Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Accounts Offline Web Counter Bus] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Accounts Offline Web Counter Bus] 'ImagePath' = 'C:\qnlvotzfdixugk\vwbuervm.exe'
Creates the following services
- 'Accounts Offline Web Counter Bus' C:\qnlvotzfdixugk\vwbuervm.exe
Modifies file system
Creates the following files
- %WINDIR%\qnlvotzfdixugk\sbrsla
- C:\qnlvotzfdixugk\sbrsla
- C:\qnlvotzfdixugk\aak2jfjrcc3zsa2.exe
- C:\qnlvotzfdixugk\vwbuervm.exe
- C:\qnlvotzfdixugk\kwmmcolvk.exe
Sets the 'hidden' attribute to the following files
- C:\qnlvotzfdixugk\vwbuervm.exe
- C:\qnlvotzfdixugk\kwmmcolvk.exe
Deletes the following files
- %WINDIR%\qnlvotzfdixugk\sbrsla
- C:\qnlvotzfdixugk\aak2jfjrcc3zsa2.exe
Substitutes the following files
- %WINDIR%\qnlvotzfdixugk\sbrsla
Network activity
Connects to
- 'bu####ngexcept.net':80
- 'ev####gexcept.net':80
- 'st###bridge.net':80
- 'do####bridge.net':80
- 'br####bridge.net':80
- 'do####probable.net':80
- 'do####without.net':80
- 'de####kitchen.net':80
- 'st###wagon.net':80
- 'do####around.net':80
TCP
HTTP GET requests
- http://bu####ngexcept.net/index.php
- http://ev####gexcept.net/index.php
- http://st###bridge.net/index.php
- http://do####bridge.net/index.php
- http://br####bridge.net/index.php
- http://do####probable.net/index.php
- http://do####without.net/index.php
- http://de####kitchen.net/index.php
- http://st###wagon.net/index.php
- http://do####around.net/index.php
UDP
- DNS ASK pr####eladder.net
- DNS ASK pr####probable.net
- DNS ASK fe###wwagon.net
- DNS ASK do###ewagon.net
- DNS ASK fe####without.net
- DNS ASK fe####kitchen.net
- DNS ASK mi###wagon.net
- DNS ASK fe####probable.net
- DNS ASK re###twagon.net
- DNS ASK br####without.net
- DNS ASK re####without.net
- DNS ASK br####kitchen.net
- DNS ASK re####kitchen.net
- DNS ASK br####probable.net
- DNS ASK do####kitchen.net
- DNS ASK br###nwagon.net
- DNS ASK do####probable.net
- DNS ASK pr####kitchen.net
- DNS ASK pr####without.net
- DNS ASK do####without.net
- DNS ASK ev####gwithout.net
- DNS ASK bu####ngkitchen.net
- DNS ASK ev####gkitchen.net
- DNS ASK bu#####gprobable.net
- DNS ASK ev####gprobable.net
- DNS ASK re####probable.net
- DNS ASK st###wagon.net
- DNS ASK bu####ngwagon.net
- DNS ASK st####ithout.net
- DNS ASK st####itchen.net
- DNS ASK mi####itchen.net
- DNS ASK st####robable.net
- DNS ASK mi####robable.net
- DNS ASK do###rwagon.net
- DNS ASK ev####gwagon.net
- DNS ASK pr###ywagon.net
- DNS ASK mi####ithout.net
- DNS ASK bu####ngwithout.net
- DNS ASK pr####ewagon.net
- DNS ASK pr####ekitchen.net
- DNS ASK bu####ngproud.net
- DNS ASK ev####gproud.net
- DNS ASK bu#####gcomplete.net
- DNS ASK ev####gcomplete.net
- DNS ASK st####elcome.net
- DNS ASK mi####elcome.net
- DNS ASK bu####ngwelcome.net
- DNS ASK st###around.net
- DNS ASK st###proud.net
- DNS ASK mi###proud.net
- DNS ASK st####omplete.net
- DNS ASK mi####omplete.net
- DNS ASK do####welcome.net
- DNS ASK pr####welcome.net
- DNS ASK bu####ngaround.net
