Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Web Gateway Scheduler File Grouping Adapter] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Web Gateway Scheduler File Grouping Adapter] 'ImagePath' = 'C:\tlangqn\ozdoawk.exe'
Creates the following services
- 'Web Gateway Scheduler File Grouping Adapter' C:\tlangqn\ozdoawk.exe
Modifies file system
Creates the following files
- %WINDIR%\tlangqn\kgqxhvr
- C:\tlangqn\kgqxhvr
- C:\tlangqn\rkm8lisp64isanfqdfpg.exe
- C:\tlangqn\ozdoawk.exe
- C:\tlangqn\enoiuxq.exe
- C:\tlangqn\mu0lxmlb2hc
Sets the 'hidden' attribute to the following files
- C:\tlangqn\ozdoawk.exe
- C:\tlangqn\enoiuxq.exe
Deletes the following files
- %WINDIR%\tlangqn\kgqxhvr
- C:\tlangqn\rkm8lisp64isanfqdfpg.exe
Substitutes the following files
- %WINDIR%\tlangqn\kgqxhvr
Network activity
Connects to
- 'wo###short.net':80
- 'hu####dsupply.net':80
- 'be####caught.net':80
TCP
HTTP GET requests
- http://wo###short.net/index.php
- http://hu####dsupply.net/index.php
- http://be####caught.net/index.php
UDP
- DNS ASK jo####yopinion.net
- DNS ASK in####sesupply.net
- DNS ASK fo####distance.net
- DNS ASK in#####edistance.net
- DNS ASK fo####office.net
- DNS ASK in####seoffice.net
- DNS ASK fo####arrive.net
- DNS ASK in####searrive.net
- DNS ASK jo####ytrouble.net
- DNS ASK wo###supply.net
- DNS ASK wo####istance.net
- DNS ASK re#####rdistance.net
- DNS ASK wo###office.net
- DNS ASK re####eroffice.net
- DNS ASK wo###arrive.net
- DNS ASK re####erarrive.net
- DNS ASK jo####ystrong.net
- DNS ASK th####harrive.net
- DNS ASK fo####supply.net
- DNS ASK re####ersupply.net
- DNS ASK hu####dstrong.net
- DNS ASK ef####office.net
- DNS ASK th###office.net
- DNS ASK ch###arrive.net
- DNS ASK th###arrive.net
- DNS ASK wi####supply.net
- DNS ASK su####supply.net
- DNS ASK wi####distance.net
- DNS ASK su####distance.net
- DNS ASK wi####office.net
- DNS ASK su####office.net
- DNS ASK wi####arrive.net
- DNS ASK su####arrive.net
- DNS ASK ef####supply.net
- DNS ASK th####hsupply.net
- DNS ASK ef####distance.net
- DNS ASK th####hdistance.net
- DNS ASK th####hoffice.net
- DNS ASK th####istance.net
- DNS ASK ef####arrive.net
- DNS ASK re####ershould.net
- DNS ASK hu####dtrouble.net
- DNS ASK th####rouble.net
- DNS ASK th####resident.net
- DNS ASK ch###caught.net
- DNS ASK th###caught.net
- DNS ASK wi####strong.net
- DNS ASK su####strong.net
- DNS ASK wi####trouble.net
- DNS ASK su####trouble.net
- DNS ASK jo#####president.net
- DNS ASK wi####president.net
- DNS ASK wi####caught.net
- DNS ASK su####caught.net
- DNS ASK ef####strong.net
- DNS ASK th####hstrong.net
- DNS ASK ef####trouble.net
- DNS ASK th####htrouble.net
- DNS ASK ch####rouble.net
- DNS ASK th###strong.net
- DNS ASK ch####resident.net
- DNS ASK ch###strong.net
- DNS ASK be####caught.net
- DNS ASK hu#####president.net
- DNS ASK hu####dcaught.net
- DNS ASK de####ystrong.net
- DNS ASK li####strong.net
- DNS ASK de####ytrouble.net
- DNS ASK li####trouble.net
