Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\PC System Detection Error Config] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\PC System Detection Error Config] 'ImagePath' = 'C:\maxvmmgidii\puvvhcmsnxt.exe'
Creates the following services
- 'PC System Detection Error Config' C:\maxvmmgidii\puvvhcmsnxt.exe
Modifies file system
Creates the following files
- %WINDIR%\maxvmmgidii\ssi1vwktyixu
- C:\maxvmmgidii\ssi1vwktyixu
- C:\maxvmmgidii\dgbctdxhajnoi2idow.exe
- C:\maxvmmgidii\puvvhcmsnxt.exe
- C:\maxvmmgidii\ilhyfyqxbnw.exe
Sets the 'hidden' attribute to the following files
- C:\maxvmmgidii\puvvhcmsnxt.exe
- C:\maxvmmgidii\ilhyfyqxbnw.exe
Deletes the following files
- %WINDIR%\maxvmmgidii\ssi1vwktyixu
- C:\maxvmmgidii\dgbctdxhajnoi2idow.exe
Substitutes the following files
- %WINDIR%\maxvmmgidii\ssi1vwktyixu
Network activity
Connects to
- 'jo####ywomen.net':80
- 'li###ewomen.net':80
- 'th###women.net':80
TCP
HTTP GET requests
- http://jo####ywomen.net/index.php
- http://li###ewomen.net/index.php
- http://th###women.net/index.php
UDP
- DNS ASK he###catch.net
- DNS ASK li####course.net
- DNS ASK de####ycourse.net
- DNS ASK li###epaint.net
- DNS ASK de####ypaint.net
- DNS ASK li###eclean.net
- DNS ASK de####yclean.net
- DNS ASK hu####dwomen.net
- DNS ASK de####ywomen.net
- DNS ASK jo####ywomen.net
- DNS ASK jo####ycourse.net
- DNS ASK hu####dpaint.net
- DNS ASK jo####ypaint.net
- DNS ASK hu####dclean.net
- DNS ASK jo####yclean.net
- DNS ASK re###ndress.net
- DNS ASK va####sdress.net
- DNS ASK hu####dcourse.net
- DNS ASK th###clean.net
- DNS ASK wi###npaint.net
- DNS ASK be###gclean.net
- DNS ASK su###rclean.net
- DNS ASK wi###nclean.net
- DNS ASK th###women.net
- DNS ASK ch###women.net
- DNS ASK th###course.net
- DNS ASK ch###course.net
- DNS ASK th###paint.net
- DNS ASK re####public.net
- DNS ASK ch###paint.net
- DNS ASK ch###clean.net
- DNS ASK be###gwomen.net
- DNS ASK ri###nwomen.net
- DNS ASK be####course.net
- DNS ASK ri####course.net
- DNS ASK be###gpaint.net
- DNS ASK ri###npaint.net
- DNS ASK li###ewomen.net
- DNS ASK ri###nclean.net
- DNS ASK va####spublic.net
- DNS ASK or###public.net
- DNS ASK re####ecatch.net
- DNS ASK or###catch.net
- DNS ASK ne####arydress.net
- DNS ASK pl####ntdress.net
- DNS ASK ne####arypublic.net
- DNS ASK pl####ntpublic.net
- DNS ASK ne####aryeearly.net
- DNS ASK or###eearly.net
- DNS ASK pl####nteearly.net
- DNS ASK pl####ntcatch.net
- DNS ASK he###dress.net
- DNS ASK di####ultdress.net
- DNS ASK he###public.net
- DNS ASK di####ultpublic.net
- DNS ASK he###eearly.net
- DNS ASK di####ulteearly.net
- DNS ASK ne####arycatch.net
- DNS ASK he####public.net
- DNS ASK va####seearly.net
- DNS ASK re####epublic.net
- DNS ASK re###ncatch.net
- DNS ASK va####scatch.net
- DNS ASK ge###edress.net
- DNS ASK ge####public.net
- DNS ASK ge####eearly.net
- DNS ASK ge###ecatch.net
- DNS ASK he###ndress.net
- DNS ASK re####eearly.net
- DNS ASK le###rdress.net
- DNS ASK le####public.net
- DNS ASK he####eearly.net
- DNS ASK le####eearly.net
- DNS ASK he###ncatch.net
- DNS ASK le###rcatch.net
- DNS ASK re####edress.net
- DNS ASK or###dress.net
- DNS ASK re####eeearly.net
- DNS ASK su###rpaint.net
Miscellaneous
Creates and executes the following
- 'C:\maxvmmgidii\dgbctdxhajnoi2idow.exe'
- 'C:\maxvmmgidii\puvvhcmsnxt.exe'
- 'C:\maxvmmgidii\ilhyfyqxbnw.exe' "c:\maxvmmgidii\puvvhcmsnxt.exe"
