Technical Information
To ensure autorun and distribution
Creates the following services
- 'Cache Logon Assistant Acquisition TCP/IP SPP' C:\qidiqba\ctxdiwqu.exe
Modifies file system
Creates the following files
- %WINDIR%\qidiqba\zjkfhqyyfjjy
- C:\qidiqba\zjkfhqyyfjjy
- C:\qidiqba\enozvcxdjpsc8sr.exe
- C:\qidiqba\ctxdiwqu.exe
- C:\qidiqba\mauqbpzl.exe
Sets the 'hidden' attribute to the following files
- C:\qidiqba\ctxdiwqu.exe
- C:\qidiqba\mauqbpzl.exe
Deletes the following files
- %WINDIR%\qidiqba\zjkfhqyyfjjy
- C:\qidiqba\enozvcxdjpsc8sr.exe
Substitutes the following files
- %WINDIR%\qidiqba\zjkfhqyyfjjy
Network activity
Connects to
- 're####erquarter.net':80
- 'ef###ttrust.net':80
- 're####erhonor.net':80
- 're####ertrust.net':80
- 'hu####dfriend.net':80
TCP
HTTP GET requests
- http://re####erquarter.net/index.php
- http://ef###ttrust.net/index.php
- http://re####erhonor.net/index.php
- http://re####ertrust.net/index.php
- http://hu####dfriend.net/index.php
UDP
- DNS ASK ef####quarter.net
- DNS ASK ri####consider.net
- DNS ASK be####consider.net
- DNS ASK ri####friend.net
- DNS ASK be####friend.net
- DNS ASK ch####aughter.net
- DNS ASK th####aughter.net
- DNS ASK ri####laughter.net
- DNS ASK ch###fancy.net
- DNS ASK ch####onsider.net
- DNS ASK th####onsider.net
- DNS ASK ch###friend.net
- DNS ASK th###friend.net
- DNS ASK wi####laughter.net
- DNS ASK su####laughter.net
- DNS ASK ri###nfancy.net
- DNS ASK be###gfancy.net
- DNS ASK be####laughter.net
- DNS ASK li####friend.net
- DNS ASK su###rfancy.net
- DNS ASK hu####dlaughter.net
- DNS ASK jo####yfancy.net
- DNS ASK hu####dfancy.net
- DNS ASK jo####yconsider.net
- DNS ASK hu####dconsider.net
- DNS ASK wi###nfancy.net
- DNS ASK re####ertrust.net
- DNS ASK th###fancy.net
- DNS ASK jo####yfriend.net
- DNS ASK de####yfancy.net
- DNS ASK li###efancy.net
- DNS ASK de####yconsider.net
- DNS ASK li####consider.net
- DNS ASK de####yfriend.net
- DNS ASK hu####dfriend.net
- DNS ASK de####ylaughter.net
- DNS ASK li####laughter.net
- DNS ASK th###trust.net
- DNS ASK wi####consider.net
- DNS ASK wo###fancy.net
- DNS ASK re####erfancy.net
- DNS ASK wo####onsider.net
- DNS ASK re#####rconsider.net
- DNS ASK wo###friend.net
- DNS ASK re####erfriend.net
- DNS ASK jo####ysmell.net
- DNS ASK re#####rlaughter.net
- DNS ASK wo###trust.net
- DNS ASK wo####aughter.net
- DNS ASK jo####ysafety.net
- DNS ASK hu####dsafety.net
- DNS ASK jo####yfuture.net
- DNS ASK hu####dfuture.net
- DNS ASK de####ysmell.net
- DNS ASK li###esmell.net
- DNS ASK jo####yearly.net
- DNS ASK hu####dsmell.net
- DNS ASK jo####ylaughter.net
- DNS ASK fo####friend.net
- DNS ASK th####hfriend.net
- DNS ASK su####friend.net
- DNS ASK ef####laughter.net
- DNS ASK th####hlaughter.net
- DNS ASK ef###tfancy.net
