Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Encryption Desktop Socket] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Encryption Desktop Socket] 'ImagePath' = 'C:\xswanazp\wjfghegv.exe'
Creates the following services
- 'Encryption Desktop Socket' C:\xswanazp\wjfghegv.exe
Modifies file system
Creates the following files
- %WINDIR%\xswanazp\ctiyapi3vw3r
- C:\xswanazp\ctiyapi3vw3r
- C:\xswanazp\diya9ry02vzmsglhdg.exe
- C:\xswanazp\wjfghegv.exe
- C:\xswanazp\vdabbik.exe
Sets the 'hidden' attribute to the following files
- C:\xswanazp\wjfghegv.exe
- C:\xswanazp\vdabbik.exe
Deletes the following files
- %WINDIR%\xswanazp\ctiyapi3vw3r
- C:\xswanazp\diya9ry02vzmsglhdg.exe
Substitutes the following files
- %WINDIR%\xswanazp\ctiyapi3vw3r
Network activity
Connects to
- 'in####sebicycle.net':80
- 'wo###bridge.net':80
- 'li####kitchen.net':80
- 'de####yaround.net':80
- 'de####ycomplete.net':80
- 'be###gproud.net':80
TCP
HTTP GET requests
- http://in####sebicycle.net/index.php
- http://wo###bridge.net/index.php
- http://li####kitchen.net/index.php
- http://de####yaround.net/index.php
- http://de####ycomplete.net/index.php
- http://be###gproud.net/index.php
UDP
- DNS ASK de####ywhose.net
- DNS ASK in#####eprobable.net
- DNS ASK wo###wagon.net
- DNS ASK re####erwagon.net
- DNS ASK wo####ithout.net
- DNS ASK re####erwithout.net
- DNS ASK wo####itchen.net
- DNS ASK in####sekitchen.net
- DNS ASK fo####probable.net
- DNS ASK re####erkitchen.net
- DNS ASK jo####ywelcome.net
- DNS ASK hu####dwelcome.net
- DNS ASK jo####yaround.net
- DNS ASK hu####daround.net
- DNS ASK jo####yproud.net
- DNS ASK hu####dproud.net
- DNS ASK wo####robable.net
- DNS ASK re#####rprobable.net
- DNS ASK fo####kitchen.net
- DNS ASK in####sewithout.net
- DNS ASK fo####without.net
- DNS ASK wi####without.net
- DNS ASK su####without.net
- DNS ASK wi####kitchen.net
- DNS ASK su####kitchen.net
- DNS ASK wi####probable.net
- DNS ASK su####probable.net
- DNS ASK ef###twagon.net
- DNS ASK su###rwagon.net
- DNS ASK th####hwagon.net
- DNS ASK th####hwithout.net
- DNS ASK ef####kitchen.net
- DNS ASK th####hkitchen.net
- DNS ASK ef####probable.net
- DNS ASK th####hprobable.net
- DNS ASK fo###twagon.net
- DNS ASK in####sewagon.net
- DNS ASK ef####without.net
- DNS ASK jo####ycomplete.net
- DNS ASK de####ywelcome.net
- DNS ASK th####hcomplete.net
- DNS ASK li####welcome.net
- DNS ASK wi####welcome.net
- DNS ASK su####welcome.net
- DNS ASK wi####around.net
- DNS ASK su####around.net
- DNS ASK wi###nproud.net
- DNS ASK su###rproud.net
- DNS ASK ch####omplete.net
- DNS ASK th####omplete.net
- DNS ASK wi####complete.net
- DNS ASK th####hwelcome.net
- DNS ASK ef####around.net
- DNS ASK th####haround.net
- DNS ASK ef###tproud.net
- DNS ASK th####hproud.net
- DNS ASK ef####complete.net
- DNS ASK su####complete.net
- DNS ASK ef####welcome.net
- DNS ASK th###proud.net
- DNS ASK ch###proud.net
- DNS ASK th###around.net
- DNS ASK li####around.net
