Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\DLL Smart AuthIP Protected Certificate] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\DLL Smart AuthIP Protected Certificate] 'ImagePath' = 'C:\rljmtpgfonldwxa\fwgfkyqovg.exe'
Creates the following services
- 'DLL Smart AuthIP Protected Certificate' C:\rljmtpgfonldwxa\fwgfkyqovg.exe
Modifies file system
Creates the following files
- %WINDIR%\rljmtpgfonldwxa\ikivmeufwai
- C:\rljmtpgfonldwxa\ikivmeufwai
- C:\rljmtpgfonldwxa\cvhai2k5nvgczyifu.exe
- C:\rljmtpgfonldwxa\fwgfkyqovg.exe
- C:\rljmtpgfonldwxa\mueglir.exe
Sets the 'hidden' attribute to the following files
- C:\rljmtpgfonldwxa\fwgfkyqovg.exe
- C:\rljmtpgfonldwxa\mueglir.exe
Deletes following files that it created itself
- %WINDIR%\rljmtpgfonldwxa\ikivmeufwai
- C:\rljmtpgfonldwxa\cvhai2k5nvgczyifu.exe
Substitutes the following files
- %WINDIR%\rljmtpgfonldwxa\ikivmeufwai
Network activity
Connects to
- 'th###clear.net':80
- 'pr####tgeneral.net':80
- 'st####enorth.net':80
- 'th####eceive.net':80
- 'tw####believe.net':80
- 'th###system.net':80
TCP
HTTP GET requests
- http://th###clear.net/index.php
- http://st####enorth.net/index.php
- http://th####eceive.net/index.php
- http://tw####believe.net/index.php
- http://th###system.net/index.php
UDP
- DNS ASK cl###indeed.net
- DNS ASK th###during.net
- DNS ASK cl###during.net
- DNS ASK th###clear.net
- DNS ASK pr####tclear.net
- DNS ASK th####eneral.net
- DNS ASK pr####tgeneral.net
- DNS ASK th####nclude.net
- DNS ASK pr####tinclude.net
- DNS ASK th###north.net
- DNS ASK pr####tnorth.net
- DNS ASK ch###clear.net
- DNS ASK co####eclear.net
- DNS ASK ch####eneral.net
- DNS ASK co####egeneral.net
- DNS ASK ch####nclude.net
- DNS ASK co####einclude.net
- DNS ASK ch###north.net
- DNS ASK co####enorth.net
- DNS ASK of###clear.net
- DNS ASK al###clear.net
- DNS ASK of####eneral.net
- DNS ASK al####eneral.net
- DNS ASK of####nclude.net
- DNS ASK al####nclude.net
- DNS ASK of###north.net
- DNS ASK al###north.net
- DNS ASK mi###eclear.net
- DNS ASK tw###eclear.net
- DNS ASK mi####general.net
- DNS ASK tw####general.net
- DNS ASK mi####include.net
- DNS ASK tw####include.net
- DNS ASK mi###enorth.net
- DNS ASK tw###enorth.net
- DNS ASK ra###rclear.net
- DNS ASK mo####gclear.net
- DNS ASK ra####general.net
- DNS ASK mo####ggeneral.net
- DNS ASK ra####include.net
- DNS ASK mo####ginclude.net
- DNS ASK ra###rnorth.net
- DNS ASK mo####gnorth.net
- DNS ASK st####eclear.net
- DNS ASK hi####yclear.net
- DNS ASK st####egeneral.net
- DNS ASK hi####ygeneral.net
- DNS ASK st####einclude.net
- DNS ASK hi####yinclude.net
- DNS ASK st####enorth.net
- DNS ASK hi####ynorth.net
- DNS ASK am###tclear.net
- DNS ASK we####rclear.net
- DNS ASK am####general.net
- DNS ASK we####rgeneral.net
- DNS ASK am####include.net
- DNS ASK we####rinclude.net
- DNS ASK am###tnorth.net
- DNS ASK we####rnorth.net
- DNS ASK cl###clear.net
- DNS ASK cl####eneral.net
- DNS ASK cl####nclude.net
