Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Builder Removal BitLocker System Extensible] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Builder Removal BitLocker System Extensible] 'ImagePath' = 'C:\dzwyhysejsisa\nqdzcslq.exe'
Creates the following services
- 'Builder Removal BitLocker System Extensible' C:\dzwyhysejsisa\nqdzcslq.exe
Modifies file system
Creates the following files
- %WINDIR%\dzwyhysejsisa\vqzvaxxs
- C:\dzwyhysejsisa\vqzvaxxs
- C:\dzwyhysejsisa\xyp9jqzvueqjuqxx.exe
- C:\dzwyhysejsisa\nqdzcslq.exe
- C:\dzwyhysejsisa\mvclthpm.exe
Sets the 'hidden' attribute to the following files
- C:\dzwyhysejsisa\nqdzcslq.exe
- C:\dzwyhysejsisa\mvclthpm.exe
Deletes the following files
- %WINDIR%\dzwyhysejsisa\vqzvaxxs
- C:\dzwyhysejsisa\xyp9jqzvueqjuqxx.exe
Substitutes the following files
- %WINDIR%\dzwyhysejsisa\vqzvaxxs
Network activity
Connects to
- 'wa####oodbye.net':80
- 'wa####roblem.net':80
- 'wo###escape.net':80
- 'pa###animal.net':80
- 'fr###valley.net':80
- 'kn###labor.net':80
TCP
HTTP GET requests
- http://wa####oodbye.net/index.php
- http://wa####roblem.net/index.php
- http://wo###escape.net/index.php
- http://pa###animal.net/index.php
- http://fr###valley.net/index.php
- http://kn###labor.net/index.php
UDP
- DNS ASK al####yadvance.net
- DNS ASK th####tanimal.net
- DNS ASK wa###animal.net
- DNS ASK th####tproblem.net
- DNS ASK wa####roblem.net
- DNS ASK th####tmodern.net
- DNS ASK wa###modern.net
- DNS ASK wo###escape.net
- DNS ASK sm###escape.net
- DNS ASK wo###animal.net
- DNS ASK sm###animal.net
- DNS ASK wo####roblem.net
- DNS ASK sm####roblem.net
- DNS ASK wo###modern.net
- DNS ASK sm###modern.net
- DNS ASK pa###escape.net
- DNS ASK wa###escape.net
- DNS ASK fi###escape.net
- DNS ASK th####tescape.net
- DNS ASK su####modern.net
- DNS ASK me####modern.net
- DNS ASK be###escape.net
- DNS ASK kn###escape.net
- DNS ASK be###animal.net
- DNS ASK kn###animal.net
- DNS ASK be####roblem.net
- DNS ASK kn####roblem.net
- DNS ASK be###modern.net
- DNS ASK kn###modern.net
- DNS ASK su####escape.net
- DNS ASK cr###escape.net
- DNS ASK su####animal.net
- DNS ASK cr###animal.net
- DNS ASK su####problem.net
- DNS ASK cr####roblem.net
- DNS ASK cr###modern.net
- DNS ASK pa###animal.net
- DNS ASK fi###animal.net
- DNS ASK pa####roblem.net
- DNS ASK fo####sister.net
- DNS ASK me####sister.net
- DNS ASK fo####valley.net
- DNS ASK me####valley.net
- DNS ASK fo###wlabor.net
- DNS ASK me###rlabor.net
- DNS ASK su####silver.net
- DNS ASK be###silver.net
- DNS ASK be###sister.net
- DNS ASK kn###sister.net
- DNS ASK be###valley.net
- DNS ASK kn###valley.net
- DNS ASK be###labor.net
- DNS ASK kn###labor.net
- DNS ASK fo####silver.net
- DNS ASK me####silver.net
- DNS ASK al####ylabor.net
- DNS ASK ge####manlabor.net
- DNS ASK al####yvalley.net
- DNS ASK pa###modern.net
