mansystem.net
- DNS ASK ge#####anquarter.net
- DNS ASK fr####eceive.net
- DNS ASK be####eneral.net
- DNS ASK kn####eneral.net
- DNS ASK be####nclude.net
- DNS ASK kn####nclude.net
- DNS ASK be###north.net
- DNS ASK kn###north.net
- DNS ASK cr###clear.net
- DNS ASK th####tclear.net
- DNS ASK su####general.net
- DNS ASK cr####eneral.net
- DNS ASK su####include.net
- DNS ASK cr####nclude.net
- DNS ASK su###rnorth.net
- DNS ASK cr###north.net
- DNS ASK kn###clear.net
- DNS ASK su###rclear.net
- DNS ASK be###clear.net
- DNS ASK ge####mannorth.net
- DNS ASK ge####manclear.net
- DNS ASK al####yclear.net
- DNS ASK ge#####angeneral.net
- DNS ASK al####ygeneral.net
- DNS ASK ge#####aninclude.net
- DNS ASK al####yinclude.net
- DNS ASK al####ynorth.net
- DNS ASK fo###wnorth.net
- DNS ASK fo###wclear.net
- DNS ASK me###rclear.net
- DNS ASK fo####general.net
- DNS ASK me####general.net
- DNS ASK fo####include.net
- DNS ASK me####include.net
- DNS ASK me###rnorth.net
- DNS ASK sm####eneral.net
- DNS ASK ge#####anreceive.net
- DNS ASK wa####eneral.net
- DNS ASK pa###north.net
- DNS ASK fi###north.net
- DNS ASK fr###branch.net
- DNS ASK ex#####ncebranch.net
- DNS ASK fr####elieve.net
- DNS ASK ex#####ncebelieve.net
- DNS ASK ex#####ncereceive.net
- DNS ASK th####tgeneral.net
- DNS ASK fr####uarter.net
- DNS ASK ex#####ncequarter.net
- DNS ASK ge####manbranch.net
- DNS ASK al####ybranch.net
- DNS ASK ge#####anbelieve.net
- DNS ASK al####ybelieve.net
- DNS ASK fi####nclude.net
- DNS ASK al####yreceive.net
- DNS ASK pa####nclude.net
- DNS ASK wo####eneral.net
- DNS ASK th####tinclude.net
- DNS ASK wa####nclude.net
- DNS ASK th####tnorth.net
- DNS ASK wa###north.net
- DNS ASK wo###clear.net
- DNS ASK sm###clear.net
- DNS ASK wa###clear.net
- DNS ASK pa####eneral.net
- DNS ASK wo####nclude.net
- DNS ASK sm####nclude.net
- DNS ASK wo###north.net
- DNS ASK sm###north.net
- DNS ASK pa###clear.net
- DNS ASK fi###clear.net
- DNS ASK fi####eneral.net
- DNS ASK me####system.net
Miscellaneous
Creates and executes the following
- 'C:\flsuubla\ghyen3t9fetftgibelopw.exe'
- 'C:\flsuubla\fytvgpd.exe'
- 'C:\flsuubla\lddggqfau.exe' "c:\flsuubla\fytvgpd.exe"
