Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Secondary Error Defragmenter] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Secondary Error Defragmenter] 'ImagePath' = 'C:\izllvqtmbcyst\fcwlcjvch.exe'
Creates the following services
- 'Secondary Error Defragmenter' C:\izllvqtmbcyst\fcwlcjvch.exe
Modifies file system
Creates the following files
- %WINDIR%\izllvqtmbcyst\vqpckt
- C:\izllvqtmbcyst\vqpckt
- C:\izllvqtmbcyst\beont4irwwmovcgdrtz.exe
- C:\izllvqtmbcyst\fcwlcjvch.exe
- C:\izllvqtmbcyst\qqozjkcbdn.exe
Sets the 'hidden' attribute to the following files
- C:\izllvqtmbcyst\fcwlcjvch.exe
- C:\izllvqtmbcyst\qqozjkcbdn.exe
Deletes the following files
- %WINDIR%\izllvqtmbcyst\vqpckt
- C:\izllvqtmbcyst\beont4irwwmovcgdrtz.exe
Substitutes the following files
- %WINDIR%\izllvqtmbcyst\vqpckt
Network activity
Connects to
- 'ni####itchen.net':80
- 'st####kitchen.net':80
- 'be####kitchen.net':80
- 'ga####kitchen.net':80
- 'tr###around.net':80
- 'tr###proud.net':80
- 'st####complete.net':80
- 'ga####around.net':80
TCP
HTTP GET requests
- http://ni####itchen.net/index.php
- http://st####kitchen.net/index.php
- http://be####kitchen.net/index.php
- http://ga####kitchen.net/index.php
- http://tr###around.net/index.php
- http://tr###proud.net/index.php
- http://st####complete.net/index.php
- http://ga####around.net/index.php
UDP
- DNS ASK fl####icycle.net
- DNS ASK ca####nwelcome.net
- DNS ASK la###around.net
- DNS ASK ca####naround.net
- DNS ASK la###proud.net
- DNS ASK ca####nproud.net
- DNS ASK re####complete.net
- DNS ASK la####elcome.net
- DNS ASK de####complete.net
- DNS ASK el####icwelcome.net
- DNS ASK re####around.net
- DNS ASK el####icaround.net
- DNS ASK re###dproud.net
- DNS ASK el####icproud.net
- DNS ASK la####omplete.net
- DNS ASK re####welcome.net
- DNS ASK se####kitchen.net
- DNS ASK ca####ncomplete.net
- DNS ASK do###proud.net
- DNS ASK se####probable.net
- DNS ASK ag####twelcome.net
- DNS ASK do####elcome.net
- DNS ASK ag####taround.net
- DNS ASK do###around.net
- DNS ASK ni###proud.net
- DNS ASK ni####omplete.net
- DNS ASK de###eproud.net
- DNS ASK do####omplete.net
- DNS ASK ni####elcome.net
- DNS ASK de####welcome.net
- DNS ASK ni###around.net
- DNS ASK de####around.net
- DNS ASK ag####tproud.net
- DNS ASK ag####tcomplete.net
- DNS ASK qu####robable.net
- DNS ASK el#####ccomplete.net
- DNS ASK tr###around.net
- DNS ASK br###proud.net
- DNS ASK fl####omplete.net
- DNS ASK br####omplete.net
- DNS ASK qu####elcome.net
- DNS ASK se####welcome.net
- DNS ASK br###around.net
- DNS ASK fl###proud.net
- DNS ASK qu###around.net
- DNS ASK se###nproud.net
- DNS ASK qu####omplete.net
- DNS ASK se####complete.net
- DNS ASK ag####tnature.net
- DNS ASK do###nature.net
- DNS ASK se####around.net
- DNS ASK qu###proud.net
- DNS ASK tr####elcome.net
- DNS ASK st####welcome.net
- DNS ASK fl####elcome.net
- DNS ASK st###tproud.net
- DNS ASK tr###proud.net
- DNS ASK st####complete.net
- DNS ASK tr####omplete.net
- DNS ASK br####elcome.net
- DNS ASK st####around.net
- DNS ASK fl###around.net
- DNS ASK be####welcome.net
- DNS ASK be###rproud.net
- DNS ASK ga###rproud.net
- DNS ASK be####complete.net
- DNS ASK ga####complete.net
- DNS ASK ga####welcome.net
- DNS ASK be####around.net
- DNS ASK ga####around.net
- DNS ASK qu####itchen.net
- DNS ASK se####without.net
- DNS ASK qu####ithout.net
- DNS ASK ni###wagon.net
- DNS ASK de###ewagon.net
- DNS ASK ni####ithout.net
- DNS ASK de####without.net
- DNS ASK ni####itchen.net
- DNS ASK ag####tprobable.net
- DNS ASK ca####nkitchen.net
- DNS ASK do####itchen.net
- DNS ASK la###wagon.net
- DNS ASK ca####nwagon.net
- DNS ASK la####ithout.net
- DNS ASK ca####nwithout.net
- DNS ASK la####itchen.net
- DNS ASK ni####robable.net
- DNS ASK de####kitchen.net
- DNS ASK de####probable.net
- DNS ASK do####ithout.net
- DNS ASK se####bicycle.net
- DNS ASK fl###whose.net
- DNS ASK br###whose.net
- DNS ASK qu###except.net
- DNS ASK se####except.net
- DNS ASK qu###bridge.net
- DNS ASK ag####tkitchen.net
- DNS ASK la####robable.net
- DNS ASK br####icycle.net
- DNS ASK qu###whose.net
- DNS ASK se###nwhose.net
- DNS ASK ag####twagon.net
- DNS ASK do###wagon.net
- DNS ASK ag####twithout.net
- DNS ASK qu####icycle.net
- DNS ASK se####bridge.net
- DNS ASK do####robable.net
- DNS ASK ca####nprobable.net
- DNS ASK be####kitchen.net
- DNS ASK be####probable.net
- DNS ASK ga####probable.net
- DNS ASK fl###wagon.net
- DNS ASK br###wagon.net
- DNS ASK ga####without.net
- DNS ASK ga###rwagon.net
- DNS ASK ga####kitchen.net
- DNS ASK fl####ithout.net
- DNS ASK fl####robable.net
- DNS ASK br####robable.net
- DNS ASK qu###wagon.net
- DNS ASK se###nwagon.net
- DNS ASK br####ithout.net
- DNS ASK fl####itchen.net
- DNS ASK br####itchen.net
- DNS ASK be####without.net
- DNS ASK be###rwagon.net
- DNS ASK re###dwagon.net
- DNS ASK re####without.net
- DNS ASK el####icwithout.net
- DNS ASK re####kitchen.net
- DNS ASK el####ickitchen.net
- DNS ASK re####probable.net
- DNS ASK el#####cprobable.net
- DNS ASK el####icwagon.net
- DNS ASK st###twagon.net
- DNS ASK st####without.net
- DNS ASK tr####ithout.net
- DNS ASK st####kitchen.net
- DNS ASK tr####itchen.net
- DNS ASK st####probable.net
- DNS ASK tr####robable.net
- DNS ASK tr###wagon.net
- DNS ASK ag####tneedle.net
- DNS ASK do###needle.net
Miscellaneous
Creates and executes the following
- 'C:\izllvqtmbcyst\beont4irwwmovcgdrtz.exe'
- 'C:\izllvqtmbcyst\fcwlcjvch.exe'
- 'C:\izllvqtmbcyst\qqozjkcbdn.exe' "c:\izllvqtmbcyst\fcwlcjvch.exe"
