Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Offline System Backup Windows' = 'C:\zonotitr\nyjh8cr.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Host Files Computer Keying Web Color] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Host Files Computer Keying Web Color] 'ImagePath' = 'C:\zonotitr\nyjh8cr.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\zonotitr\drwusruefh
- C:\zonotitr\drwusruefh
- C:\zonotitr\wndcigty2hjiosuxfyjungoj.exe
- C:\zonotitr\nyjh8cr.exe
- C:\zonotitr\kfxlck3ob9.exe
- C:\zonotitr\gn8aft2tv3o2
Sets the 'hidden' attribute to the following files:
- C:\zonotitr\nyjh8cr.exe
- C:\zonotitr\kfxlck3ob9.exe
Deletes the following files:
- %WINDIR%\zonotitr\drwusruefh
- C:\zonotitr\wndcigty2hjiosuxfyjungoj.exe
Substitutes the following files:
- %WINDIR%\zonotitr\drwusruefh
Network activity:
Connects to:
- 'ma#####anfleurette.net':80
- 'cr#####ongabrielson.net':80
- 'ja#####yngabrielson.net':80
- 'cr######ncollingwood.net':80
- 'ja######ncollingwood.net':80
- 'cr#####onstephenson.net':80
- 'ja#####ynstephenson.net':80
- 'ro######echristinsen.net':80
- 'ja######achristinsen.net':80
- 'ro#####negabrielson.net':80
- 'ja#####tagabrielson.net':80
- 'ro######ecollingwood.net':80
- 'ja######acollingwood.net':80
- 'ro#####nestephenson.net':80
- 'ja#####tastephenson.net':80
- 'ha######achristinsen.net':80
- 'co######echristinsen.net':80
- 'ha#####tagabrielson.net':80
- 'co#####cegabrielson.net':80
- 'ha######acollingwood.net':80
- 'co######ecollingwood.net':80
- 'ha#####tastephenson.net':80
- 'co#####cestephenson.net':80
- 'ka######achristinsen.net':80
- 'ch#####tagabrielson.net':80
- 'ka#####ragabrielson.net':80
- 'ka######acollingwood.net':80
- 'ch#####tastephenson.net':80
- 'ka#####rastephenson.net':80
- 'ma######nchristinsen.net':80
- 'ja######nchristinsen.net':80
- 'pr######achristinsen.net':80
- 'cr######nchristinsen.net':80
- 'ch#####nestephenson.net':80
- 'pr#####lafleurette.net':80
- 'ma#####anwinthrop.net':80
- 'pr#####lawinthrop.net':80
- 'ma#####anmackenzie.net':80
- 'pr#####lamackenzie.net':80
- 'ma#####anjermaine.net':80
- 'pr#####lajermaine.net':80
- 'de#####stfleurette.net':80
- 'la#####iafleurette.net':80
- 'de#####stwinthrop.net':80
- 'la#####iawinthrop.net':80
- 'de#####stmackenzie.net':80
- 'la#####iamackenzie.net':80
- 'de#####stjermaine.net':80
- 'la#####iajermaine.net':80
- 'ch######achristinsen.net':80
- 'se######nchristinsen.net':80
- 'ch#####nagabrielson.net':80
- 'se#####angabrielson.net':80
- 'ch######acollingwood.net':80
- 'se######ncollingwood.net':80
- 'ch#####nastephenson.net':80
- 'se#####anstephenson.net':80
- 'ch######echristinsen.net':80
- 'cl######dchristinsen.net':80
- 'ch#####negabrielson.net':80
- 'cl#####ndgabrielson.net':80
- 'ch######ecollingwood.net':80
- 'cl######dcollingwood.net':80
- 'cl#####ndstephenson.net':80
- 'ma#####angabrielson.net':80
TCP:
HTTP GET requests:
- http://ma#####anfleurette.net/index.php
- http://cr#####ongabrielson.net/index.php
- http://ja#####yngabrielson.net/index.php
- http://cr######ncollingwood.net/index.php
- http://ja######ncollingwood.net/index.php
- http://cr#####onstephenson.net/index.php
- http://ja#####ynstephenson.net/index.php
- http://ro######echristinsen.net/index.php
- http://ja######achristinsen.net/index.php
- http://ro#####negabrielson.net/index.php
- http://ja#####tagabrielson.net/index.php
- http://ro######ecollingwood.net/index.php
- http://ja######acollingwood.net/index.php
- http://ro#####nestephenson.net/index.php
- http://ja#####tastephenson.net/index.php
- http://ha######achristinsen.net/index.php
- http://co######echristinsen.net/index.php
- http://ha#####tagabrielson.net/index.php
- http://co#####cegabrielson.net/index.php
- http://ha######acollingwood.net/index.php
- http://co######ecollingwood.net/index.php
- http://ha#####tastephenson.net/index.php
- http://co#####cestephenson.net/index.php
- http://ka######achristinsen.net/index.php
- http://ch#####tagabrielson.net/index.php
- http://ka#####ragabrielson.net/index.php
- http://ka######acollingwood.net/index.php
