Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\NetBIOS HomeGroup Location Link-Layer Copy] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\NetBIOS HomeGroup Location Link-Layer Copy] 'ImagePath' = 'C:\npjpwmbhw\kiqdimvl.exe'
Creates the following services
- 'NetBIOS HomeGroup Location Link-Layer Copy' C:\npjpwmbhw\kiqdimvl.exe
Modifies file system
Creates the following files
- %WINDIR%\npjpwmbhw\cogdnen
- C:\npjpwmbhw\cogdnen
- C:\npjpwmbhw\im9ov09u46bgiksyjv.exe
- C:\npjpwmbhw\kiqdimvl.exe
- C:\npjpwmbhw\hholqaq.exe
Sets the 'hidden' attribute to the following files
- C:\npjpwmbhw\kiqdimvl.exe
- C:\npjpwmbhw\hholqaq.exe
Deletes the following files
- %WINDIR%\npjpwmbhw\cogdnen
- C:\npjpwmbhw\im9ov09u46bgiksyjv.exe
Substitutes the following files
- %WINDIR%\npjpwmbhw\cogdnen
Network activity
Connects to
- 'kn####elcome.net':80
- 'kn###proud.net':80
- 'be####omplete.net':80
- 'su####around.net':80
- 'cr###around.net':80
- 'wa####omplete.net':80
- 'wo###around.net':80
- 'fr###nature.net':80
- 'ex#####ncenature.net':80
TCP
HTTP GET requests
- http://kn####elcome.net/index.php
- http://kn###proud.net/index.php
- http://be####omplete.net/index.php
- http://su####around.net/index.php
- http://cr###around.net/index.php
- http://wa####omplete.net/index.php
- http://wo###around.net/index.php
- http://fr###nature.net/index.php
- http://ex#####ncenature.net/index.php
UDP
- DNS ASK me####around.net
- DNS ASK kn###nature.net
- DNS ASK be###nature.net
- DNS ASK me####govern.net
- DNS ASK fo####govern.net
- DNS ASK me####enough.net
- DNS ASK fo####enough.net
- DNS ASK me####needle.net
- DNS ASK fo####needle.net
- DNS ASK me####nature.net
- DNS ASK kn###needle.net
- DNS ASK be###needle.net
- DNS ASK ge####mangovern.net
- DNS ASK al####yenough.net
- DNS ASK ge####manenough.net
- DNS ASK al####yneedle.net
- DNS ASK ge####manneedle.net
- DNS ASK al####ynature.net
- DNS ASK ge####mannature.net
- DNS ASK ex#####ncegovern.net
- DNS ASK fr###govern.net
- DNS ASK fo####nature.net
- DNS ASK wa###around.net
- DNS ASK be###enough.net
- DNS ASK wo###needle.net
- DNS ASK sm###nature.net
- DNS ASK wo###nature.net
- DNS ASK wa###govern.net
- DNS ASK th####tgovern.net
- DNS ASK wa###enough.net
- DNS ASK th####tenough.net
- DNS ASK wa###needle.net
- DNS ASK th####tneedle.net
- DNS ASK wa###nature.net
- DNS ASK th####tnature.net
- DNS ASK cr###govern.net
- DNS ASK su####govern.net
- DNS ASK cr###enough.net
- DNS ASK su####enough.net
- DNS ASK cr###needle.net
- DNS ASK su####needle.net
- DNS ASK cr###nature.net
- DNS ASK su####nature.net
- DNS ASK kn###govern.net
- DNS ASK be###govern.net
- DNS ASK ex#####nceenough.net
- DNS ASK al####ygovern.net
- DNS ASK fr###enough.net
- DNS ASK ex#####nceneedle.net
- DNS ASK fr###needle.net
- DNS ASK be####omplete.net
- DNS ASK cr####omplete.net
- DNS ASK su####complete.net
- DNS ASK cr###proud.net
- DNS ASK su###rproud.net
- DNS ASK cr###around.net
- DNS ASK su####around.net
- DNS ASK cr####elcome.net
- DNS ASK su####welcome.net
- DNS ASK kn####omplete.net
- DNS ASK kn###proud.net
- DNS ASK wa####elcome.net
- DNS ASK be###proud.net
- DNS ASK kn###around.net
- DNS ASK be###around.net
- DNS ASK kn####elcome.net
- DNS ASK be####elcome.net
- DNS ASK me####complete.net
- DNS ASK fo####complete.net
- DNS ASK me###rproud.net
- DNS ASK fo###wproud.net
- DNS ASK sm###needle.net
- DNS ASK kn###enough.net
- DNS ASK th####taround.net
- DNS ASK wa###proud.net
- DNS ASK th####twelcome.net
- DNS ASK ex#####ncenature.net
- DNS ASK fr###nature.net
- DNS ASK fi####omplete.net
- DNS ASK pa####omplete.net
- DNS ASK fi###proud.net
- DNS ASK pa###proud.net
- DNS ASK fi###around.net
- DNS ASK pa###around.net
- DNS ASK fi####elcome.net
- DNS ASK pa####elcome.net
- DNS ASK sm####omplete.net
- DNS ASK wo####omplete.net
- DNS ASK sm###proud.net
- DNS ASK wo###proud.net
- DNS ASK sm###around.net
- DNS ASK wo###around.net
- DNS ASK sm####elcome.net
- DNS ASK wo####elcome.net
- DNS ASK wa####omplete.net
- DNS ASK th####tcomplete.net
- DNS ASK th####tproud.net
- DNS ASK wo###enough.net
Miscellaneous
Creates and executes the following
- 'C:\npjpwmbhw\im9ov09u46bgiksyjv.exe'
- 'C:\npjpwmbhw\kiqdimvl.exe'
- 'C:\npjpwmbhw\hholqaq.exe' "c:\npjpwmbhw\kiqdimvl.exe"
