Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Task Problem Spooler Control Plug Search] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Task Problem Spooler Control Plug Search] 'ImagePath' = 'C:\psjwgccd\qlycmibk.exe'
Creates the following services
- 'Task Problem Spooler Control Plug Search' C:\psjwgccd\qlycmibk.exe
Modifies file system
Creates the following files
- %WINDIR%\psjwgccd\cvqyre
- C:\psjwgccd\cvqyre
- C:\psjwgccd\tbc7lvrqbio9eep.exe
- C:\psjwgccd\qlycmibk.exe
- C:\psjwgccd\krzkhnr.exe
Sets the 'hidden' attribute to the following files
- C:\psjwgccd\qlycmibk.exe
- C:\psjwgccd\krzkhnr.exe
Deletes the following files
- %WINDIR%\psjwgccd\cvqyre
- C:\psjwgccd\tbc7lvrqbio9eep.exe
Substitutes the following files
- %WINDIR%\psjwgccd\cvqyre
Network activity
Connects to
- 'wi####supply.net':80
UDP
- DNS ASK mo#####ndistance.net
- DNS ASK po#####edistance.net
- DNS ASK mo####inoffice.net
- DNS ASK po####leoffice.net
- DNS ASK mo####inarrive.net
- DNS ASK po####learrive.net
- DNS ASK pe####ssupply.net
- DNS ASK wi####supply.net
- DNS ASK pe####sdistance.net
- DNS ASK wi####distance.net
- DNS ASK pe####soffice.net
- DNS ASK wi####office.net
Miscellaneous
Creates and executes the following
- 'C:\psjwgccd\tbc7lvrqbio9eep.exe'
- 'C:\psjwgccd\qlycmibk.exe'
- 'C:\psjwgccd\krzkhnr.exe' "c:\psjwgccd\qlycmibk.exe"
