Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ActiveX RPC Receiver Block Discovery] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ActiveX RPC Receiver Block Discovery] 'ImagePath' = 'C:\dkswxfkhrb\gowemljrpjgk.exe'
Creates the following services
- 'ActiveX RPC Receiver Block Discovery' C:\dkswxfkhrb\gowemljrpjgk.exe
Modifies file system
Creates the following files
- %WINDIR%\dkswxfkhrb\qkkwbrttloq
- C:\dkswxfkhrb\qkkwbrttloq
- C:\dkswxfkhrb\btla36mdlmusxrqw3ft6.exe
- C:\dkswxfkhrb\gowemljrpjgk.exe
- C:\dkswxfkhrb\msyilawjxxbo.exe
Sets the 'hidden' attribute to the following files
- C:\dkswxfkhrb\gowemljrpjgk.exe
- C:\dkswxfkhrb\msyilawjxxbo.exe
Deletes the following files
- %WINDIR%\dkswxfkhrb\qkkwbrttloq
- C:\dkswxfkhrb\btla36mdlmusxrqw3ft6.exe
Substitutes the following files
- %WINDIR%\dkswxfkhrb\qkkwbrttloq
Network activity
Connects to
- 'qu###storm.net':80
- 'el####iccharge.net':80
- 'st####charge.net':80
- 'be####charge.net':80
UDP
- DNS ASK be####thrown.net
- DNS ASK de#####ifference.net
- DNS ASK ni####ifference.net
- DNS ASK de####charge.net
- DNS ASK ni###charge.net
- DNS ASK de####single.net
- DNS ASK ni###single.net
- DNS ASK do###every.net
- DNS ASK ag####tevery.net
- DNS ASK do####ifference.net
- DNS ASK ag#####difference.net
- DNS ASK do###charge.net
- DNS ASK ag####tcharge.net
- DNS ASK do###single.net
- DNS ASK ag####tsingle.net
- DNS ASK se####however.net
- DNS ASK qu####owever.net
- DNS ASK se####period.net
- DNS ASK qu###period.net
- DNS ASK se####although.net
- DNS ASK qu####lthough.net
- DNS ASK se####choose.net
- DNS ASK qu###choose.net
- DNS ASK br####owever.net
- DNS ASK fl####owever.net
- DNS ASK br###period.net
- DNS ASK fl###period.net
- DNS ASK br####lthough.net
- DNS ASK fl####lthough.net
- DNS ASK br###choose.net
- DNS ASK ni###every.net
- DNS ASK la###single.net
- DNS ASK ga###revery.net
- DNS ASK ca####nsingle.net
- DNS ASK be###revery.net
- DNS ASK ga#####ifference.net
- DNS ASK be#####ifference.net
- DNS ASK ga####charge.net
- DNS ASK be####charge.net
- DNS ASK ga####single.net
- DNS ASK be####single.net
- DNS ASK tr###every.net
- DNS ASK st###tevery.net
- DNS ASK tr####ifference.net
- DNS ASK st#####ifference.net
- DNS ASK tr###charge.net
- DNS ASK st####charge.net
- DNS ASK tr###single.net
- DNS ASK st####single.net
- DNS ASK el####icevery.net
- DNS ASK re###devery.net
- DNS ASK el#####cdifference.net
- DNS ASK re#####ifference.net
- DNS ASK el####iccharge.net
- DNS ASK re####charge.net
- DNS ASK el####icsingle.net
- DNS ASK re####single.net
- DNS ASK ca####nevery.net
- DNS ASK la###every.net
- DNS ASK ca#####difference.net
- DNS ASK la####ifference.net
- DNS ASK ca####ncharge.net
- DNS ASK la###charge.net
- DNS ASK fl###choose.net
- DNS ASK de###eevery.net
- DNS ASK ga####however.net
- DNS ASK de####period.net
- DNS ASK de####although.net
- DNS ASK ni####lthough.net
- DNS ASK de####choose.net
- DNS ASK ni###choose.net
- DNS ASK do####owever.net
- DNS ASK ag####thowever.net
- DNS ASK do###period.net
- DNS ASK ag####tperiod.net
- DNS ASK do####lthough.net
- DNS ASK ag####talthough.net
- DNS ASK do###choose.net
- DNS ASK ag####tchoose.net
- DNS ASK se####thrown.net
- DNS ASK qu###thrown.net
- DNS ASK se###nstorm.net
- DNS ASK qu###storm.net
- DNS ASK se####training.net
- DNS ASK qu####raining.net
- DNS ASK se####hunger.net
- DNS ASK qu###hunger.net
- DNS ASK br###thrown.net
- DNS ASK fl###thrown.net
- DNS ASK br###storm.net
- DNS ASK fl###storm.net
- DNS ASK br####raining.net
- DNS ASK fl####raining.net
- DNS ASK br###hunger.net
- DNS ASK fl###hunger.net
- DNS ASK ga####thrown.net
- DNS ASK ni###period.net
- DNS ASK ni####owever.net
- DNS ASK ga####period.net
- DNS ASK de####however.net
- DNS ASK be####period.net
- DNS ASK ga####although.net
- DNS ASK be####although.net
- DNS ASK ga####choose.net
- DNS ASK be####choose.net
- DNS ASK tr####owever.net
- DNS ASK st####however.net
- DNS ASK tr###period.net
- DNS ASK st####period.net
- DNS ASK tr####lthough.net
- DNS ASK st####although.net
- DNS ASK tr###choose.net
- DNS ASK st####choose.net
- DNS ASK el####ichowever.net
- DNS ASK re####however.net
- DNS ASK el####icperiod.net
- DNS ASK re####period.net
- DNS ASK el#####calthough.net
- DNS ASK re####although.net
- DNS ASK el####icchoose.net
- DNS ASK re####choose.net
- DNS ASK ca####nhowever.net
- DNS ASK la####owever.net
- DNS ASK ca####nperiod.net
- DNS ASK la###period.net
- DNS ASK ca####nalthough.net
- DNS ASK la####lthough.net
- DNS ASK ca####nchoose.net
- DNS ASK la###choose.net
- DNS ASK be####however.net
- DNS ASK fl###single.net
Miscellaneous
Creates and executes the following
- 'C:\dkswxfkhrb\btla36mdlmusxrqw3ft6.exe'
- 'C:\dkswxfkhrb\gowemljrpjgk.exe'
- 'C:\dkswxfkhrb\msyilawjxxbo.exe' "c:\dkswxfkhrb\gowemljrpjgk.exe"
