Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Resolution CardSpace Removal Storage Tools] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Resolution CardSpace Removal Storage Tools] 'ImagePath' = 'C:\ykvikmok\nyglpcgqvcl.exe'
Creates the following services
- 'Resolution CardSpace Removal Storage Tools' C:\ykvikmok\nyglpcgqvcl.exe
Modifies file system
Creates the following files
- %WINDIR%\ykvikmok\zioon5cg
- C:\ykvikmok\zioon5cg
- C:\ykvikmok\hlnp5m1bmbzmxluhskzz.exe
- C:\ykvikmok\nyglpcgqvcl.exe
- C:\ykvikmok\ftvwxlt.exe
- C:\ykvikmok\etqjiov
Sets the 'hidden' attribute to the following files
- C:\ykvikmok\nyglpcgqvcl.exe
- C:\ykvikmok\ftvwxlt.exe
Deletes the following files
- %WINDIR%\ykvikmok\zioon5cg
- C:\ykvikmok\hlnp5m1bmbzmxluhskzz.exe
Substitutes the following files
- %WINDIR%\ykvikmok\zioon5cg
Network activity
TCP
HTTP GET requests
- http://fo####health.net/index.php
- http://me####health.net/index.php
- http://fo####clothes.net/index.php
- http://kn###health.net/index.php
- http://su####clothes.net/index.php
- http://wa###health.net/index.php
- http://wo###health.net/index.php
- http://pa####lothes.net/index.php
- http://fr###catch.net/index.php
- http://su###rdress.net/index.php
- http://wa###catch.net/index.php
UDP
- DNS ASK ge####manhealth.net
- DNS ASK kn###catch.net
- DNS ASK be###catch.net
- DNS ASK me###rdress.net
- DNS ASK fo###wdress.net
- DNS ASK me####public.net
- DNS ASK fo####public.net
- DNS ASK me####eearly.net
- DNS ASK fo####eearly.net
- DNS ASK me###rcatch.net
- DNS ASK fo###wcatch.net
- DNS ASK al####ydress.net
- DNS ASK al####ypublic.net
- DNS ASK kn###eearly.net
- DNS ASK ge####manpublic.net
- DNS ASK al####yeearly.net
- DNS ASK ge####maneearly.net
- DNS ASK al####ycatch.net
- DNS ASK ge####mancatch.net
- DNS ASK ex####encedress.net
- DNS ASK fr###dress.net
- DNS ASK ex#####ncepublic.net
- DNS ASK fr###public.net
- DNS ASK ex#####nceeearly.net
- DNS ASK ge####mandress.net
- DNS ASK wo###health.net
- DNS ASK be###public.net
- DNS ASK sm###public.net
- DNS ASK wo###public.net
- DNS ASK sm###eearly.net
- DNS ASK wo###eearly.net
- DNS ASK sm###catch.net
- DNS ASK wo###catch.net
- DNS ASK wa###dress.net
- DNS ASK th####tdress.net
- DNS ASK wa###public.net
- DNS ASK th####tpublic.net
- DNS ASK wa###eearly.net
- DNS ASK fr###eearly.net
- DNS ASK be###eearly.net
- DNS ASK th####tcatch.net
- DNS ASK cr###dress.net
- DNS ASK su###rdress.net
- DNS ASK cr###public.net
- DNS ASK su####public.net
- DNS ASK cr###eearly.net
- DNS ASK su####eearly.net
- DNS ASK cr###catch.net
- DNS ASK su###rcatch.net
- DNS ASK kn###dress.net
- DNS ASK be###dress.net
- DNS ASK wa###catch.net
- DNS ASK kn###public.net
- DNS ASK ex####encecatch.net
- DNS ASK fr###catch.net
- DNS ASK fi####istant.net
- DNS ASK fo####distant.net
- DNS ASK cr####eparate.net
- DNS ASK su####separate.net
- DNS ASK kn####istant.net
- DNS ASK be####istant.net
- DNS ASK kn####lothes.net
- DNS ASK be####lothes.net
- DNS ASK kn###health.net
- DNS ASK be###health.net
- DNS ASK kn####eparate.net
- DNS ASK be####eparate.net
- DNS ASK wo###dress.net
- DNS ASK cr###health.net
- DNS ASK me####clothes.net
- DNS ASK fo####clothes.net
- DNS ASK me####health.net
- DNS ASK fo####health.net
- DNS ASK me####separate.net
- DNS ASK fo####separate.net
- DNS ASK al####ydistant.net
- DNS ASK ge#####andistant.net
- DNS ASK al####yclothes.net
- DNS ASK ge#####anclothes.net
- DNS ASK al####yhealth.net
- DNS ASK me####distant.net
- DNS ASK th####teearly.net
- DNS ASK su####clothes.net
- DNS ASK cr####istant.net
- DNS ASK cr####lothes.net
- DNS ASK pa####istant.net
- DNS ASK fi####lothes.net
- DNS ASK pa####lothes.net
- DNS ASK fi###health.net
- DNS ASK pa###health.net
- DNS ASK fi####eparate.net
- DNS ASK pa####eparate.net
- DNS ASK sm####istant.net
- DNS ASK wo####istant.net
- DNS ASK sm####lothes.net
- DNS ASK su####distant.net
- DNS ASK wo####lothes.net
- DNS ASK su####health.net
- DNS ASK sm####eparate.net
- DNS ASK wo####eparate.net
- DNS ASK wa####istant.net
- DNS ASK th####tdistant.net
- DNS ASK wa####lothes.net
- DNS ASK th####tclothes.net
- DNS ASK wa###health.net
- DNS ASK th####thealth.net
- DNS ASK wa####eparate.net
- DNS ASK th####tseparate.net
- DNS ASK sm###health.net
- DNS ASK sm###dress.net
Miscellaneous
Creates and executes the following
- 'C:\ykvikmok\hlnp5m1bmbzmxluhskzz.exe'
- 'C:\ykvikmok\nyglpcgqvcl.exe'
- 'C:\ykvikmok\ftvwxlt.exe' "c:\ykvikmok\nyglpcgqvcl.exe"
