Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Services IP Mapper Multimedia] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Services IP Mapper Multimedia] 'ImagePath' = 'C:\wwyspyxje\fcchmpkl.exe'
Creates the following services
- 'Services IP Mapper Multimedia' C:\wwyspyxje\fcchmpkl.exe
Modifies file system
Creates the following files
- %WINDIR%\wwyspyxje\uwrqul
- C:\wwyspyxje\uwrqul
- C:\wwyspyxje\wzcotweqbstapbfvm1.exe
- C:\wwyspyxje\fcchmpkl.exe
- C:\wwyspyxje\xpcdmicalhgu.exe
- C:\wwyspyxje\gmiixpkfwy6y
Sets the 'hidden' attribute to the following files
- C:\wwyspyxje\fcchmpkl.exe
- C:\wwyspyxje\xpcdmicalhgu.exe
Deletes the following files
- %WINDIR%\wwyspyxje\uwrqul
- C:\wwyspyxje\wzcotweqbstapbfvm1.exe
Substitutes the following files
- %WINDIR%\wwyspyxje\uwrqul
Network activity
Connects to
- 'ma####ecover.net':80
- 'en####hcompany.net':80
- 'en####hfurther.net':80
- 'fa####company.net':80
- 'ch####encompany.net':80
- 'fa###ycover.net':80
- 'fa####further.net':80
- 'pi####ecompany.net':80
- 'ci####ttebecome.net':80
- 'pi####ebecome.net':80
- 'ci####ttecover.net':80
- 'ci#####tefurther.net':80
- 'fi####further.net':80
- 'ri###cover.net':80
- 'su###ncover.net':80
- 'ma####ecompany.net':80
- 'ex###tuntil.net':80
- 'be####euntil.net':80
TCP
HTTP GET requests
- http://ma####ecover.net/index.php?me########
- http://en####hcompany.net/index.php?me########
- http://en####hfurther.net/index.php?me########
- http://fa####company.net/index.php?me########
- http://ch####encompany.net/index.php?me########
- http://fa###ycover.net/index.php?me########
- http://fa####further.net/index.php?me########
- http://pi####ecompany.net/index.php?me########
- http://ci####ttebecome.net/index.php?me########
- http://pi####ebecome.net/index.php?me########
- http://ci####ttecover.net/index.php?me########
- http://ci#####tefurther.net/index.php?me########
- http://fi####further.net/index.php?me########
- http://ri###cover.net/index.php?me########
- http://su###ncover.net/index.php?me########
- http://ma####ecompany.net/index.php?me########
- http://ex###tuntil.net/index.php?me########
- http://be####euntil.net/index.php?me########
UDP
- DNS ASK ch####enenough.net
- DNS ASK ch####enfurther.net
- DNS ASK ci#####tecompany.net
- DNS ASK pi####ecompany.net
- DNS ASK ci####ttebecome.net
- DNS ASK pi####ebecome.net
- DNS ASK ci####ttecover.net
- DNS ASK pi####ecover.net
- DNS ASK ci#####tefurther.net
- DNS ASK pi####efurther.net
- DNS ASK th####company.net
- DNS ASK fi####company.net
- DNS ASK th####become.net
- DNS ASK fi####become.net
- DNS ASK th###hcover.net
- DNS ASK fi###ecover.net
- DNS ASK th####further.net
- DNS ASK fi####further.net
- DNS ASK fa####further.net
- DNS ASK ch####encover.net
- DNS ASK fa###ycover.net
- DNS ASK ch####enbecome.net
- DNS ASK ex####finger.net
- DNS ASK be####eshoulder.net
- DNS ASK ex####shoulder.net
- DNS ASK be####eabove.net
- DNS ASK ex###tabove.net
- DNS ASK be####euntil.net
- DNS ASK ex###tuntil.net
- DNS ASK en####hcompany.net
- DNS ASK en####hbecome.net
- DNS ASK ei####company.net
- DNS ASK ei####become.net
- DNS ASK en####hcover.net
- DNS ASK ei###rcover.net
- DNS ASK en####hfurther.net
- DNS ASK ei####further.net
- DNS ASK fa####company.net
- DNS ASK ch####encompany.net
- DNS ASK fa####become.net
- DNS ASK be####efinger.net
- DNS ASK ri####ompany.net
- DNS ASK wh####rcompany.net
- DNS ASK ri###become.net
- DNS ASK be####ebecome.net
- DNS ASK ex####become.net
- DNS ASK be####ecover.net
- DNS ASK ex###tcover.net
- DNS ASK be####efurther.net
- DNS ASK ex####further.net
- DNS ASK en####hgovern.net
- DNS ASK ei####govern.net
- DNS ASK en####henough.net
- DNS ASK ei####enough.net
- DNS ASK en####hneedle.net
- DNS ASK ei####needle.net
- DNS ASK en####hnature.net
- DNS ASK ei####nature.net
- DNS ASK fa####govern.net
- DNS ASK ch####engovern.net
- DNS ASK fa####enough.net
- DNS ASK ex####company.net
- DNS ASK be####ecompany.net
- DNS ASK pe####further.net
- DNS ASK ma####efurther.net
- DNS ASK ri###cover.net
- DNS ASK wh####rcover.net
- DNS ASK ri####urther.net
- DNS ASK wh####rfurther.net
- DNS ASK fo####ncompany.net
- DNS ASK su####company.net
- DNS ASK fo####nbecome.net
- DNS ASK su####become.net
- DNS ASK su###ncover.net
- DNS ASK fo####ncover.net
- DNS ASK fo####nfurther.net
- DNS ASK su####further.net
- DNS ASK ma####ecompany.net
- DNS ASK pe####company.net
- DNS ASK ma####ebecome.net
- DNS ASK pe####become.net
- DNS ASK ma####ecover.net
- DNS ASK pe###ncover.net
- DNS ASK wh####rbecome.net
- DNS ASK pe###nuntil.net
Miscellaneous
Creates and executes the following
- 'C:\wwyspyxje\wzcotweqbstapbfvm1.exe'
- 'C:\wwyspyxje\fcchmpkl.exe'
- 'C:\wwyspyxje\xpcdmicalhgu.exe' "c:\wwyspyxje\fcchmpkl.exe"
