Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\DCOM Gateway Panel VC Registrar Base] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\DCOM Gateway Panel VC Registrar Base] 'ImagePath' = 'C:\mdavjpqdjgvkqw\yfyjeii.exe'
Creates the following services
- 'DCOM Gateway Panel VC Registrar Base' C:\mdavjpqdjgvkqw\yfyjeii.exe
Modifies file system
Creates the following files
- %WINDIR%\mdavjpqdjgvkqw\fnaxwfhbh
- C:\mdavjpqdjgvkqw\fnaxwfhbh
- C:\mdavjpqdjgvkqw\ir8gqwmkwetxjkcq.exe
- C:\mdavjpqdjgvkqw\yfyjeii.exe
- C:\mdavjpqdjgvkqw\uqrrjhqk.exe
Sets the 'hidden' attribute to the following files
- C:\mdavjpqdjgvkqw\yfyjeii.exe
- C:\mdavjpqdjgvkqw\uqrrjhqk.exe
Deletes the following files
- %WINDIR%\mdavjpqdjgvkqw\fnaxwfhbh
- C:\mdavjpqdjgvkqw\ir8gqwmkwetxjkcq.exe
Substitutes the following files
- %WINDIR%\mdavjpqdjgvkqw\fnaxwfhbh
Network activity
Connects to
- 're###tstorm.net':80
- 'st####thchoose.net':80
- 'bu####ngsingle.net':80
- 'do####charge.net':80
- 'st###single.net':80
TCP
HTTP GET requests
- http://re###tstorm.net/index.php
- http://st####thchoose.net/index.php
- http://bu####ngsingle.net/index.php
- http://do####charge.net/index.php
- http://st###single.net/index.php
UDP
- DNS ASK pr####thrown.net
- DNS ASK ev####gcharge.net
- DNS ASK bu#####gdifference.net
- DNS ASK ev#####difference.net
- DNS ASK bu####ngevery.net
- DNS ASK ev####gevery.net
- DNS ASK st###single.net
- DNS ASK st####thperiod.net
- DNS ASK mi###single.net
- DNS ASK mi###charge.net
- DNS ASK st####ifference.net
- DNS ASK mi####ifference.net
- DNS ASK st###every.net
- DNS ASK mi###every.net
- DNS ASK do####single.net
- DNS ASK ev####gsingle.net
- DNS ASK bu####ngcharge.net
- DNS ASK bu####ngsingle.net
- DNS ASK ou####eevery.net
- DNS ASK mo####ntevery.net
- DNS ASK de####although.net
- DNS ASK pr####eperiod.net
- DNS ASK de####period.net
- DNS ASK pr####ehowever.net
- DNS ASK de####however.net
- DNS ASK st####thchoose.net
- DNS ASK pr####single.net
- DNS ASK st###charge.net
- DNS ASK st#####halthough.net
- DNS ASK mo####ntsingle.net
- DNS ASK ou####esingle.net
- DNS ASK mo####ntcharge.net
- DNS ASK ou####echarge.net
- DNS ASK mo#####tdifference.net
- DNS ASK ou#####difference.net
- DNS ASK pr####ealthough.net
- DNS ASK st####thhowever.net
- DNS ASK br####single.net
- DNS ASK be####econtrol.net
- DNS ASK do#####ifference.net
- DNS ASK de#####ifference.net
- DNS ASK pr####eevery.net
- DNS ASK de###eevery.net
- DNS ASK st####thsingle.net
- DNS ASK st####thcharge.net
- DNS ASK st#####hdifference.net
- DNS ASK do####charge.net
- DNS ASK st####thevery.net
- DNS ASK be####ematter.net
- DNS ASK ex###tspent.net
- DNS ASK be####espent.net
- DNS ASK ex####together.net
- DNS ASK be####etogether.net
- DNS ASK ex####control.net
- DNS ASK de####charge.net
- DNS ASK pr#####difference.net
- DNS ASK pr####echarge.net
- DNS ASK de####single.net
- DNS ASK pr####esingle.net
