Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Tools Background Virtual] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Tools Background Virtual] 'ImagePath' = 'C:\ejpzqrhggvxe\sdbrdttrvyhl.exe'
Creates the following services
- 'Tools Background Virtual' C:\ejpzqrhggvxe\sdbrdttrvyhl.exe
Modifies file system
Creates the following files
- %WINDIR%\ejpzqrhggvxe\wonucl
- C:\ejpzqrhggvxe\wonucl
- C:\ejpzqrhggvxe\agccabpfcvdfihcgaha.exe
- C:\ejpzqrhggvxe\sdbrdttrvyhl.exe
- C:\ejpzqrhggvxe\kgosmyppcs.exe
- C:\ejpzqrhggvxe\va5vof7f
Sets the 'hidden' attribute to the following files
- C:\ejpzqrhggvxe\sdbrdttrvyhl.exe
- C:\ejpzqrhggvxe\kgosmyppcs.exe
Deletes the following files
- %WINDIR%\ejpzqrhggvxe\wonucl
- C:\ejpzqrhggvxe\agccabpfcvdfihcgaha.exe
Substitutes the following files
- %WINDIR%\ejpzqrhggvxe\wonucl
Network activity
Connects to
- 'st####training.net':80
- 'tr####raining.net':80
- 'st###tstorm.net':80
- 'tr###storm.net':80
- 'be####training.net':80
- 'qu###storm.net':80
UDP
- DNS ASK ni###hunger.net
- DNS ASK be####period.net
- DNS ASK ga####although.net
- DNS ASK be####although.net
- DNS ASK ga####choose.net
- DNS ASK be####choose.net
- DNS ASK tr####owever.net
- DNS ASK st####however.net
- DNS ASK tr###period.net
- DNS ASK st####period.net
- DNS ASK tr####lthough.net
- DNS ASK st####although.net
- DNS ASK tr###choose.net
- DNS ASK st####choose.net
- DNS ASK el####ichowever.net
- DNS ASK de####period.net
- DNS ASK re####however.net
- DNS ASK re####period.net
- DNS ASK el#####calthough.net
- DNS ASK re####although.net
- DNS ASK el####icchoose.net
- DNS ASK re####choose.net
- DNS ASK ca####nhowever.net
- DNS ASK la####owever.net
- DNS ASK ca####nperiod.net
- DNS ASK la###period.net
- DNS ASK ca####nalthough.net
- DNS ASK la####lthough.net
- DNS ASK ca####nchoose.net
- DNS ASK la###choose.net
- DNS ASK de####however.net
- DNS ASK el####icperiod.net
- DNS ASK ni####owever.net
- DNS ASK ga####period.net
- DNS ASK qu####owever.net
- DNS ASK ag####tsingle.net
- DNS ASK do###single.net
- DNS ASK ag####tcharge.net
- DNS ASK do###charge.net
- DNS ASK ag#####difference.net
- DNS ASK do####ifference.net
- DNS ASK do###every.net
- DNS ASK fl####raining.net
- DNS ASK ni###single.net
- DNS ASK de####single.net
- DNS ASK ni###charge.net
- DNS ASK de####charge.net
- DNS ASK ni####ifference.net
- DNS ASK de#####ifference.net
- DNS ASK ga####however.net
- DNS ASK be####however.net
- DNS ASK se####period.net
- DNS ASK qu###period.net
- DNS ASK se####although.net
- DNS ASK qu####lthough.net
- DNS ASK se####choose.net
- DNS ASK qu###choose.net
- DNS ASK br####owever.net
- DNS ASK fl####owever.net
- DNS ASK br###period.net
- DNS ASK fl###period.net
- DNS ASK br####lthough.net
- DNS ASK fl####lthough.net
- DNS ASK br###choose.net
- DNS ASK fl###choose.net
- DNS ASK se####however.net
- DNS ASK ni###period.net
- DNS ASK de####although.net
- DNS ASK ni####lthough.net
- DNS ASK tr###storm.net
- DNS ASK st###tstorm.net
- DNS ASK tr####raining.net
- DNS ASK st####training.net
- DNS ASK tr###hunger.net
- DNS ASK st####hunger.net
- DNS ASK el####icthrown.net
- DNS ASK re####thrown.net
- DNS ASK el####icstorm.net
- DNS ASK re###dstorm.net
- DNS ASK el#####ctraining.net
- DNS ASK re####training.net
- DNS ASK el####ichunger.net
- DNS ASK tr###thrown.net
- DNS ASK re####hunger.net
- DNS ASK la###thrown.net
- DNS ASK ca####nstorm.net
- DNS ASK la###storm.net
- DNS ASK ca####ntraining.net
- DNS ASK la####raining.net
- DNS ASK ca####nhunger.net
- DNS ASK la###hunger.net
- DNS ASK de####thrown.net
- DNS ASK ni###thrown.net
- DNS ASK de###estorm.net
- DNS ASK ni###storm.net
- DNS ASK de####training.net
- DNS ASK ni####raining.net
- DNS ASK de####hunger.net
- DNS ASK ca####nthrown.net
- DNS ASK be####hunger.net
- DNS ASK st####thrown.net
- DNS ASK ga####hunger.net
- DNS ASK de####choose.net
- DNS ASK qu####raining.net
- DNS ASK ni###choose.net
- DNS ASK do####owever.net
- DNS ASK ag####thowever.net
- DNS ASK do###period.net
- DNS ASK ag####tperiod.net
- DNS ASK do####lthough.net
- DNS ASK ag####talthough.net
- DNS ASK do###choose.net
- DNS ASK ag####tchoose.net
- DNS ASK se####thrown.net
- DNS ASK qu###thrown.net
- DNS ASK se###nstorm.net
- DNS ASK qu###storm.net
- DNS ASK se####training.net
- DNS ASK se####hunger.net
- DNS ASK be####training.net
- DNS ASK qu###hunger.net
- DNS ASK br###thrown.net
- DNS ASK fl###thrown.net
- DNS ASK br###storm.net
- DNS ASK fl###storm.net
- DNS ASK br####raining.net
- DNS ASK ag####tevery.net
- DNS ASK br###hunger.net
- DNS ASK fl###hunger.net
- DNS ASK ga####thrown.net
- DNS ASK be####thrown.net
- DNS ASK ga###rstorm.net
- DNS ASK be###rstorm.net
- DNS ASK ga####training.net
- DNS ASK ni###every.net
- DNS ASK de###eevery.net
Miscellaneous
Creates and executes the following
- 'C:\ejpzqrhggvxe\agccabpfcvdfihcgaha.exe'
- 'C:\ejpzqrhggvxe\sdbrdttrvyhl.exe'
- 'C:\ejpzqrhggvxe\kgosmyppcs.exe' "c:\ejpzqrhggvxe\sdbrdttrvyhl.exe"