- DNS ASK de####yproud.net
- DNS ASK li###eproud.net
- DNS ASK de####ycomplete.net
- DNS ASK li####complete.net
- DNS ASK ri####welcome.net
- DNS ASK be####welcome.net
- DNS ASK de####yaround.net
- DNS ASK ri####around.net
- DNS ASK ri###nproud.net
- DNS ASK be###gproud.net
- DNS ASK ri####complete.net
- DNS ASK be####complete.net
- DNS ASK ch####elcome.net
- DNS ASK th####elcome.net
- DNS ASK ch###around.net
- DNS ASK be####around.net
- DNS ASK wi###nwagon.net
- DNS ASK hu####dcomplete.net
- DNS ASK th####robable.net
- DNS ASK in####sebicycle.net
- DNS ASK su####bicycle.net
- DNS ASK wi###nwhose.net
- DNS ASK su###rwhose.net
- DNS ASK ef####except.net
- DNS ASK th####hexcept.net
- DNS ASK ef####bridge.net
- DNS ASK su####bridge.net
- DNS ASK wi####bicycle.net
- DNS ASK th####hbridge.net
- DNS ASK ef###twhose.net
- DNS ASK th####hwhose.net
- DNS ASK fo####except.net
- DNS ASK in####seexcept.net
- DNS ASK fo####bridge.net
- DNS ASK in####sebridge.net
- DNS ASK ef####bicycle.net
- DNS ASK th####hbicycle.net
- DNS ASK wi####bridge.net
- DNS ASK su####except.net
- DNS ASK wi####except.net
- DNS ASK ri####except.net
- DNS ASK be####except.net
- DNS ASK ri####bridge.net
- DNS ASK be####bridge.net
- DNS ASK ri####bicycle.net
- DNS ASK be####bicycle.net
- DNS ASK ri###nwhose.net
- DNS ASK li###ewhose.net
- DNS ASK be###gwhose.net
- DNS ASK th###except.net
- DNS ASK ch###bridge.net
- DNS ASK th###bridge.net
- DNS ASK ch####icycle.net
- DNS ASK th####icycle.net
- DNS ASK ch###whose.net
- DNS ASK th###whose.net
- DNS ASK ch###except.net
- DNS ASK fo####bicycle.net
- DNS ASK fo###twhose.net
- DNS ASK th####itchen.net
- DNS ASK in####sewhose.net
- DNS ASK de####yprobable.net
- DNS ASK li####probable.net
- DNS ASK ri###nwagon.net
- DNS ASK be###gwagon.net
- DNS ASK ri####without.net
- DNS ASK be####without.net
- DNS ASK de####ykitchen.net
- DNS ASK li####kitchen.net
- DNS ASK ri####kitchen.net
- DNS ASK be####probable.net
- DNS ASK ch###wagon.net
- DNS ASK th###wagon.net
- DNS ASK ch####ithout.net
- DNS ASK th####ithout.net
- DNS ASK ch####itchen.net
- DNS ASK be####kitchen.net
- DNS ASK ri####probable.net
- DNS ASK li####without.net
- DNS ASK de####ywithout.net
- DNS ASK li###ewagon.net
- DNS ASK re####erexcept.net
- DNS ASK wo###bridge.net
- DNS ASK re####erbridge.net
- DNS ASK wo####icycle.net
- DNS ASK re####erbicycle.net
- DNS ASK wo###whose.net
- DNS ASK re####erwhose.net
- DNS ASK wo###except.net
- DNS ASK jo####ywagon.net
- DNS ASK jo####ywithout.net
- DNS ASK hu####dwithout.net
- DNS ASK jo####ykitchen.net
- DNS ASK hu####dkitchen.net
- DNS ASK jo####yprobable.net
- DNS ASK hu####dprobable.net
- DNS ASK de####ywagon.net
- DNS ASK hu####dwagon.net
- DNS ASK ch####robable.net
- DNS ASK fo####welcome.net
Miscellaneous
Creates and executes the following
- 'C:\xswanazp\diya9ry02vzmsglhdg.exe'
- 'C:\xswanazp\wjfghegv.exe'
- 'C:\xswanazp\vdabbik.exe' "c:\xswanazp\wjfghegv.exe"
