Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WebClient Modules TP] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WebClient Modules TP] 'ImagePath' = 'C:\knwcdpdshmizhk\ukfrcopmpk.exe'
Creates the following services
- 'WebClient Modules TP' C:\knwcdpdshmizhk\ukfrcopmpk.exe
Modifies file system
Creates the following files
- %WINDIR%\knwcdpdshmizhk\d2ntbsp
- C:\knwcdpdshmizhk\d2ntbsp
- C:\knwcdpdshmizhk\dtrtft23iwrfdikpv.exe
- C:\knwcdpdshmizhk\ukfrcopmpk.exe
- C:\knwcdpdshmizhk\mcxjieqhr.exe
Sets the 'hidden' attribute to the following files
- C:\knwcdpdshmizhk\ukfrcopmpk.exe
- C:\knwcdpdshmizhk\mcxjieqhr.exe
Deletes the following files
- %WINDIR%\knwcdpdshmizhk\d2ntbsp
- C:\knwcdpdshmizhk\dtrtft23iwrfdikpv.exe
Substitutes the following files
- %WINDIR%\knwcdpdshmizhk\d2ntbsp
Network activity
Connects to
- 'th###nature.net':80
- 'pr####tnature.net':80
- 'th####urther.net':80
- 'pr####tcompany.net':80
- 'co####ecompany.net':80
- 'mo####gfurther.net':80
- 'hi####ycompany.net':80
TCP
HTTP GET requests
- http://th###nature.net/index.php
- http://pr####tnature.net/index.php
- http://th####urther.net/index.php
- http://pr####tcompany.net/index.php
- http://co####ecompany.net/index.php
- http://mo####gfurther.net/index.php
- http://hi####ycompany.net/index.php
UDP
- DNS ASK cl###around.net
- DNS ASK of###become.net
- DNS ASK al###cover.net
- DNS ASK of###cover.net
- DNS ASK al####urther.net
- DNS ASK of####urther.net
- DNS ASK co####ecompany.net
- DNS ASK ch####ompany.net
- DNS ASK co####ebecome.net
- DNS ASK ch###become.net
- DNS ASK co####ecover.net
- DNS ASK ch###cover.net
- DNS ASK co####efurther.net
- DNS ASK ch####urther.net
- DNS ASK pr####tcompany.net
- DNS ASK th####ompany.net
- DNS ASK pr####tbecome.net
- DNS ASK th###become.net
- DNS ASK pr####tcover.net
- DNS ASK th###cover.net
- DNS ASK pr####tfurther.net
- DNS ASK th####urther.net
- DNS ASK cl###govern.net
- DNS ASK cl###enough.net
- DNS ASK cl###needle.net
- DNS ASK cl###nature.net
- DNS ASK am####govern.net
- DNS ASK we####rgovern.net
- DNS ASK al###become.net
- DNS ASK of####ompany.net
- DNS ASK am####further.net
- DNS ASK hi####ycompany.net
- DNS ASK st####ecompany.net
- DNS ASK hi####ybecome.net
- DNS ASK st####ebecome.net
- DNS ASK hi####ycover.net
- DNS ASK st####ecover.net
- DNS ASK hi####yfurther.net
- DNS ASK st####efurther.net
- DNS ASK mo####gcompany.net
- DNS ASK ra####company.net
- DNS ASK mo####gbecome.net
- DNS ASK mo####gcover.net
- DNS ASK mo####genough.net
- DNS ASK ra###rcover.net
- DNS ASK mo####gfurther.net
- DNS ASK ra####further.net
- DNS ASK tw####company.net
- DNS ASK mi####company.net
- DNS ASK tw####become.net
- DNS ASK mi####become.net
- DNS ASK tw###ecover.net
- DNS ASK mi###ecover.net
- DNS ASK tw####further.net
- DNS ASK mi####further.net
- DNS ASK al####ompany.net
- DNS ASK we####renough.net
- DNS ASK am####enough.net
- DNS ASK we####rneedle.net
- DNS ASK al###needle.net
- DNS ASK of###needle.net
- DNS ASK al###nature.net
- DNS ASK of###nature.net
- DNS ASK co####egovern.net
- DNS ASK ch###govern.net
- DNS ASK co####eenough.net
- DNS ASK ch###enough.net
- DNS ASK co####eneedle.net
- DNS ASK ch###needle.net
- DNS ASK co####enature.net
- DNS ASK ch###nature.net
- DNS ASK pr####tgovern.net
- DNS ASK th###govern.net
- DNS ASK pr####tenough.net
- DNS ASK th###enough.net
- DNS ASK pr####tneedle.net
- DNS ASK th###needle.net
- DNS ASK pr####tnature.net
- DNS ASK th###nature.net
- DNS ASK cl####omplete.net
- DNS ASK th####omplete.net
- DNS ASK cl###proud.net
- DNS ASK th###proud.net
- DNS ASK al###enough.net
- DNS ASK of###govern.net
- DNS ASK of###enough.net
- DNS ASK al###govern.net
- DNS ASK am####needle.net
- DNS ASK mi####nature.net
- DNS ASK we####rnature.net
- DNS ASK am####nature.net
- DNS ASK hi####ygovern.net
- DNS ASK st####egovern.net
- DNS ASK hi####yenough.net
- DNS ASK st####eenough.net
- DNS ASK hi####yneedle.net
- DNS ASK st####eneedle.net
- DNS ASK hi####ynature.net
- DNS ASK st####enature.net
- DNS ASK mo####ggovern.net
- DNS ASK ra####become.net
- DNS ASK we####rfurther.net
- DNS ASK ra####enough.net
- DNS ASK mo####gneedle.net
- DNS ASK ra####needle.net
- DNS ASK mo####gnature.net
- DNS ASK ra####nature.net
- DNS ASK tw####govern.net
- DNS ASK mi####govern.net
- DNS ASK tw####enough.net
- DNS ASK mi####enough.net
- DNS ASK tw####needle.net
- DNS ASK mi####needle.net
- DNS ASK tw####nature.net
- DNS ASK ra####govern.net
- DNS ASK am###tcover.net
Miscellaneous
Creates and executes the following
- 'C:\knwcdpdshmizhk\dtrtft23iwrfdikpv.exe'
- 'C:\knwcdpdshmizhk\ukfrcopmpk.exe'
- 'C:\knwcdpdshmizhk\mcxjieqhr.exe' "c:\knwcdpdshmizhk\ukfrcopmpk.exe"
