Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '敮啪汍桙䝷' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵瑜票祎奂攮數'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '祢杴䉉楤剌' = '㩣坜湩潤獷卜獹整㍭尲獰剆扇⹑硥e'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '奪啵佅摴奉' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵䕜坧呖佚攮數'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '慣橏䝸捅獃' = '㩣坜湩潤獷卜獹整㍭尲䥃䝍卯⹂硥e'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '穂塚䍬楷瑇' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵硜买兦啨攮數'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '瑓䭔瑢奎湭' = '㩣坜湩潤獷卜獹整㍭尲瑃捡充硥e'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '䕖捤䩶捬䕍' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵䱜睌䭁瑏攮數'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '桁湐填摙捴' = '㩣坜湩潤獷卜獹整㍭尲灣敓䙚硥e'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '瑅捧摆扭䉹' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵奜歙䙏䵺攮數'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '婋䝭敶䵥塗' = '㩣坜湩潤獷卜獹整㍭尲䡓硳剂⹃硥e'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '瑧祐䉂捺穆' = '㩣坜湩潤獷卜獹整㍭尲摘䱎䍳硥e'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '潭湑扱桯瑤' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵睜橒坸䥴攮數'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '䩪剱䝏䕫偊' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵潜䉧潴呗攮數'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '晫䥏睈剈汷' = '㩣坜湩潤獷卜獹整㍭尲䍳癍器⹍硥e'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '䭈兇奲兩䱱' = '㩣坜湩潤獷卜獹整㍭尲䵦畗煤硥e'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '牆䝃䵎硙煄' = '㩣坜湩潤獷卜獹整㍭尲硱晵女硥e'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '䑂塕䅄剒摐' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵作䕒湕潑攮數'
Modifies file system
Creates the following files
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\thynyby.exe
- <SYSTEM32>\psfrgbq.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\egwvtzo.exe
- <SYSTEM32>\cimgosb.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\xpnfqhu.exe
- <SYSTEM32>\ctaceqg.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\llwakot.exe
- <SYSTEM32>\cpsezfv.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\yykofzm.exe
- <SYSTEM32>\shsxbrc.exe
- <SYSTEM32>\xdnlsch.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\wrjxwti.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\ogbtowt.exe
- <SYSTEM32>\scmvhvm.exe
- <SYSTEM32>\fmwudqt.exe
- <SYSTEM32>\qxufsyn.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\oreunqo.exe
Network activity
UDP
- DNS ASK w.###kin.host
- DNS ASK co####ad.github.com
- DNS ASK ra#.####ubusercontent.com
- DNS ASK ap###rror.com
