Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Support WebClient Media Gateway] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Support WebClient Media Gateway] 'ImagePath' = 'C:\tbuhksz\rqvlyioldx.exe'
Creates the following services
- 'Support WebClient Media Gateway' C:\tbuhksz\rqvlyioldx.exe
Modifies file system
Creates the following files
- %WINDIR%\tbuhksz\shavxqwk
- C:\tbuhksz\shavxqwk
- C:\tbuhksz\irsw81kxt22bye.exe
- C:\tbuhksz\rqvlyioldx.exe
- C:\tbuhksz\hvmtmboirfo.exe
Sets the 'hidden' attribute to the following files
- C:\tbuhksz\rqvlyioldx.exe
- C:\tbuhksz\hvmtmboirfo.exe
Deletes the following files
- %WINDIR%\tbuhksz\shavxqwk
- C:\tbuhksz\irsw81kxt22bye.exe
Substitutes the following files
- %WINDIR%\tbuhksz\shavxqwk
Network activity
Connects to
- 'ma####alhealth.net':80
- 'mo####ineearly.net':80
- 'fi####public.net':80
- 'fr###clean.net':80
- 'fr###paint.net':80
- 'fr###women.net':80
TCP
HTTP GET requests
- http://ma####alhealth.net/index.php
- http://mo####ineearly.net/index.php
- http://fi####public.net/index.php
- http://fr###clean.net/index.php
- http://fr###paint.net/index.php
- http://fr###women.net/index.php
UDP
- DNS ASK fi####separate.net
- DNS ASK ex####enceclean.net
- DNS ASK fr###clean.net
- DNS ASK ma####aldress.net
- DNS ASK se####ldress.net
- DNS ASK ma####alpublic.net
- DNS ASK se####lpublic.net
- DNS ASK ma####aleearly.net
- DNS ASK se####leearly.net
- DNS ASK ma####alcatch.net
- DNS ASK se####lcatch.net
- DNS ASK pr####lydress.net
- DNS ASK sw###dress.net
- DNS ASK fr###paint.net
- DNS ASK pr####lypublic.net
- DNS ASK pr####lyeearly.net
- DNS ASK sw###eearly.net
- DNS ASK pr####lycatch.net
- DNS ASK sw###catch.net
- DNS ASK le###dress.net
- DNS ASK fi###hdress.net
- DNS ASK le###public.net
- DNS ASK fi####public.net
- DNS ASK le###eearly.net
- DNS ASK fi####eearly.net
- DNS ASK le###catch.net
- DNS ASK fi###hcatch.net
- DNS ASK sw###public.net
- DNS ASK ex####encepaint.net
- DNS ASK fr###course.net
- DNS ASK ex#####ncecourse.net
- DNS ASK su###rclean.net
- DNS ASK kn###women.net
- DNS ASK be###women.net
- DNS ASK kn###course.net
- DNS ASK be###course.net
- DNS ASK kn###paint.net
- DNS ASK be###paint.net
- DNS ASK kn###clean.net
- DNS ASK be###clean.net
- DNS ASK me###rwomen.net
- DNS ASK fo###wwomen.net
- DNS ASK me####course.net
- DNS ASK fo####course.net
- DNS ASK me###rpaint.net
- DNS ASK fo###wpaint.net
- DNS ASK me###rclean.net
- DNS ASK fo###wclean.net
- DNS ASK al####ywomen.net
- DNS ASK ge####manwomen.net
- DNS ASK al####ycourse.net
- DNS ASK ge####mancourse.net
- DNS ASK al####ypaint.net
- DNS ASK ge####manpaint.net
- DNS ASK al####yclean.net
- DNS ASK ge####manclean.net
- DNS ASK ex####encewomen.net
- DNS ASK fr###women.net
- DNS ASK su####tdress.net
- DNS ASK cr###clean.net
- DNS ASK wi###rdress.net
- DNS ASK su####teearly.net
- DNS ASK se####eearly.net
- DNS ASK la###catch.net
- DNS ASK se###acatch.net
- DNS ASK ma####aldistant.net
- DNS ASK se####ldistant.net
- DNS ASK ma####alclothes.net
- DNS ASK se####lclothes.net
- DNS ASK ma####alhealth.net
- DNS ASK se####lhealth.net
- DNS ASK ma#####lseparate.net
- DNS ASK se####lseparate.net
- DNS ASK pr####lydistant.net
- DNS ASK la###eearly.net
- DNS ASK sw####istant.net
- DNS ASK sw####lothes.net
- DNS ASK pr####lyhealth.net
- DNS ASK sw###health.net
- DNS ASK pr#####yseparate.net
- DNS ASK sw####eparate.net
- DNS ASK le####istant.net
- DNS ASK fi####distant.net
- DNS ASK le####lothes.net
- DNS ASK fi####clothes.net
- DNS ASK le###health.net
- DNS ASK fi####health.net
- DNS ASK le####eparate.net
- DNS ASK pr####lyclothes.net
- DNS ASK se####public.net
- DNS ASK la###public.net
- DNS ASK se###adress.net
- DNS ASK su####tcatch.net
- DNS ASK wi###rcatch.net
- DNS ASK wi###wdress.net
- DNS ASK pe####sdress.net
- DNS ASK wi####public.net
- DNS ASK pe####spublic.net
- DNS ASK wi####eearly.net
- DNS ASK pe####seearly.net
- DNS ASK wi###wcatch.net
- DNS ASK pe####scatch.net
- DNS ASK po####ledress.net
- DNS ASK mo####indress.net
- DNS ASK po####lepublic.net
- DNS ASK mo####inpublic.net
- DNS ASK po####leeearly.net
- DNS ASK mo####ineearly.net
- DNS ASK po####lecatch.net
- DNS ASK mo####incatch.net
- DNS ASK mo###rdress.net
- DNS ASK si###edress.net
- DNS ASK mo####public.net
- DNS ASK si####public.net
- DNS ASK mo####eearly.net
- DNS ASK si####eearly.net
- DNS ASK mo###rcatch.net
- DNS ASK si###ecatch.net
- DNS ASK la###dress.net
- DNS ASK su####tpublic.net
- DNS ASK su###rpaint.net
Miscellaneous
Creates and executes the following
- 'C:\tbuhksz\irsw81kxt22bye.exe'
- 'C:\tbuhksz\rqvlyioldx.exe'
- 'C:\tbuhksz\hvmtmboirfo.exe' "c:\tbuhksz\rqvlyioldx.exe"
