Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\IKE DCOM Device Presentation Desktop UserMode] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\IKE DCOM Device Presentation Desktop UserMode] 'ImagePath' = 'C:\kvcppbacflfuvgc\pmjptveh.exe'
Creates the following services
- 'IKE DCOM Device Presentation Desktop UserMode' C:\kvcppbacflfuvgc\pmjptveh.exe
Modifies file system
Creates the following files
- %WINDIR%\kvcppbacflfuvgc\awedonjb
- C:\kvcppbacflfuvgc\awedonjb
- C:\kvcppbacflfuvgc\vceqampzvatbr9l.exe
- C:\kvcppbacflfuvgc\pmjptveh.exe
- C:\kvcppbacflfuvgc\vsuhmsolss.exe
Sets the 'hidden' attribute to the following files
- C:\kvcppbacflfuvgc\pmjptveh.exe
- C:\kvcppbacflfuvgc\vsuhmsolss.exe
Deletes the following files
- %WINDIR%\kvcppbacflfuvgc\awedonjb
- C:\kvcppbacflfuvgc\vceqampzvatbr9l.exe
Substitutes the following files
- %WINDIR%\kvcppbacflfuvgc\awedonjb
Network activity
Connects to
- 'mo####receive.net':80
- 'le####elieve.net':80
- 'si####system.net':80
- 'si###etrust.net':80
- 'fi###hhonor.net':80
- 'se####friend.net':80
TCP
HTTP GET requests
- http://mo####receive.net/index.php
- http://le####elieve.net/index.php
- http://si####system.net/index.php
- http://si###etrust.net/index.php
- http://fi###hhonor.net/index.php
- http://se####friend.net/index.php
Other
- '34.##9.100.209':443
UDP
- DNS ASK ma####alnorth.net
- DNS ASK le####either.net
- DNS ASK fi####system.net
- DNS ASK le###system.net
- DNS ASK fi###htrust.net
- DNS ASK le###trust.net
- DNS ASK sw###honor.net
- DNS ASK pr####lyhonor.net
- DNS ASK pr####lyneither.net
- DNS ASK ma####alneither.net
- DNS ASK sw###system.net
- DNS ASK pr####lysystem.net
- DNS ASK sw###trust.net
- DNS ASK pr####lytrust.net
- DNS ASK se####lhonor.net
- DNS ASK ma####alhonor.net
- DNS ASK se####lneither.net
- DNS ASK fi####neither.net
- DNS ASK sw####either.net
- DNS ASK le###honor.net
- DNS ASK pe####ssystem.net
- DNS ASK po####lesystem.net
- DNS ASK mo####intrust.net
- DNS ASK po####letrust.net
- DNS ASK pe####shonor.net
- DNS ASK wi###whonor.net
- DNS ASK pe####sneither.net
- DNS ASK wi####neither.net
- DNS ASK wi####system.net
- DNS ASK su####ttrust.net
- DNS ASK pe####strust.net
- DNS ASK wi###wtrust.net
- DNS ASK wi###rhonor.net
- DNS ASK su####thonor.net
- DNS ASK su####tneither.net
- DNS ASK su####tsystem.net
- DNS ASK wi###rtrust.net
- DNS ASK fi###hhonor.net
- DNS ASK se####lsystem.net
- DNS ASK ma####alsystem.net
- DNS ASK se####ltrust.net
- DNS ASK po#####econsider.net
- DNS ASK mo####infriend.net
- DNS ASK po####lefriend.net
- DNS ASK pe####slaughter.net
- DNS ASK wi####laughter.net
- DNS ASK pe####sfancy.net
- DNS ASK po####lefancy.net
- DNS ASK mo#####nconsider.net
- DNS ASK wi###wfancy.net
- DNS ASK pe####sfriend.net
- DNS ASK wi####friend.net
- DNS ASK su####tlaughter.net
- DNS ASK wi###rfancy.net
- DNS ASK su####tfancy.net
- DNS ASK su####tconsider.net
- DNS ASK pe####sconsider.net
- DNS ASK wi####consider.net
- DNS ASK mo####infancy.net
- DNS ASK po#####elaughter.net
- DNS ASK mo#####nlaughter.net
