Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Assistant NetBIOS Isolation Firewall' = '%APPDATA%\qmiajmipqojzn\jzttqjtfzvn.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\qmiajmipqojzn\jzttqjtfzvn.abfs8
- %APPDATA%\qmiajmipqojzn\htcdgty.exe
- %APPDATA%\qmiajmipqojzn\jzttqjtfzvn.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\qmiajmipqojzn\htcdgty.exe
- %APPDATA%\qmiajmipqojzn\jzttqjtfzvn.exe
Network activity:
Connects to:
- 'wo###should.net':80
- 're####ershould.net':80
- 'wo###short.net':80
- 'in####seopinion.net':80
- 'fo####promise.net':80
- 'in####sepromise.net':80
- 'wo####romise.net':80
- 're####erpromise.net':80
- 'jo####ysupply.net':80
- 're####ershort.net':80
- 'wo####pinion.net':80
- 're####eropinion.net':80
- 'fo####opinion.net':80
- 'th####hshort.net':80
- 'ef####opinion.net':80
- 'th####hopinion.net':80
- 'ef####should.net':80
- 'th####hshould.net':80
- 'ef###tshort.net':80
- 'in####seshould.net':80
- 'fo###tshort.net':80
- 'in####seshort.net':80
- 'ef####promise.net':80
- 'th####hpromise.net':80
- 'fo####should.net':80
TCP:
HTTP GET requests:
- http://wo###should.net/forum/search.php?em######################################
- http://re####ershould.net/forum/search.php?em######################################
- http://wo###short.net/forum/search.php?em######################################
- http://in####seopinion.net/forum/search.php?em######################################
- http://fo####promise.net/forum/search.php?em######################################
- http://in####sepromise.net/forum/search.php?em######################################
- http://wo####romise.net/forum/search.php?em######################################
- http://re####erpromise.net/forum/search.php?em######################################
- http://jo####ysupply.net/forum/search.php?em######################################
- http://re####ershort.net/forum/search.php?em######################################
- http://wo####pinion.net/forum/search.php?em######################################
- http://re####eropinion.net/forum/search.php?em######################################
- http://fo####opinion.net/forum/search.php?em######################################
- http://th####hshort.net/forum/search.php?em######################################
- http://ef####opinion.net/forum/search.php?em######################################
- http://th####hopinion.net/forum/search.php?em######################################
- http://ef####should.net/forum/search.php?em######################################
- http://th####hshould.net/forum/search.php?em######################################
- http://ef###tshort.net/forum/search.php?em######################################
- http://in####seshould.net/forum/search.php?em######################################
- http://fo###tshort.net/forum/search.php?em######################################
- http://in####seshort.net/forum/search.php?em######################################
- http://ef####promise.net/forum/search.php?em######################################
- http://th####hpromise.net/forum/search.php?em######################################
- http://fo####should.net/forum/search.php?em######################################
UDP:
- DNS ASK wo###should.net
- DNS ASK re####ershould.net
- DNS ASK wo###short.net
- DNS ASK in####seopinion.net
- DNS ASK fo####promise.net
- DNS ASK in####sepromise.net
- DNS ASK wo####romise.net
- DNS ASK re####erpromise.net
- DNS ASK jo####ysupply.net
- DNS ASK re####ershort.net
- DNS ASK wo####pinion.net
- DNS ASK re####eropinion.net
- DNS ASK fo####opinion.net
- DNS ASK th####hshort.net
- DNS ASK ef####opinion.net
- DNS ASK th####hopinion.net
- DNS ASK ef####should.net
- DNS ASK th####hshould.net
- DNS ASK ef###tshort.net
- DNS ASK in####seshould.net
- DNS ASK fo###tshort.net
- DNS ASK in####seshort.net
- DNS ASK ef####promise.net
- DNS ASK th####hpromise.net
- DNS ASK fo####should.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
