Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Reports Receiver Protection] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Reports Receiver Protection] 'ImagePath' = 'C:\yhdiawilz\eebdgosu.exe'
Creates the following services
- 'Reports Receiver Protection' C:\yhdiawilz\eebdgosu.exe
Modifies file system
Creates the following files
- %WINDIR%\yhdiawilz\rcqqxsvfkf
- C:\yhdiawilz\rcqqxsvfkf
- C:\yhdiawilz\nmmlp3i7mdvxbyrrud.exe
- C:\yhdiawilz\eebdgosu.exe
- C:\yhdiawilz\stpfdrgvuf.exe
- C:\yhdiawilz\mnr5qkppz
Sets the 'hidden' attribute to the following files
- C:\yhdiawilz\eebdgosu.exe
- C:\yhdiawilz\stpfdrgvuf.exe
Deletes the following files
- %WINDIR%\yhdiawilz\rcqqxsvfkf
- C:\yhdiawilz\nmmlp3i7mdvxbyrrud.exe
Substitutes the following files
- %WINDIR%\yhdiawilz\rcqqxsvfkf
Network activity
Connects to
- 'tr###speak.net':80
- 'tw####behind.net':80
TCP
HTTP GET requests
- http://tr###speak.net/index.php
- http://tw####behind.net/index.php
UDP
- DNS ASK st###tspeak.net
- DNS ASK th###broad.net
- DNS ASK pr####tbroad.net
- DNS ASK th###behind.net
- DNS ASK pr####tbehind.net
- DNS ASK th###butter.net
- DNS ASK pr####tbutter.net
- DNS ASK ch####nderstand.net
- DNS ASK co#####understand.net
- DNS ASK ch###broad.net
- DNS ASK co####ebroad.net
- DNS ASK ch###behind.net
- DNS ASK co####ebehind.net
- DNS ASK ga####oclock.net
- DNS ASK ch###butter.net
- DNS ASK of####nderstand.net
- DNS ASK al####nderstand.net
- DNS ASK of###broad.net
- DNS ASK al###broad.net
- DNS ASK of###behind.net
- DNS ASK al###behind.net
- DNS ASK of###butter.net
- DNS ASK al###butter.net
- DNS ASK mi#####nderstand.net
- DNS ASK tw#####nderstand.net
- DNS ASK mi###ebroad.net
- DNS ASK tw###ebroad.net
- DNS ASK th####nderstand.net
- DNS ASK pr#####understand.net
- DNS ASK se####oclock.net
- DNS ASK qu###oclock.net
- DNS ASK se###nwrite.net
- DNS ASK st###tniece.net
- DNS ASK tr###niece.net
- DNS ASK st###twrite.net
- DNS ASK tr###write.net
- DNS ASK st####oclock.net
- DNS ASK tr###oclock.net
- DNS ASK be###rspeak.net
- DNS ASK ga###rspeak.net
- DNS ASK be###rniece.net
- DNS ASK ga###rniece.net
- DNS ASK be###rwrite.net
- DNS ASK ga###rwrite.net
- DNS ASK mi####behind.net
- DNS ASK co####ebutter.net
- DNS ASK be####oclock.net
- DNS ASK br###speak.net
- DNS ASK fl###niece.net
- DNS ASK br###niece.net
- DNS ASK fl###write.net
- DNS ASK br###write.net
- DNS ASK fl###oclock.net
- DNS ASK br###oclock.net
- DNS ASK qu###speak.net
- DNS ASK se###nspeak.net
- DNS ASK qu###niece.net
- DNS ASK se###nniece.net
- DNS ASK qu###write.net
- DNS ASK tr###speak.net
- DNS ASK fl###speak.net
- DNS ASK tw####behind.net
Miscellaneous
Creates and executes the following
- 'C:\yhdiawilz\nmmlp3i7mdvxbyrrud.exe'
- 'C:\yhdiawilz\eebdgosu.exe'
- 'C:\yhdiawilz\stpfdrgvuf.exe' "c:\yhdiawilz\eebdgosu.exe"