- DNS ASK fi###modern.net
- DNS ASK fr###silver.net
- DNS ASK ex#####ncesilver.net
- DNS ASK fr###sister.net
- DNS ASK ex#####ncesister.net
- DNS ASK fo####modern.net
- DNS ASK ex#####ncevalley.net
- DNS ASK fr###valley.net
- DNS ASK ex####encelabor.net
- DNS ASK ge####mansilver.net
- DNS ASK al####ysilver.net
- DNS ASK ge####mansister.net
- DNS ASK al####ysister.net
- DNS ASK ge####manvalley.net
- DNS ASK fi####roblem.net
- DNS ASK fr###labor.net
- DNS ASK kn###silver.net
- DNS ASK me####problem.net
- DNS ASK ge#####anproblem.net
- DNS ASK kn####oodbye.net
- DNS ASK be####ortieth.net
- DNS ASK kn####ortieth.net
- DNS ASK su####advance.net
- DNS ASK cr####dvance.net
- DNS ASK su####stranger.net
- DNS ASK cr####tranger.net
- DNS ASK su####goodbye.net
- DNS ASK cr####oodbye.net
- DNS ASK su####fortieth.net
- DNS ASK cr####ortieth.net
- DNS ASK th####tadvance.net
- DNS ASK wa####dvance.net
- DNS ASK th####tstranger.net
- DNS ASK wa####tranger.net
- DNS ASK be####oodbye.net
- DNS ASK th####tgoodbye.net
- DNS ASK kn####tranger.net
- DNS ASK kn####dvance.net
- DNS ASK ge#####anstranger.net
- DNS ASK al####ystranger.net
- DNS ASK ge#####angoodbye.net
- DNS ASK al####ygoodbye.net
- DNS ASK ge#####anfortieth.net
- DNS ASK al####yfortieth.net
- DNS ASK fo####advance.net
- DNS ASK me####advance.net
- DNS ASK fo####stranger.net
- DNS ASK me####stranger.net
- DNS ASK fo####goodbye.net
- DNS ASK me####goodbye.net
- DNS ASK fo####fortieth.net
- DNS ASK me####fortieth.net
- DNS ASK be####dvance.net
- DNS ASK be####tranger.net
- DNS ASK wa####oodbye.net
- DNS ASK th####tfortieth.net
- DNS ASK wa####ortieth.net
- DNS ASK ex#####nceproblem.net
- DNS ASK fr###modern.net
- DNS ASK ex#####ncemodern.net
- DNS ASK ge####manescape.net
- DNS ASK al####yescape.net
- DNS ASK ge####mananimal.net
- DNS ASK me####animal.net
- DNS ASK al####yanimal.net
- DNS ASK al####yproblem.net
- DNS ASK ge####manmodern.net
- DNS ASK al####ymodern.net
- DNS ASK fo####escape.net
- DNS ASK me####escape.net
- DNS ASK fo####animal.net
- DNS ASK ex#####nceanimal.net
- DNS ASK fr####roblem.net
- DNS ASK fr###animal.net
- DNS ASK ex#####nceescape.net
- DNS ASK fr###escape.net
- DNS ASK sm####dvance.net
- DNS ASK wo####tranger.net
- DNS ASK sm####tranger.net
- DNS ASK wo####oodbye.net
- DNS ASK sm####oodbye.net
- DNS ASK wo####ortieth.net
- DNS ASK fo####problem.net
- DNS ASK pa####dvance.net
- DNS ASK sm####ortieth.net
- DNS ASK pa####tranger.net
- DNS ASK fi####tranger.net
- DNS ASK pa####oodbye.net
- DNS ASK fi####oodbye.net
- DNS ASK pa####ortieth.net
- DNS ASK fi####ortieth.net
- DNS ASK wo####dvance.net
- DNS ASK fi####dvance.net
- DNS ASK cr###silver.net
Miscellaneous
Creates and executes the following
- 'C:\dzwyhysejsisa\xyp9jqzvueqjuqxx.exe'
- 'C:\dzwyhysejsisa\nqdzcslq.exe'
- 'C:\dzwyhysejsisa\mvclthpm.exe' "c:\dzwyhysejsisa\nqdzcslq.exe"