- http://ch#####tastephenson.net/index.php
- http://ka#####rastephenson.net/index.php
- http://ma######nchristinsen.net/index.php
- http://ja######nchristinsen.net/index.php
- http://pr######achristinsen.net/index.php
- http://cr######nchristinsen.net/index.php
- http://ch#####nestephenson.net/index.php
- http://pr#####lafleurette.net/index.php
- http://ma#####anwinthrop.net/index.php
- http://pr#####lawinthrop.net/index.php
- http://ma#####anmackenzie.net/index.php
- http://pr#####lamackenzie.net/index.php
- http://ma#####anjermaine.net/index.php
- http://pr#####lajermaine.net/index.php
- http://de#####stfleurette.net/index.php
- http://la#####iafleurette.net/index.php
- http://de#####stwinthrop.net/index.php
- http://la#####iawinthrop.net/index.php
- http://de#####stmackenzie.net/index.php
- http://la#####iamackenzie.net/index.php
- http://de#####stjermaine.net/index.php
- http://la#####iajermaine.net/index.php
- http://ch######achristinsen.net/index.php
- http://se######nchristinsen.net/index.php
- http://ch#####nagabrielson.net/index.php
- http://se#####angabrielson.net/index.php
- http://ch######acollingwood.net/index.php
- http://se######ncollingwood.net/index.php
- http://ch#####nastephenson.net/index.php
- http://se#####anstephenson.net/index.php
- http://ch######echristinsen.net/index.php
- http://cl######dchristinsen.net/index.php
- http://ch#####negabrielson.net/index.php
- http://cl#####ndgabrielson.net/index.php
- http://ch######ecollingwood.net/index.php
- http://cl######dcollingwood.net/index.php
- http://cl#####ndstephenson.net/index.php
- http://ma#####angabrielson.net/index.php
UDP:
- DNS ASK ma#####anfleurette.net
- DNS ASK cr######ncollingwood.net
- DNS ASK ja######ncollingwood.net
- DNS ASK cr#####onstephenson.net
- DNS ASK ja#####ynstephenson.net
- DNS ASK ro######echristinsen.net
- DNS ASK ja######achristinsen.net
- DNS ASK ro#####negabrielson.net
- DNS ASK ja#####tagabrielson.net
- DNS ASK ro######ecollingwood.net
- DNS ASK ja######acollingwood.net
- DNS ASK ro#####nestephenson.net
- DNS ASK ja#####tastephenson.net
- DNS ASK ha######achristinsen.net
- DNS ASK ch######achristinsen.net
- DNS ASK co######echristinsen.net
- DNS ASK co#####cegabrielson.net
- DNS ASK ha######acollingwood.net
- DNS ASK co######ecollingwood.net
- DNS ASK ha#####tastephenson.net
- DNS ASK co#####cestephenson.net
- DNS ASK ka######achristinsen.net
- DNS ASK ch#####tagabrielson.net
- DNS ASK ka#####ragabrielson.net
- DNS ASK ka######acollingwood.net
- DNS ASK ch#####tastephenson.net
- DNS ASK ka#####rastephenson.net
- DNS ASK ma######nchristinsen.net
- DNS ASK pr######achristinsen.net
- DNS ASK cr#####ongabrielson.net
- DNS ASK ja#####yngabrielson.net
- DNS ASK ja######nchristinsen.net
- DNS ASK cr######nchristinsen.net
- DNS ASK cl#####ndstephenson.net
- DNS ASK ma#####anwinthrop.net
- DNS ASK pr#####lawinthrop.net
- DNS ASK ma#####anmackenzie.net
- DNS ASK pr#####lamackenzie.net
- DNS ASK ma#####anjermaine.net
- DNS ASK pr#####lajermaine.net
- DNS ASK de#####stfleurette.net
- DNS ASK la#####iafleurette.net
- DNS ASK de#####stwinthrop.net
- DNS ASK la#####iawinthrop.net
- DNS ASK de#####stmackenzie.net
- DNS ASK la#####iamackenzie.net
- DNS ASK de#####stjermaine.net
- DNS ASK ma#####angabrielson.net
- DNS ASK ha#####tagabrielson.net
- DNS ASK la#####iajermaine.net
- DNS ASK ch#####nagabrielson.net
- DNS ASK se#####angabrielson.net
- DNS ASK ch######acollingwood.net
- DNS ASK se######ncollingwood.net
- DNS ASK ch#####nastephenson.net
- DNS ASK se#####anstephenson.net
- DNS ASK ch######echristinsen.net
- DNS ASK cl######dchristinsen.net
- DNS ASK ch#####negabrielson.net
- DNS ASK cl#####ndgabrielson.net
- DNS ASK ch######ecollingwood.net
- DNS ASK cl######dcollingwood.net
- DNS ASK ch#####nestephenson.net
- DNS ASK pr#####lafleurette.net
- DNS ASK se######nchristinsen.net
- DNS ASK pr#####lagabrielson.net
Miscellaneous:
Creates and executes the following:
- 'C:\zonotitr\wndcigty2hjiosuxfyjungoj.exe'
- 'C:\zonotitr\nyjh8cr.exe'
- 'C:\zonotitr\kfxlck3ob9.exe' "c:\zonotitr\nyjh8cr.exe"