Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Telephony Biometric Reporting] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Telephony Biometric Reporting] 'ImagePath' = 'C:\zqxqgovllxenbk\mkicfcezmm.exe'
Creates the following services
- 'Telephony Biometric Reporting' C:\zqxqgovllxenbk\mkicfcezmm.exe
Modifies file system
Creates the following files
- %WINDIR%\zqxqgovllxenbk\gsnrsrqb
- C:\zqxqgovllxenbk\gsnrsrqb
- C:\zqxqgovllxenbk\aoonjqs2ysfxaxeodlb.exe
- C:\zqxqgovllxenbk\mkicfcezmm.exe
- C:\zqxqgovllxenbk\tobvlzpoac.exe
- C:\zqxqgovllxenbk\yodkayph
Sets the 'hidden' attribute to the following files
- C:\zqxqgovllxenbk\mkicfcezmm.exe
- C:\zqxqgovllxenbk\tobvlzpoac.exe
Deletes the following files
- %WINDIR%\zqxqgovllxenbk\gsnrsrqb
- C:\zqxqgovllxenbk\aoonjqs2ysfxaxeodlb.exe
Substitutes the following files
- %WINDIR%\zqxqgovllxenbk\gsnrsrqb
Network activity
Connects to
- 'ma####epublic.net':80
- 'th####public.net':80
- 'th###hdress.net':80
- 'en####hpublic.net':80
- 'do###rclean.net':80
- 'pr###yclean.net':80
- 'pr###ywomen.net':80
- 'do###eclean.net':80
- 'de####course.net':80
- 'st###clean.net':80
- 'ev####gnothing.net':80
TCP
HTTP GET requests
- http://ma####epublic.net/index.php
- http://th####public.net/index.php
- http://th###hdress.net/index.php
- http://en####hpublic.net/index.php
- http://do###rclean.net/index.php
- http://pr###yclean.net/index.php
- http://pr###ywomen.net/index.php
- http://do###eclean.net/index.php
- http://de####course.net/index.php
- http://st###clean.net/index.php
- http://ev####gnothing.net/index.php
UDP
- DNS ASK ex####public.net
- DNS ASK re###tclean.net
- DNS ASK br###nclean.net
- DNS ASK do###ewomen.net
- DNS ASK fe###wwomen.net
- DNS ASK fe####course.net
- DNS ASK do###epaint.net
- DNS ASK fe###wpaint.net
- DNS ASK do###eclean.net
- DNS ASK fe###wclean.net
- DNS ASK pr###ywomen.net
- DNS ASK do###rwomen.net
- DNS ASK pr####course.net
- DNS ASK do####course.net
- DNS ASK pr###ypaint.net
- DNS ASK ev####gclean.net
- DNS ASK do###rpaint.net
- DNS ASK do###rclean.net
- DNS ASK mi###women.net
- DNS ASK st###women.net
- DNS ASK mi###course.net
- DNS ASK st###course.net
- DNS ASK mi###paint.net
- DNS ASK st###paint.net
- DNS ASK mi###clean.net
- DNS ASK st###clean.net
- DNS ASK ev####gwomen.net
- DNS ASK bu####ngwomen.net
- DNS ASK ev####gcourse.net
- DNS ASK bu####ngcourse.net
- DNS ASK ev####gpaint.net
- DNS ASK pr###yclean.net
- DNS ASK bu####ngpaint.net
- DNS ASK br###npaint.net
- DNS ASK st####thwomen.net
- DNS ASK ou####estream.net
- DNS ASK mo####ntnothing.net
- DNS ASK ou####enothing.net
- DNS ASK mo####ntbottle.net
- DNS ASK ou####ebottle.net
- DNS ASK mo####ntdivide.net
- DNS ASK bu####ngstream.net
- DNS ASK pi####edress.net
