Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Security Tunneling BitLocker] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Security Tunneling BitLocker] 'ImagePath' = 'C:\igfvssjc\gimbrheqh.exe'
Creates the following services
- 'Security Tunneling BitLocker' C:\igfvssjc\gimbrheqh.exe
Modifies file system
Creates the following files
- %WINDIR%\igfvssjc\jywxmggqr3
- C:\igfvssjc\jywxmggqr3
- C:\igfvssjc\sgfp4b8zae7reyx7ti.exe
- C:\igfvssjc\gimbrheqh.exe
- C:\igfvssjc\pemjzmrbzor.exe
Sets the 'hidden' attribute to the following files
- C:\igfvssjc\gimbrheqh.exe
- C:\igfvssjc\pemjzmrbzor.exe
Deletes the following files
- %WINDIR%\igfvssjc\jywxmggqr3
- C:\igfvssjc\sgfp4b8zae7reyx7ti.exe
Substitutes the following files
- %WINDIR%\igfvssjc\jywxmggqr3
Network activity
Connects to
- 'st###direct.net':80
- 'do####direct.net':80
- 're####method.net':80
- 're####action.net':80
- 'pr####edirect.net':80
- 'mi###write.net':80
- 'do###rspeak.net':80
- 'do###espeak.net':80
- 'de###ewrite.net':80
TCP
HTTP GET requests
- http://st###direct.net/index.php
- http://do####direct.net/index.php
- http://re####method.net/index.php
- http://re####action.net/index.php
- http://pr####edirect.net/index.php
- http://mi###write.net/index.php
- http://do###rspeak.net/index.php
- http://do###espeak.net/index.php
- http://de###ewrite.net/index.php
UDP
- DNS ASK ev####gdirect.net
- DNS ASK do####oclock.net
- DNS ASK pr###ywrite.net
- DNS ASK do###rwrite.net
- DNS ASK pr###yniece.net
- DNS ASK do###rniece.net
- DNS ASK pr###yspeak.net
- DNS ASK do###rspeak.net
- DNS ASK mi###oclock.net
- DNS ASK st###oclock.net
- DNS ASK mi###write.net
- DNS ASK mi###niece.net
- DNS ASK fe###wspeak.net
- DNS ASK st###niece.net
- DNS ASK mi###speak.net
- DNS ASK st###speak.net
- DNS ASK ev####goclock.net
- DNS ASK bu####ngoclock.net
- DNS ASK ev####gwrite.net
- DNS ASK bu####ngwrite.net
- DNS ASK ev####gniece.net
- DNS ASK bu####ngniece.net
- DNS ASK st###write.net
- DNS ASK pr####ebrought.net
- DNS ASK do###espeak.net
- DNS ASK st####thniece.net
- DNS ASK st####thspeak.net
- DNS ASK de####oclock.net
- DNS ASK pr####eoclock.net
- DNS ASK de###ewrite.net
- DNS ASK pr####ewrite.net
- DNS ASK de###eniece.net
- DNS ASK pr####eniece.net
- DNS ASK de###espeak.net
- DNS ASK pr####espeak.net
- DNS ASK ev####gspeak.net
- DNS ASK pr####oclock.net
- DNS ASK re###twrite.net
- DNS ASK br###nwrite.net
- DNS ASK re###tniece.net
- DNS ASK br###nniece.net
- DNS ASK re###tspeak.net
- DNS ASK br###nspeak.net
- DNS ASK fe####oclock.net
- DNS ASK do###ewrite.net
- DNS ASK fe###wwrite.net
- DNS ASK do###eniece.net
- DNS ASK br####oclock.net
- DNS ASK fe###wniece.net
- DNS ASK bu####ngspeak.net
- DNS ASK ou####eoclock.net
- DNS ASK mo####ntoclock.net
- DNS ASK do####method.net
- DNS ASK fe####direct.net
- DNS ASK fe####action.net
- DNS ASK fe####method.net
- DNS ASK pr####brought.net
- DNS ASK do####brought.net
- DNS ASK pr####direct.net
- DNS ASK do####direct.net
- DNS ASK pr####action.net
- DNS ASK do####action.net
- DNS ASK st####thwrite.net
- DNS ASK br####method.net
- DNS ASK mi####rought.net
- DNS ASK st####rought.net
- DNS ASK mi###direct.net
- DNS ASK st###direct.net
- DNS ASK mi###action.net
- DNS ASK st###action.net
- DNS ASK mi###method.net
- DNS ASK st###method.net
- DNS ASK ev####gbrought.net
- DNS ASK bu####ngbrought.net
- DNS ASK pr####method.net
- DNS ASK re####oclock.net
- DNS ASK re####method.net
- DNS ASK br####direct.net
- DNS ASK br####action.net
- DNS ASK ou####ewrite.net
- DNS ASK mo####ntwrite.net
- DNS ASK ou####eniece.net
- DNS ASK mo####ntniece.net
- DNS ASK ou####espeak.net
- DNS ASK mo####ntspeak.net
- DNS ASK st####thbrought.net
- DNS ASK st####thdirect.net
- DNS ASK st####thaction.net
- DNS ASK re####action.net
- DNS ASK st####thmethod.net
- DNS ASK fe####brought.net
- DNS ASK de####direct.net
- DNS ASK pr####edirect.net
- DNS ASK de####action.net
- DNS ASK pr####eaction.net
- DNS ASK de####method.net
- DNS ASK pr####emethod.net
- DNS ASK re####brought.net
- DNS ASK br####brought.net
- DNS ASK re####direct.net
- DNS ASK de####brought.net
- DNS ASK st####thoclock.net
Miscellaneous
Creates and executes the following
- 'C:\igfvssjc\sgfp4b8zae7reyx7ti.exe'
- 'C:\igfvssjc\gimbrheqh.exe'
- 'C:\igfvssjc\pemjzmrbzor.exe' "c:\igfvssjc\gimbrheqh.exe"
