Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Time Management Controls Portable] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Time Management Controls Portable] 'ImagePath' = 'C:\uokezfiber\xzzitup.exe'
Creates the following services
- 'Time Management Controls Portable' C:\uokezfiber\xzzitup.exe
Modifies file system
Creates the following files
- %WINDIR%\uokezfiber\mrhrcaxoc
- C:\uokezfiber\mrhrcaxoc
- C:\uokezfiber\pvpkbtjnspaqazqh5fbm.exe
- C:\uokezfiber\xzzitup.exe
- C:\uokezfiber\feisgjq.exe
Sets the 'hidden' attribute to the following files
- C:\uokezfiber\xzzitup.exe
- C:\uokezfiber\feisgjq.exe
Deletes the following files
- %WINDIR%\uokezfiber\mrhrcaxoc
- C:\uokezfiber\pvpkbtjnspaqazqh5fbm.exe
Substitutes the following files
- %WINDIR%\uokezfiber\mrhrcaxoc
Network activity
Connects to
- 'wi###wclean.net':80
- 'wi###rwomen.net':80
- 'fi###hclean.net':80
- 'sw###clean.net':80
- 'sw###women.net':80
- 'ma####alpaint.net':80
- 'si####stream.net':80
- 'mo####instream.net':80
- 'mo####inbottle.net':80
- 'wi####stream.net':80
- 'su####tnothing.net':80
- 'pr####lynothing.net':80
- 'si####business.net':80
- 'mo####inappear.net':80
- 'le###manner.net':80
- 'sw####usiness.net':80
TCP
HTTP GET requests
- http://wi###wclean.net/index.php
- http://wi###rwomen.net/index.php
- http://fi###hclean.net/index.php
- http://sw###clean.net/index.php
- http://sw###women.net/index.php
- http://ma####alpaint.net/index.php
- http://si####stream.net/index.php
- http://mo####instream.net/index.php
- http://mo####inbottle.net/index.php
- http://wi####stream.net/index.php
- http://su####tnothing.net/index.php
- http://pr####lynothing.net/index.php
- http://si####business.net/index.php
- http://mo####inappear.net/index.php
- http://le###manner.net/index.php
- http://sw####usiness.net/index.php
UDP
- DNS ASK po####lepaint.net
- DNS ASK se####ldivide.net
- DNS ASK ma####aldivide.net
- DNS ASK se####manner.net
- DNS ASK la###manner.net
- DNS ASK se####another.net
- DNS ASK la####nother.net
- DNS ASK se####business.net
- DNS ASK se####appear.net
- DNS ASK si####appear.net
- DNS ASK la###appear.net
- DNS ASK si####manner.net
- DNS ASK mo####manner.net
- DNS ASK si####another.net
- DNS ASK mo####another.net
- DNS ASK si####business.net
- DNS ASK mo####business.net
- DNS ASK ma####albottle.net
- DNS ASK la####usiness.net
- DNS ASK se####lbottle.net
- DNS ASK pr####lystream.net
- DNS ASK fi####nothing.net
- DNS ASK le####othing.net
- DNS ASK fi####bottle.net
- DNS ASK le###bottle.net
- DNS ASK fi####divide.net
- DNS ASK le###divide.net
- DNS ASK sw###stream.net
- DNS ASK sw####othing.net
- DNS ASK se####lnothing.net
- DNS ASK pr####lynothing.net
- DNS ASK sw###bottle.net
- DNS ASK pr####lybottle.net
- DNS ASK sw###divide.net
- DNS ASK pr####lydivide.net
- DNS ASK se####lstream.net
- DNS ASK ma####alstream.net
- DNS ASK ma####alnothing.net
- DNS ASK mo####appear.net
- DNS ASK mo####inmanner.net
- DNS ASK po####lemanner.net
- DNS ASK fi####business.net
- DNS ASK le####usiness.net
- DNS ASK fi####appear.net
- DNS ASK le###appear.net
- DNS ASK sw###manner.net
- DNS ASK pr####lymanner.net
- DNS ASK fi####another.net
- DNS ASK le####nother.net
- DNS ASK sw####nother.net
- DNS ASK pr#####ybusiness.net
