Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Tablet ActiveX Print Compatibility Performance] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Tablet ActiveX Print Compatibility Performance] 'ImagePath' = 'C:\yxvmlmjq\vhquaqxa.exe'
Creates the following services
- 'Tablet ActiveX Print Compatibility Performance' C:\yxvmlmjq\vhquaqxa.exe
Modifies file system
Creates the following files
- %WINDIR%\yxvmlmjq\klnviec0jb
- C:\yxvmlmjq\klnviec0jb
- C:\yxvmlmjq\cjaipad7xvba4rychmurm.exe
- C:\yxvmlmjq\vhquaqxa.exe
- C:\yxvmlmjq\ubimqurah.exe
- C:\yxvmlmjq\xgtnhuk
Sets the 'hidden' attribute to the following files
- C:\yxvmlmjq\vhquaqxa.exe
- C:\yxvmlmjq\ubimqurah.exe
Deletes the following files
- %WINDIR%\yxvmlmjq\klnviec0jb
- C:\yxvmlmjq\cjaipad7xvba4rychmurm.exe
Substitutes the following files
- %WINDIR%\yxvmlmjq\klnviec0jb
Network activity
Connects to
- 'si###eboard.net':80
- 'mo###rboard.net':80
- 'mo####inboard.net':80
- 'su#####character.net':80
- 'ma####alboard.net':80
- 'se####except.net':80
TCP
HTTP GET requests
- http://si###eboard.net/index.php
- http://mo###rboard.net/index.php
- http://su#####character.net/index.php
- http://ma####alboard.net/index.php
- http://se####except.net/index.php
UDP
- DNS ASK wi####dollar.net
- DNS ASK le###ladder.net
- DNS ASK fi####ladder.net
- DNS ASK le####haracter.net
- DNS ASK fi####character.net
- DNS ASK su####tenter.net
- DNS ASK wi###renter.net
- DNS ASK su####tboard.net
- DNS ASK wi###rboard.net
- DNS ASK su####tladder.net
- DNS ASK fi###hboard.net
- DNS ASK su#####character.net
- DNS ASK pe####senter.net
- DNS ASK wi###wboard.net
- DNS ASK pe####sboard.net
- DNS ASK wi####ladder.net
- DNS ASK pe####sladder.net
- DNS ASK wi####character.net
- DNS ASK pe#####character.net
- DNS ASK po####leenter.net
- DNS ASK mo####inenter.net
- DNS ASK wi###wenter.net
- DNS ASK le###board.net
- DNS ASK fi###henter.net
- DNS ASK le###enter.net
- DNS ASK se####bicycle.net
- DNS ASK la###bridge.net
- DNS ASK se####bridge.net
- DNS ASK la###except.net
- DNS ASK se####except.net
- DNS ASK ma####alenter.net
- DNS ASK se####lenter.net
- DNS ASK ma####alboard.net
- DNS ASK se####lboard.net
- DNS ASK ma####alladder.net
- DNS ASK se####lladder.net
- DNS ASK ma#####lcharacter.net
- DNS ASK se#####character.net
- DNS ASK pr####lyenter.net
- DNS ASK sw###enter.net
- DNS ASK pr####lyboard.net
- DNS ASK sw###board.net
- DNS ASK pr####lyladder.net
- DNS ASK sw###ladder.net
- DNS ASK pr#####ycharacter.net
- DNS ASK sw####haracter.net
- DNS ASK po####leboard.net
- DNS ASK la####icycle.net
- DNS ASK mo####inboard.net
- DNS ASK mo####inladder.net
- DNS ASK se####lshore.net
- DNS ASK pr####lyrealize.net
- DNS ASK sw####ealize.net
- DNS ASK pr####lydollar.net
- DNS ASK sw###dollar.net
- DNS ASK pr####lywritten.net
- DNS ASK sw####ritten.net
- DNS ASK pr####lyshore.net
- DNS ASK sw###shore.net
- DNS ASK ma####alshore.net
- DNS ASK le####ealize.net
- DNS ASK le###dollar.net
- DNS ASK fi####dollar.net
- DNS ASK le####ritten.net
- DNS ASK fi####written.net
- DNS ASK le###shore.net
- DNS ASK fi###hshore.net
- DNS ASK su####trealize.net
- DNS ASK wi####realize.net
- DNS ASK su####tdollar.net
- DNS ASK fi####realize.net
- DNS ASK se####lwritten.net
- DNS ASK ma####alwritten.net
- DNS ASK se####ldollar.net
- DNS ASK po#####echaracter.net
- DNS ASK mo#####ncharacter.net
- DNS ASK mo###renter.net
- DNS ASK si###eenter.net
- DNS ASK mo###rboard.net
- DNS ASK si###eboard.net
- DNS ASK mo####ladder.net
- DNS ASK si####ladder.net
- DNS ASK mo####character.net
- DNS ASK si####character.net
- DNS ASK la###enter.net
- DNS ASK se###aenter.net
- DNS ASK la###board.net
- DNS ASK se###aboard.net
- DNS ASK la###ladder.net
- DNS ASK se####ladder.net
- DNS ASK la####haracter.net
- DNS ASK se####character.net
- DNS ASK ma####alrealize.net
- DNS ASK se####lrealize.net
- DNS ASK ma####aldollar.net
- DNS ASK po####leladder.net
- DNS ASK se###awhose.net
Miscellaneous
Creates and executes the following
- 'C:\yxvmlmjq\cjaipad7xvba4rychmurm.exe'
- 'C:\yxvmlmjq\vhquaqxa.exe'
- 'C:\yxvmlmjq\ubimqurah.exe' "c:\yxvmlmjq\vhquaqxa.exe"
