Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Task Disk Remote UPnP Human Protected SNMP] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Task Disk Remote UPnP Human Protected SNMP] 'ImagePath' = 'C:\sjimdajprkiqv\aqmapqt.exe'
Creates the following services
- 'Task Disk Remote UPnP Human Protected SNMP' C:\sjimdajprkiqv\aqmapqt.exe
Modifies file system
Creates the following files
- %WINDIR%\sjimdajprkiqv\uzbrfxl7x
- C:\sjimdajprkiqv\uzbrfxl7x
- C:\sjimdajprkiqv\bjcukj7bclq0kgvsjzfex.exe
- C:\sjimdajprkiqv\aqmapqt.exe
- C:\sjimdajprkiqv\swjpsocok.exe
Sets the 'hidden' attribute to the following files
- C:\sjimdajprkiqv\aqmapqt.exe
- C:\sjimdajprkiqv\swjpsocok.exe
Deletes the following files
- %WINDIR%\sjimdajprkiqv\uzbrfxl7x
- C:\sjimdajprkiqv\bjcukj7bclq0kgvsjzfex.exe
Substitutes the following files
- %WINDIR%\sjimdajprkiqv\uzbrfxl7x
Network activity
Connects to
- 'ch###dollar.net':80
- 'ch###board.net':80
- 'li####bridge.net':80
TCP
HTTP GET requests
- http://ch###dollar.net/index.php
- http://ch###board.net/index.php
- http://li####bridge.net/index.php
UDP
- DNS ASK ri###nshore.net
- DNS ASK ef####character.net
- DNS ASK th#####character.net
- DNS ASK ef####ladder.net
- DNS ASK th####hladder.net
- DNS ASK ef###tboard.net
- DNS ASK th####hboard.net
- DNS ASK th####henter.net
- DNS ASK ch###enter.net
- DNS ASK fo####character.net
- DNS ASK in#####echaracter.net
- DNS ASK fo####ladder.net
- DNS ASK in####seladder.net
- DNS ASK fo###tboard.net
- DNS ASK in####seboard.net
- DNS ASK su###renter.net
- DNS ASK wi###nenter.net
- DNS ASK su###rboard.net
- DNS ASK wi###nboard.net
- DNS ASK su####ladder.net
- DNS ASK wi####ladder.net
- DNS ASK su####character.net
- DNS ASK wi####character.net
- DNS ASK th###enter.net
- DNS ASK ef###tenter.net
- DNS ASK th###board.net
- DNS ASK ch###board.net
- DNS ASK th###ladder.net
- DNS ASK ch###ladder.net
- DNS ASK th####haracter.net
- DNS ASK ch####haracter.net
- DNS ASK be###genter.net
- DNS ASK fo###tenter.net
- DNS ASK hu####dexcept.net
- DNS ASK th###except.net
- DNS ASK re#####rcharacter.net
- DNS ASK li####bridge.net
- DNS ASK de####ybicycle.net
- DNS ASK li####bicycle.net
- DNS ASK de####ywhose.net
- DNS ASK li###ewhose.net
- DNS ASK ri####except.net
- DNS ASK ri####bridge.net
- DNS ASK in####seenter.net
- DNS ASK be####bridge.net
- DNS ASK ri####bicycle.net
- DNS ASK be####bicycle.net
- DNS ASK ri###nwhose.net
- DNS ASK be###gwhose.net
- DNS ASK ch###except.net
- DNS ASK de####ybridge.net
- DNS ASK li####except.net
- DNS ASK de####yexcept.net
- DNS ASK hu####dwhose.net
- DNS ASK jo####ywhose.net
- DNS ASK hu####dbicycle.net
- DNS ASK jo####ybicycle.net
- DNS ASK hu####dbridge.net
- DNS ASK jo####ybridge.net
- DNS ASK ri###nenter.net
- DNS ASK jo####yexcept.net
- DNS ASK re####erenter.net
- DNS ASK wo###enter.net
- DNS ASK re####erboard.net
- DNS ASK wo###board.net
- DNS ASK re####erladder.net
- DNS ASK wo###ladder.net
- DNS ASK wo####haracter.net
- DNS ASK be####except.net
- DNS ASK be###gboard.net
- DNS ASK li####ladder.net
- DNS ASK wi####written.net
- DNS ASK su####written.net
- DNS ASK wi####dollar.net
- DNS ASK su####dollar.net
- DNS ASK wi####realize.net
- DNS ASK su####realize.net
- DNS ASK th####hshore.net
- DNS ASK ch###shore.net
- DNS ASK ef####written.net
- DNS ASK th####hwritten.net
- DNS ASK ef####dollar.net
- DNS ASK th####hdollar.net
- DNS ASK ef####realize.net
- DNS ASK th####hrealize.net
- DNS ASK su###rshore.net
- DNS ASK wi###nshore.net
- DNS ASK th####ealize.net
- DNS ASK ch####ealize.net
- DNS ASK th###dollar.net
- DNS ASK ch###dollar.net
- DNS ASK th####ritten.net
- DNS ASK ch####ritten.net
- DNS ASK th###shore.net
- DNS ASK ef###tshore.net
- DNS ASK be####realize.net
- DNS ASK ri####realize.net
- DNS ASK be####dollar.net
- DNS ASK ri####dollar.net
- DNS ASK be####written.net
- DNS ASK ri####written.net
- DNS ASK be###gshore.net
- DNS ASK fo###tshore.net
- DNS ASK re####erwritten.net
- DNS ASK be####ladder.net
- DNS ASK in####sewritten.net
- DNS ASK hu####dboard.net
- DNS ASK jo####yenter.net
- DNS ASK hu####denter.net
- DNS ASK de#####character.net
- DNS ASK li####character.net
- DNS ASK de####yladder.net
- DNS ASK de####yboard.net
- DNS ASK in####seshore.net
- DNS ASK li###eboard.net
- DNS ASK de####yenter.net
- DNS ASK li###eenter.net
- DNS ASK ri####character.net
- DNS ASK be####character.net
- DNS ASK ri####ladder.net
- DNS ASK jo####yboard.net
- DNS ASK hu####dladder.net
- DNS ASK jo####yladder.net
- DNS ASK hu#####character.net
- DNS ASK jo#####character.net
- DNS ASK re####errealize.net
- DNS ASK wo####ealize.net
- DNS ASK re####erdollar.net
- DNS ASK wo###dollar.net
- DNS ASK ri###nboard.net
- DNS ASK wo####ritten.net
- DNS ASK re####ershore.net
- DNS ASK wo###shore.net
- DNS ASK in####serealize.net
- DNS ASK fo####realize.net
- DNS ASK in####sedollar.net
- DNS ASK fo####dollar.net
- DNS ASK fo####written.net
- DNS ASK ch###bridge.net
Miscellaneous
Creates and executes the following
- 'C:\sjimdajprkiqv\bjcukj7bclq0kgvsjzfex.exe'
- 'C:\sjimdajprkiqv\aqmapqt.exe'
- 'C:\sjimdajprkiqv\swjpsocok.exe' "c:\sjimdajprkiqv\aqmapqt.exe"