- DNS ASK cl###north.net
- DNS ASK th###branch.net
- DNS ASK pr####tbranch.net
- DNS ASK th####elieve.net
- DNS ASK pr####tbelieve.net
- DNS ASK th####eceive.net
- DNS ASK pr####treceive.net
- DNS ASK th####uarter.net
- DNS ASK pr####tquarter.net
- DNS ASK ch###branch.net
- DNS ASK co####ebranch.net
- DNS ASK ch####elieve.net
- DNS ASK co####ebelieve.net
- DNS ASK ch####eceive.net
- DNS ASK co####ereceive.net
- DNS ASK ch####uarter.net
- DNS ASK co####equarter.net
- DNS ASK of###branch.net
- DNS ASK al###branch.net
- DNS ASK of####elieve.net
- DNS ASK al####elieve.net
- DNS ASK of####eceive.net
- DNS ASK al####eceive.net
- DNS ASK of####uarter.net
- DNS ASK al####uarter.net
- DNS ASK mi####branch.net
- DNS ASK tw####branch.net
- DNS ASK mi####believe.net
- DNS ASK tw####believe.net
- DNS ASK mi####receive.net
- DNS ASK tw####receive.net
- DNS ASK mi####quarter.net
- DNS ASK tw####quarter.net
- DNS ASK ra####branch.net
- DNS ASK mo####gbranch.net
- DNS ASK ra####believe.net
- DNS ASK mo####gbelieve.net
- DNS ASK ra####receive.net
- DNS ASK mo####greceive.net
- DNS ASK ra####quarter.net
- DNS ASK mo####gquarter.net
- DNS ASK st####ebranch.net
- DNS ASK hi####ybranch.net
- DNS ASK st####ebelieve.net
- DNS ASK hi####ybelieve.net
- DNS ASK st####ereceive.net
- DNS ASK hi####yreceive.net
- DNS ASK st####equarter.net
- DNS ASK hi####yquarter.net
- DNS ASK am####branch.net
- DNS ASK we####rbranch.net
- DNS ASK am####believe.net
- DNS ASK we####rbelieve.net
- DNS ASK am####receive.net
- DNS ASK we####rreceive.net
- DNS ASK am####quarter.net
- DNS ASK we####rquarter.net
- DNS ASK cl###branch.net
- DNS ASK cl####elieve.net
- DNS ASK cl####eceive.net
- DNS ASK cl####uarter.net
- DNS ASK th###honor.net
- DNS ASK pr####thonor.net
- DNS ASK th####either.net
- DNS ASK pr####tneither.net
- DNS ASK th###system.net
- DNS ASK pr####tsystem.net
- DNS ASK th###trust.net
- DNS ASK pr####ttrust.net
- DNS ASK ch###honor.net
- DNS ASK co####ehonor.net
- DNS ASK ch####either.net
- DNS ASK co####eneither.net
- DNS ASK ch###system.net
- DNS ASK co####esystem.net
- DNS ASK ch###trust.net
- DNS ASK co####etrust.net
- DNS ASK of###honor.net
- DNS ASK al###honor.net
- DNS ASK of####either.net
- DNS ASK al####either.net
- DNS ASK of###system.net
- DNS ASK al###system.net
- DNS ASK of###trust.net
- DNS ASK al###trust.net
- DNS ASK mi###ehonor.net
- DNS ASK tw###ehonor.net
- DNS ASK mi####neither.net
- DNS ASK tw####neither.net
- DNS ASK mi####system.net
- DNS ASK tw####system.net
- DNS ASK mi###etrust.net
- DNS ASK tw###etrust.net
- DNS ASK ra###rhonor.net
- DNS ASK mo####ghonor.net
- DNS ASK ra####neither.net
- DNS ASK mo####gneither.net
- DNS ASK ra####system.net
- DNS ASK mo####gsystem.net
- DNS ASK ra###rtrust.net
Miscellaneous
Creates and executes the following
- 'C:\rljmtpgfonldwxa\cvhai2k5nvgczyifu.exe'
- 'C:\rljmtpgfonldwxa\fwgfkyqovg.exe'
- 'C:\rljmtpgfonldwxa\mueglir.exe' "c:\rljmtpgfonldwxa\fwgfkyqovg.exe"