- DNS ASK do###revery.net
- DNS ASK pr###yevery.net
- DNS ASK fe####single.net
- DNS ASK fe####charge.net
- DNS ASK fe#####ifference.net
- DNS ASK fe###wevery.net
- DNS ASK pr####charge.net
- DNS ASK de####choose.net
- DNS ASK do###eevery.net
- DNS ASK br####charge.net
- DNS ASK re####charge.net
- DNS ASK br#####ifference.net
- DNS ASK re#####ifference.net
- DNS ASK br###nevery.net
- DNS ASK re###tevery.net
- DNS ASK pr#####ifference.net
- DNS ASK re####single.net
- DNS ASK ex####matter.net
- DNS ASK pr####echoose.net
- DNS ASK fe####however.net
- DNS ASK de###estorm.net
- DNS ASK pr####ethrown.net
- DNS ASK de####thrown.net
- DNS ASK st####thhunger.net
- DNS ASK st###hunger.net
- DNS ASK st#####htraining.net
- DNS ASK br####hunger.net
- DNS ASK st####raining.net
- DNS ASK st###storm.net
- DNS ASK st####ththrown.net
- DNS ASK st###thrown.net
- DNS ASK mo####ntchoose.net
- DNS ASK ou####echoose.net
- DNS ASK mo#####talthough.net
- DNS ASK de####training.net
- DNS ASK pr####estorm.net
- DNS ASK pr####etraining.net
- DNS ASK de####hunger.net
- DNS ASK pr####ehunger.net
- DNS ASK do####hunger.net
- DNS ASK fe####training.net
- DNS ASK do####training.net
- DNS ASK fe###wstorm.net
- DNS ASK do###estorm.net
- DNS ASK fe####thrown.net
- DNS ASK ou####ealthough.net
- DNS ASK st####thstorm.net
- DNS ASK do####thrown.net
- DNS ASK br####training.net
- DNS ASK re####training.net
- DNS ASK br###nstorm.net
- DNS ASK re###tstorm.net
- DNS ASK br####thrown.net
- DNS ASK re####thrown.net
- DNS ASK fe####hunger.net
- DNS ASK re####hunger.net
- DNS ASK ev####ghowever.net
- DNS ASK br####however.net
- DNS ASK mo####nthowever.net
- DNS ASK do####period.net
- DNS ASK pr####period.net
- DNS ASK do####however.net
- DNS ASK pr####however.net
- DNS ASK fe####choose.net
- DNS ASK fe####although.net
- DNS ASK mo####ntperiod.net
- DNS ASK fe####period.net
- DNS ASK br####choose.net
- DNS ASK re####choose.net
- DNS ASK br####although.net
- DNS ASK re####although.net
- DNS ASK br####period.net
- DNS ASK re####period.net
- DNS ASK do####although.net
- DNS ASK pr####although.net
- DNS ASK pr####choose.net
- DNS ASK do####choose.net
- DNS ASK mi####owever.net
- DNS ASK bu####ngchoose.net
- DNS ASK ev####gchoose.net
- DNS ASK bu#####galthough.net
- DNS ASK ev####galthough.net
- DNS ASK bu####ngperiod.net
- DNS ASK ev####gperiod.net
- DNS ASK ou####eperiod.net
- DNS ASK re####however.net
- DNS ASK bu####nghowever.net
- DNS ASK mi###choose.net
- DNS ASK st####lthough.net
- DNS ASK mi####lthough.net
- DNS ASK st###period.net
- DNS ASK mi###period.net
- DNS ASK st####owever.net
- DNS ASK ou####ehowever.net
- DNS ASK st###choose.net
- DNS ASK pe####matter.net
Miscellaneous
Creates and executes the following
- 'C:\mdavjpqdjgvkqw\ir8gqwmkwetxjkcq.exe'
- 'C:\mdavjpqdjgvkqw\yfyjeii.exe'
- 'C:\mdavjpqdjgvkqw\uqrrjhqk.exe' "c:\mdavjpqdjgvkqw\yfyjeii.exe"
