Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Adaptive Machine KtmRm Transaction] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Adaptive Machine KtmRm Transaction] 'ImagePath' = 'C:\vyckookm\lyocqstupze.exe'
Creates the following services
- 'Adaptive Machine KtmRm Transaction' C:\vyckookm\lyocqstupze.exe
Modifies file system
Creates the following files
- %WINDIR%\vyckookm\fnmh0cvqdj1z
- C:\vyckookm\fnmh0cvqdj1z
- C:\vyckookm\vtp5szt4wekfywoobp.exe
- C:\vyckookm\lyocqstupze.exe
- C:\vyckookm\kuhotnvep.exe
Sets the 'hidden' attribute to the following files
- C:\vyckookm\lyocqstupze.exe
- C:\vyckookm\kuhotnvep.exe
Deletes the following files
- %WINDIR%\vyckookm\fnmh0cvqdj1z
- C:\vyckookm\vtp5szt4wekfywoobp.exe
Substitutes the following files
- %WINDIR%\vyckookm\fnmh0cvqdj1z
Network activity
Connects to
- 'fa###yworth.net':80
- 'ri###action.net':80
- 'fa####action.net':80
- 'fa####direct.net':80
- 'ri###speak.net':80
TCP
HTTP GET requests
- http://ri###action.net/index.php
- http://fa####action.net/index.php
- http://fa####direct.net/index.php
- http://ri###speak.net/index.php
UDP
- DNS ASK ri###worth.net
- DNS ASK ex###tspeak.net
- DNS ASK en####hbrought.net
- DNS ASK ei####brought.net
- DNS ASK en####hdirect.net
- DNS ASK ei####direct.net
- DNS ASK en####haction.net
- DNS ASK ei####action.net
- DNS ASK en####hmethod.net
- DNS ASK ei####method.net
- DNS ASK fa####brought.net
- DNS ASK ch####enbrought.net
- DNS ASK fa####direct.net
- DNS ASK ch####endirect.net
- DNS ASK fa####action.net
- DNS ASK fa####method.net
- DNS ASK ex###tniece.net
- DNS ASK ch####enmethod.net
- DNS ASK ci#####tebrought.net
- DNS ASK pi####ebrought.net
- DNS ASK ci####ttedirect.net
- DNS ASK pi####edirect.net
- DNS ASK ci####tteaction.net
- DNS ASK pi####eaction.net
- DNS ASK ci####ttemethod.net
- DNS ASK pi####emethod.net
- DNS ASK th####brought.net
- DNS ASK fi####brought.net
- DNS ASK th####direct.net
- DNS ASK fi####direct.net
- DNS ASK ch####enaction.net
- DNS ASK su####method.net
- DNS ASK be####eniece.net
- DNS ASK fi###eniece.net
- DNS ASK th###hspeak.net
- DNS ASK fi###espeak.net
- DNS ASK ri###oclock.net
- DNS ASK wh####roclock.net
- DNS ASK ri###write.net
- DNS ASK wh####rwrite.net
- DNS ASK ri###niece.net
- DNS ASK wh####rniece.net
- DNS ASK ri###speak.net
- DNS ASK wh####rspeak.net
- DNS ASK fo####noclock.net
- DNS ASK su####oclock.net
- DNS ASK fo####nwrite.net
- DNS ASK th####action.net
- DNS ASK be####espeak.net
- DNS ASK su###nniece.net
- DNS ASK fo####nspeak.net
- DNS ASK su###nspeak.net
- DNS ASK ma####eoclock.net
- DNS ASK pe####oclock.net
- DNS ASK ma####ewrite.net
- DNS ASK pe###nwrite.net
- DNS ASK ma####eniece.net
- DNS ASK pe###nniece.net
- DNS ASK ma####espeak.net
- DNS ASK pe###nspeak.net
- DNS ASK be####eoclock.net
- DNS ASK ex####oclock.net
- DNS ASK be####ewrite.net
- DNS ASK fo####nniece.net
- DNS ASK ex###twrite.net
- DNS ASK fi####action.net
- DNS ASK th####method.net
- DNS ASK fi####method.net
- DNS ASK pi####eworth.net
- DNS ASK ei####likely.net
- DNS ASK en####hglossary.net
- DNS ASK ei####glossary.net
- DNS ASK en####hround.net
- DNS ASK ei###rround.net
- DNS ASK fa###yworth.net
- DNS ASK ch####enworth.net
- DNS ASK fa####likely.net
- DNS ASK ch####enlikely.net
- DNS ASK fa####glossary.net
- DNS ASK ch#####nglossary.net
- DNS ASK fa###yround.net
- DNS ASK ch####enround.net
- DNS ASK th###hniece.net
- DNS ASK ei###rworth.net
- DNS ASK ci####ttelikely.net
- DNS ASK pi####elikely.net
- DNS ASK ci#####teglossary.net
- DNS ASK pi####eglossary.net
- DNS ASK ci####tteround.net
- DNS ASK pi####eround.net
- DNS ASK th###hworth.net
- DNS ASK fi###eworth.net
- DNS ASK th####likely.net
- DNS ASK fi####likely.net
- DNS ASK th####glossary.net
- DNS ASK fi####glossary.net
- DNS ASK th###hround.net
- DNS ASK fi###eround.net
- DNS ASK ci####tteworth.net
- DNS ASK su###nwrite.net
- DNS ASK en####hworth.net
- DNS ASK ex####action.net
- DNS ASK ex####method.net
- DNS ASK ri####rought.net
- DNS ASK wh####rbrought.net
- DNS ASK ri###direct.net
- DNS ASK wh####rdirect.net
- DNS ASK ri###action.net
- DNS ASK wh####raction.net
- DNS ASK ri###method.net
- DNS ASK wh####rmethod.net
- DNS ASK fo####nbrought.net
- DNS ASK su####brought.net
- DNS ASK fo####ndirect.net
- DNS ASK su####direct.net
- DNS ASK fo####naction.net
- DNS ASK be####emethod.net
- DNS ASK su####action.net
- DNS ASK en####hlikely.net
- DNS ASK ma####ebrought.net
- DNS ASK pe####brought.net
- DNS ASK ma####edirect.net
- DNS ASK pe####direct.net
- DNS ASK ma####eaction.net
- DNS ASK pe####action.net
- DNS ASK ma####emethod.net
- DNS ASK pe####method.net
- DNS ASK be####ebrought.net
- DNS ASK ex####brought.net
- DNS ASK be####edirect.net
- DNS ASK ex####direct.net
- DNS ASK be####eaction.net
- DNS ASK fo####nmethod.net
- DNS ASK fi###ewrite.net
Miscellaneous
Creates and executes the following
- 'C:\vyckookm\vtp5szt4wekfywoobp.exe'
- 'C:\vyckookm\lyocqstupze.exe'
- 'C:\vyckookm\kuhotnvep.exe' "c:\vyckookm\lyocqstupze.exe"