- DNS ASK ev####gstream.net
- DNS ASK bu####ngnothing.net
- DNS ASK ev####gnothing.net
- DNS ASK bu####ngbottle.net
- DNS ASK ev####gbottle.net
- DNS ASK bu####ngdivide.net
- DNS ASK br####course.net
- DNS ASK re###tpaint.net
- DNS ASK st####thcourse.net
- DNS ASK st####thpaint.net
- DNS ASK st####thclean.net
- DNS ASK de###ewomen.net
- DNS ASK pr####ewomen.net
- DNS ASK de####course.net
- DNS ASK pr####ecourse.net
- DNS ASK de###epaint.net
- DNS ASK pr####epaint.net
- DNS ASK de###eclean.net
- DNS ASK pr####eclean.net
- DNS ASK re###twomen.net
- DNS ASK br###nwomen.net
- DNS ASK re####course.net
- DNS ASK mo####ntstream.net
- DNS ASK bu####ngclean.net
- DNS ASK ou####ewomen.net
- DNS ASK mo####ntwomen.net
- DNS ASK th###hcatch.net
- DNS ASK fi###ecatch.net
- DNS ASK ri###dress.net
- DNS ASK wh####rdress.net
- DNS ASK ri###public.net
- DNS ASK wh####rpublic.net
- DNS ASK ri###eearly.net
- DNS ASK wh####reearly.net
- DNS ASK ri###catch.net
- DNS ASK wh####rcatch.net
- DNS ASK fo####ndress.net
- DNS ASK su###ndress.net
- DNS ASK fo####npublic.net
- DNS ASK th####eearly.net
- DNS ASK su####public.net
- DNS ASK su####eearly.net
- DNS ASK fo####ncatch.net
- DNS ASK su###ncatch.net
- DNS ASK ma####edress.net
- DNS ASK pe###ndress.net
- DNS ASK ma####epublic.net
- DNS ASK pe####public.net
- DNS ASK ma####eeearly.net
- DNS ASK pe####eearly.net
- DNS ASK ma####ecatch.net
- DNS ASK pe###ncatch.net
- DNS ASK be####edress.net
- DNS ASK ex###tdress.net
- DNS ASK be####epublic.net
- DNS ASK fo####neearly.net
- DNS ASK fi####public.net
- DNS ASK fi####eearly.net
- DNS ASK th####public.net
- DNS ASK ou####ecourse.net
- DNS ASK ch####endress.net
- DNS ASK mo####ntcourse.net
- DNS ASK ou####epaint.net
- DNS ASK mo####ntpaint.net
- DNS ASK ou####eclean.net
- DNS ASK mo####ntclean.net
- DNS ASK en####hdress.net
- DNS ASK ei###rdress.net
- DNS ASK en####hpublic.net
- DNS ASK ei####public.net
- DNS ASK en####heearly.net
- DNS ASK ei####eearly.net
- DNS ASK en####hcatch.net
- DNS ASK ei###rcatch.net
- DNS ASK fa###ydress.net
- DNS ASK fa####public.net
- DNS ASK fi###edress.net
- DNS ASK ch####enpublic.net
- DNS ASK fa####eearly.net
- DNS ASK ch####eneearly.net
- DNS ASK fa###ycatch.net
- DNS ASK ch####encatch.net
- DNS ASK ci####ttedress.net
- DNS ASK ou####edivide.net
- DNS ASK ci####ttepublic.net
- DNS ASK pi####epublic.net
- DNS ASK ci####tteeearly.net
- DNS ASK pi####eeearly.net
- DNS ASK ci####ttecatch.net
- DNS ASK pi####ecatch.net
- DNS ASK th###hdress.net
- DNS ASK ev####gdivide.net
- DNS ASK st###stream.net
Miscellaneous
Creates and executes the following
- 'C:\zqxqgovllxenbk\aoonjqs2ysfxaxeodlb.exe'
- 'C:\zqxqgovllxenbk\mkicfcezmm.exe'
- 'C:\zqxqgovllxenbk\tobvlzpoac.exe' "c:\zqxqgovllxenbk\mkicfcezmm.exe"