- DNS ASK ev####garound.net
- DNS ASK ev####gwelcome.net
- DNS ASK ou####ecomplete.net
- DNS ASK fe####bicycle.net
- DNS ASK de####kitchen.net
- DNS ASK pr####eprobable.net
- DNS ASK de####probable.net
- DNS ASK st####thwagon.net
- DNS ASK st####thwithout.net
- DNS ASK de###ewagon.net
- DNS ASK de####without.net
- DNS ASK pr####ewithout.net
- DNS ASK st####thkitchen.net
- DNS ASK mo####ntaround.net
- DNS ASK ou####earound.net
- DNS ASK mo####ntproud.net
- DNS ASK ou####eproud.net
- DNS ASK mo#####tcomplete.net
- DNS ASK st#####hprobable.net
- DNS ASK mo####ntwelcome.net
- DNS ASK ou####ewelcome.net
- DNS ASK ou####eprobable.net
- DNS ASK mo#####tprobable.net
- DNS ASK ou####ekitchen.net
- DNS ASK ev####gexcept.net
- DNS ASK bu####ngbridge.net
- DNS ASK ev####gbridge.net
- DNS ASK bu####ngbicycle.net
- DNS ASK ev####gbicycle.net
- DNS ASK bu####ngwhose.net
- DNS ASK mi###whose.net
- DNS ASK ev####gwhose.net
- DNS ASK mi###except.net
- DNS ASK st###bridge.net
- DNS ASK mi###bridge.net
- DNS ASK st####icycle.net
- DNS ASK mi####icycle.net
- DNS ASK mo####ntwhose.net
- DNS ASK ou####ebicycle.net
- DNS ASK bu####ngexcept.net
- DNS ASK mo####ntbicycle.net
- DNS ASK ou####ebridge.net
- DNS ASK de####ladder.net
- DNS ASK de###eboard.net
- DNS ASK pr####eenter.net
- DNS ASK de###eenter.net
- DNS ASK st#####hcharacter.net
- DNS ASK st####haracter.net
- DNS ASK st###whose.net
- DNS ASK st####thladder.net
- DNS ASK st###except.net
- DNS ASK st####thboard.net
- DNS ASK st####thenter.net
- DNS ASK st###enter.net
- DNS ASK mo####ntexcept.net
- DNS ASK ou####eexcept.net
- DNS ASK mo####ntbridge.net
- DNS ASK st###ladder.net
- DNS ASK pr####eboard.net
- DNS ASK st###board.net
- DNS ASK ou####ewhose.net
- DNS ASK do####except.net
- DNS ASK de####except.net
- DNS ASK de####bridge.net
- DNS ASK pr####ebicycle.net
- DNS ASK de####bicycle.net
- DNS ASK pr####ewhose.net
- DNS ASK de###ewhose.net
- DNS ASK pr####eexcept.net
- DNS ASK pr####except.net
- DNS ASK pr####ebridge.net
- DNS ASK st####thexcept.net
- DNS ASK mo####ntwagon.net
- DNS ASK ou####ewagon.net
- DNS ASK mo####ntwithout.net
- DNS ASK ou####ewithout.net
- DNS ASK mo####ntkitchen.net
- DNS ASK st####thbridge.net
- DNS ASK st####thbicycle.net
- DNS ASK st####thwhose.net
- DNS ASK mi###around.net
- DNS ASK do####around.net
- DNS ASK re####bicycle.net
- DNS ASK pr####bridge.net
- DNS ASK do####bicycle.net
- DNS ASK pr####bicycle.net
- DNS ASK do###rwhose.net
- DNS ASK pr###ywhose.net
- DNS ASK fe####except.net
- DNS ASK br###nwhose.net
- DNS ASK re###twhose.net
- DNS ASK fe####bridge.net
- DNS ASK do###ewhose.net
- DNS ASK br####except.net
- DNS ASK re####except.net
- DNS ASK br####bridge.net
- DNS ASK re####bridge.net
- DNS ASK br####bicycle.net
- DNS ASK do####bridge.net
- DNS ASK fe###wwhose.net
- DNS ASK pr####around.net
Miscellaneous
Creates and executes the following
- 'C:\qnlvotzfdixugk\aak2jfjrcc3zsa2.exe'
- 'C:\qnlvotzfdixugk\vwbuervm.exe'
- 'C:\qnlvotzfdixugk\kwmmcolvk.exe' "c:\qnlvotzfdixugk\vwbuervm.exe"