- DNS ASK se####laughter.net
- DNS ASK la####aughter.net
- DNS ASK se###afancy.net
- DNS ASK la###fancy.net
- DNS ASK se####consider.net
- DNS ASK la####onsider.net
- DNS ASK se####friend.net
- DNS ASK ma####altrust.net
- DNS ASK la###friend.net
- DNS ASK mo####laughter.net
- DNS ASK si###efancy.net
- DNS ASK mo###rfancy.net
- DNS ASK si####consider.net
- DNS ASK mo####consider.net
- DNS ASK si####friend.net
- DNS ASK mo####friend.net
- DNS ASK si####laughter.net
- DNS ASK mo####insystem.net
- DNS ASK su####tfriend.net
- DNS ASK po####leneither.net
- DNS ASK po####lehonor.net
- DNS ASK mo####inreceive.net
- DNS ASK po####lereceive.net
- DNS ASK mo####inquarter.net
- DNS ASK po####lequarter.net
- DNS ASK pe####sbranch.net
- DNS ASK wi####branch.net
- DNS ASK pe####sbelieve.net
- DNS ASK pe####sreceive.net
- DNS ASK fi####branch.net
- DNS ASK wi####receive.net
- DNS ASK pe####squarter.net
- DNS ASK wi####quarter.net
- DNS ASK su####tbranch.net
- DNS ASK su####tbelieve.net
- DNS ASK su####treceive.net
- DNS ASK su####tquarter.net
- DNS ASK po####lebelieve.net
- DNS ASK wi####believe.net
- DNS ASK mo####inbelieve.net
- DNS ASK la####uarter.net
- DNS ASK se####branch.net
- DNS ASK la###branch.net
- DNS ASK se####believe.net
- DNS ASK la####elieve.net
- DNS ASK se####receive.net
- DNS ASK la####eceive.net
- DNS ASK se####quarter.net
- DNS ASK si####branch.net
- DNS ASK mo####inbranch.net
- DNS ASK mo####branch.net
- DNS ASK si####believe.net
- DNS ASK mo####believe.net
- DNS ASK si####receive.net
- DNS ASK mo####receive.net
- DNS ASK si####quarter.net
- DNS ASK mo####quarter.net
- DNS ASK po####lebranch.net
- DNS ASK le###branch.net
- DNS ASK fi####believe.net
- DNS ASK le####elieve.net
- DNS ASK se####neither.net
- DNS ASK la####either.net
- DNS ASK se####system.net
- DNS ASK la###system.net
- DNS ASK se###atrust.net
- DNS ASK la###trust.net
- DNS ASK se###ahonor.net
- DNS ASK la###honor.net
- DNS ASK si###ehonor.net
- DNS ASK mo####neither.net
- DNS ASK si####system.net
- DNS ASK mo####system.net
- DNS ASK si###etrust.net
- DNS ASK mo###rtrust.net
- DNS ASK mo####inhonor.net
- DNS ASK mo###rhonor.net
- DNS ASK si####neither.net
- DNS ASK ma####alquarter.net
- DNS ASK se####lquarter.net
- DNS ASK ma####alreceive.net
- DNS ASK le####eceive.net
- DNS ASK fi####quarter.net
- DNS ASK le####uarter.net
- DNS ASK sw###branch.net
- DNS ASK pr####lybranch.net
- DNS ASK sw####elieve.net
- DNS ASK pr####lybelieve.net
- DNS ASK fi####receive.net
- DNS ASK sw####eceive.net
- DNS ASK sw####uarter.net
- DNS ASK pr####lyquarter.net
- DNS ASK se####lbranch.net
- DNS ASK ma####albranch.net
- DNS ASK se####lbelieve.net
- DNS ASK ma####albelieve.net
- DNS ASK se####lreceive.net
- DNS ASK pr####lyreceive.net
- DNS ASK mo####inneither.net
- DNS ASK fi####laughter.net
Miscellaneous
Creates and executes the following
- 'C:\kvcppbacflfuvgc\vceqampzvatbr9l.exe'
- 'C:\kvcppbacflfuvgc\pmjptveh.exe'
- 'C:\kvcppbacflfuvgc\vsuhmsolss.exe' "c:\kvcppbacflfuvgc\pmjptveh.exe"