- DNS ASK de#####president.net
- DNS ASK ch####istance.net
- DNS ASK li####president.net
- DNS ASK ch###office.net
- DNS ASK li####caught.net
- DNS ASK be####strong.net
- DNS ASK ri####trouble.net
- DNS ASK be####trouble.net
- DNS ASK ri####president.net
- DNS ASK be####president.net
- DNS ASK ri####caught.net
- DNS ASK de####ycaught.net
- DNS ASK jo####ycaught.net
- DNS ASK ri####strong.net
- DNS ASK th###supply.net
- DNS ASK ch###supply.net
- DNS ASK be####arrive.net
- DNS ASK th####pinion.net
- DNS ASK ch####romise.net
- DNS ASK th####romise.net
- DNS ASK wi####should.net
- DNS ASK su####should.net
- DNS ASK wi###nshort.net
- DNS ASK su###rshort.net
- DNS ASK wi####opinion.net
- DNS ASK su####opinion.net
- DNS ASK wi####promise.net
- DNS ASK su####promise.net
- DNS ASK ef####should.net
- DNS ASK th####hshould.net
- DNS ASK ef###tshort.net
- DNS ASK th####hshort.net
- DNS ASK ch###short.net
- DNS ASK ch###should.net
- DNS ASK ch####pinion.net
- DNS ASK th###should.net
- DNS ASK be####promise.net
- DNS ASK de####ypromise.net
- DNS ASK jo####ypromise.net
- DNS ASK hu####dpromise.net
- DNS ASK de####yshould.net
- DNS ASK li####should.net
- DNS ASK de####yshort.net
- DNS ASK li###eshort.net
- DNS ASK de####yopinion.net
- DNS ASK ef####opinion.net
- DNS ASK ef####president.net
- DNS ASK li####opinion.net
- DNS ASK ri####should.net
- DNS ASK be####should.net
- DNS ASK ri###nshort.net
- DNS ASK be###gshort.net
- DNS ASK ri####opinion.net
- DNS ASK be####opinion.net
- DNS ASK ri####promise.net
- DNS ASK hu####dopinion.net
- DNS ASK li####promise.net
- DNS ASK su####president.net
- DNS ASK th####hopinion.net
- DNS ASK in####seshould.net
- DNS ASK de####ysupply.net
- DNS ASK li####supply.net
- DNS ASK de####ydistance.net
- DNS ASK li####distance.net
- DNS ASK de####yoffice.net
- DNS ASK li####office.net
- DNS ASK th###short.net
- DNS ASK de####yarrive.net
- DNS ASK ri####supply.net
- DNS ASK be####supply.net
- DNS ASK ri####distance.net
- DNS ASK be####distance.net
- DNS ASK ri####office.net
- DNS ASK be####office.net
- DNS ASK ri####arrive.net
- DNS ASK hu####doffice.net
- DNS ASK li####arrive.net
- DNS ASK hu####darrive.net
- DNS ASK jo####yarrive.net
- DNS ASK jo####yoffice.net
- DNS ASK hu####ddistance.net
- DNS ASK fo###tshort.net
- DNS ASK in####seshort.net
- DNS ASK fo####opinion.net
- DNS ASK in####seopinion.net
- DNS ASK fo####promise.net
- DNS ASK in####sepromise.net
- DNS ASK ef####promise.net
- DNS ASK wo###should.net
- DNS ASK th####hpromise.net
- DNS ASK wo###short.net
- DNS ASK wo####pinion.net
- DNS ASK re####eropinion.net
- DNS ASK wo####romise.net
- DNS ASK re####erpromise.net
- DNS ASK jo####ysupply.net
- DNS ASK hu####dsupply.net
- DNS ASK fo####should.net
- DNS ASK jo####ydistance.net
- DNS ASK re####ershort.net
- DNS ASK th#####president.net
Miscellaneous
Creates and executes the following
- 'C:\tlangqn\rkm8lisp64isanfqdfpg.exe'
- 'C:\tlangqn\ozdoawk.exe'
- 'C:\tlangqn\enoiuxq.exe' "c:\tlangqn\ozdoawk.exe"