- DNS ASK sw###appear.net
- DNS ASK pr####lyappear.net
- DNS ASK se####lmanner.net
- DNS ASK ma####almanner.net
- DNS ASK se####lanother.net
- DNS ASK pr####lyanother.net
- DNS ASK sw####usiness.net
- DNS ASK le###manner.net
- DNS ASK fi####manner.net
- DNS ASK su####tappear.net
- DNS ASK po####leanother.net
- DNS ASK mo#####nbusiness.net
- DNS ASK po#####ebusiness.net
- DNS ASK mo####inappear.net
- DNS ASK po####leappear.net
- DNS ASK pe####smanner.net
- DNS ASK wi####manner.net
- DNS ASK mo####inanother.net
- DNS ASK pe####sanother.net
- DNS ASK pe####sbusiness.net
- DNS ASK wi####business.net
- DNS ASK pe####sappear.net
- DNS ASK wi####appear.net
- DNS ASK su####tmanner.net
- DNS ASK su####tanother.net
- DNS ASK su####tbusiness.net
- DNS ASK wi####another.net
- DNS ASK le###stream.net
- DNS ASK ma####alanother.net
- DNS ASK fi####stream.net
- DNS ASK su####tbottle.net
- DNS ASK le###clean.net
- DNS ASK fi###hpaint.net
- DNS ASK le###paint.net
- DNS ASK fi####course.net
- DNS ASK le###course.net
- DNS ASK fi###hwomen.net
- DNS ASK le###women.net
- DNS ASK pr####lyclean.net
- DNS ASK ma####alclean.net
- DNS ASK sw###paint.net
- DNS ASK pr####lypaint.net
- DNS ASK sw###course.net
- DNS ASK pr####lycourse.net
- DNS ASK sw###women.net
- DNS ASK pr####lywomen.net
- DNS ASK se####lclean.net
- DNS ASK fi###hclean.net
- DNS ASK sw###clean.net
- DNS ASK su####twomen.net
- DNS ASK wi###wpaint.net
- DNS ASK mo####incourse.net
- DNS ASK po####lecourse.net
- DNS ASK mo####inwomen.net
- DNS ASK po####lewomen.net
- DNS ASK pe####sclean.net
- DNS ASK wi###wclean.net
- DNS ASK pe####spaint.net
- DNS ASK pe####scourse.net
- DNS ASK su####tcourse.net
- DNS ASK wi####course.net
- DNS ASK pe####swomen.net
- DNS ASK wi###wwomen.net
- DNS ASK wi###rclean.net
- DNS ASK su####tclean.net
- DNS ASK wi###rpaint.net
- DNS ASK su####tpaint.net
- DNS ASK wi###rwomen.net
- DNS ASK se####lpaint.net
- DNS ASK ma####alpaint.net
- DNS ASK se####lcourse.net
- DNS ASK po####lenothing.net
- DNS ASK mo####inbottle.net
- DNS ASK po####lebottle.net
- DNS ASK mo####individe.net
- DNS ASK po####ledivide.net
- DNS ASK pe####sstream.net
- DNS ASK po####lestream.net
- DNS ASK mo####innothing.net
- DNS ASK wi####stream.net
- DNS ASK pe####sbottle.net
- DNS ASK wi####bottle.net
- DNS ASK pe####sdivide.net
- DNS ASK wi####divide.net
- DNS ASK su####tstream.net
- DNS ASK su####tnothing.net
- DNS ASK pe####snothing.net
- DNS ASK wi####nothing.net
- DNS ASK mo####instream.net
- DNS ASK mo####divide.net
- DNS ASK si####divide.net
- DNS ASK se####lwomen.net
- DNS ASK ma####alwomen.net
- DNS ASK se####stream.net
- DNS ASK la###stream.net
- DNS ASK se####nothing.net
- DNS ASK la####othing.net
- DNS ASK se####bottle.net
- DNS ASK ma####alcourse.net
- DNS ASK la###bottle.net
- DNS ASK la###divide.net
- DNS ASK si####stream.net
- DNS ASK mo####stream.net
- DNS ASK si####nothing.net
- DNS ASK mo####nothing.net
- DNS ASK si####bottle.net
- DNS ASK mo####bottle.net
- DNS ASK se####divide.net
- DNS ASK su####tdivide.net
- DNS ASK se####lbusiness.net
Miscellaneous
Creates and executes the following
- 'C:\uokezfiber\pvpkbtjnspaqazqh5fbm.exe'
- 'C:\uokezfiber\xzzitup.exe'
- 'C:\uokezfiber\feisgjq.exe' "c:\uokezfiber\xzzitup.exe"