- DNS ASK th####hfancy.net
- DNS ASK ef####consider.net
- DNS ASK in####sefriend.net
- DNS ASK su####consider.net
- DNS ASK wi####friend.net
- DNS ASK fo####laughter.net
- DNS ASK in#####elaughter.net
- DNS ASK fo###tfancy.net
- DNS ASK in####sefancy.net
- DNS ASK fo####consider.net
- DNS ASK in#####econsider.net
- DNS ASK ef####friend.net
- DNS ASK th####hconsider.net
- DNS ASK re####ersystem.net
- DNS ASK wo###system.net
- DNS ASK re####erneither.net
- DNS ASK hu####dsystem.net
- DNS ASK jo####ytrust.net
- DNS ASK hu####dtrust.net
- DNS ASK de####yhonor.net
- DNS ASK li###ehonor.net
- DNS ASK jo####yneither.net
- DNS ASK in####sequarter.net
- DNS ASK jo####ysystem.net
- DNS ASK de####yneither.net
- DNS ASK de####ytrust.net
- DNS ASK li###etrust.net
- DNS ASK ri###nhonor.net
- DNS ASK be###ghonor.net
- DNS ASK ri####neither.net
- DNS ASK li####neither.net
- DNS ASK de####ysystem.net
- DNS ASK li####system.net
- DNS ASK de####yearly.net
- DNS ASK be####neither.net
- DNS ASK re####erquarter.net
- DNS ASK fo####branch.net
- DNS ASK in####sebranch.net
- DNS ASK fo####believe.net
- DNS ASK in####sebelieve.net
- DNS ASK fo####receive.net
- DNS ASK in####sereceive.net
- DNS ASK jo####yhonor.net
- DNS ASK hu####dhonor.net
- DNS ASK fo####quarter.net
- DNS ASK re####erbranch.net
- DNS ASK wo####elieve.net
- DNS ASK re####erbelieve.net
- DNS ASK wo####eceive.net
- DNS ASK re####erreceive.net
- DNS ASK wo####uarter.net
- DNS ASK th####hquarter.net
- DNS ASK wo###branch.net
- DNS ASK hu####dearly.net
- DNS ASK ri####system.net
- DNS ASK be###gtrust.net
- DNS ASK ef####system.net
- DNS ASK th####hsystem.net
- DNS ASK ef###ttrust.net
- DNS ASK th####htrust.net
- DNS ASK fo###thonor.net
- DNS ASK in####sehonor.net
- DNS ASK be####system.net
- DNS ASK th####hneither.net
- DNS ASK ef####neither.net
- DNS ASK in####sesystem.net
- DNS ASK fo###ttrust.net
- DNS ASK in####setrust.net
- DNS ASK wo###honor.net
- DNS ASK re####erhonor.net
- DNS ASK wo####either.net
- DNS ASK fo####neither.net
- DNS ASK fo####system.net
- DNS ASK ri###ntrust.net
- DNS ASK in####seneither.net
- DNS ASK hu####dneither.net
- DNS ASK ch###honor.net
- DNS ASK th###honor.net
- DNS ASK ch####either.net
- DNS ASK th####either.net
- DNS ASK ch###system.net
- DNS ASK th###system.net
- DNS ASK su###rtrust.net
- DNS ASK th####hhonor.net
- DNS ASK ef###thonor.net
- DNS ASK su###rhonor.net
- DNS ASK wi####neither.net
- DNS ASK su####neither.net
- DNS ASK wi####system.net
- DNS ASK su####system.net
- DNS ASK wi###ntrust.net
- DNS ASK ch###trust.net
- DNS ASK wi###nhonor.net
- DNS ASK li###eearly.net
Miscellaneous
Creates and executes the following
- 'C:\qidiqba\enozvcxdjpsc8sr.exe'
- 'C:\qidiqba\ctxdiwqu.exe'
- 'C:\qidiqba\mauqbpzl.exe' "c:\qidiqba\ctxdiwqu.exe"
