Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Health Controls Font Interface' = '<SYSTEM32>\llwmtyri.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Services IP Windows Human Backup] 'ImagePath' = '<SYSTEM32>\llwmtyri.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Services IP Windows Human Backup] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\lxvujwso.exe' "<SYSTEM32>\llwmtyri.exe"
- '%WINDIR%\Temp\r5b3fq2qhkyuveu.exe' -r 25138 tcp
- '%TEMP%\r5b3fq2kqzyuveums4qeyy.exe'
- '<SYSTEM32>\llwmtyri.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\imgofkqjdvcma\run
- <SYSTEM32>\imgofkqjdvcma\rng
- %WINDIR%\Temp\r5b3fq2qhkyuveu.exe
- <SYSTEM32>\imgofkqjdvcma\cfg
- <SYSTEM32>\lxvujwso.exe
- %TEMP%\r5b3fq2kqzyuveums4qeyy.exe
- <SYSTEM32>\imgofkqjdvcma\tst
- <SYSTEM32>\llwmtyri.exe
- <SYSTEM32>\imgofkqjdvcma\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\lxvujwso.exe
- <SYSTEM32>\llwmtyri.exe
Deletes the following files:
- %WINDIR%\Temp\r5b3fq2qhkyuveu.exe
- <DRIVERS>\etc\hosts
- %TEMP%\r5b3fq2kqzyuveums4qeyy.exe
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'wr###taste.net':80
- 'ma###aste.net':80
- 'ro###ives.net':80
- 'ro###llow.net':80
- 'de###ives.net':80
- 'ma###llow.net':80
- 'wr###gives.net':80
- 'wr###allow.net':80
- 'wr###earth.net':80
- 'ma###arth.net':80
- 'jo###ives.net':80
- 'wi###ives.net':80
- 'wi###llow.net':80
- 'wi###arth.net':80
- 'jo###llow.net':80
- 'ro###arth.net':80
- 'de###llow.net':80
- 'de###arth.net':80
- 'de###aste.net':80
- 'ro###aste.net':80
- 'ma###ives.net':80
- 'mu###come.net':80
- 'ya###erve.net':80
- 'ya###ome.net':80
- 'ya###ook.net':80
- 'mu###took.net':80
- 'we###ook.net':80
- 'sp###took.net':80
- 'sp###weight.net':80
- 'mu###nerve.net':80
- 'we###eight.net':80
- 'ha###ook.net':80
- 'hu###come.net':80
- 'hu###took.net':80
- 'hu###weight.net':80
- 'ha###eight.net':80
- 'ya###eight.net':80
- 'mu###weight.net':80
- 'ha###erve.net':80
- 'ha###ome.net':80
- 'hu###nerve.net':80
- 'ya###llow.net':80
- 'mu###allow.net':80
- 'mu###earth.net':80
- 'mu###taste.net':80
- 'ya###arth.net':80
- 'sp###taste.net':80
- 'we###arth.net':80
- 'we###aste.net':80
- 'ya###ives.net':80
- 'mu###gives.net':80
- 'de###lxc.com':80
- 'ha###arth.net':80
- 'be##lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'ha###ives.net':80
- 'ya###aste.net':80
- 'hu###gives.net':80
- 'hu###allow.net':80
- 'ha###llow.net':80
- 'sp###earth.net':80
- 'se####bertaste.net':80
- 'se####berearth.net':80
- 'ha###aste.net':80
- 'fr###gives.net':80
- 'of###gives.net':80
- 'wi###aste.net':80
- 'jo###arth.net':80
- 'jo###aste.net':80
- 'se####berallow.net':80
- 'se####bergives.net':80
- 'sp###gives.net':80
- 'fr###taste.net':80
- 'we###ives.net':80
- 'we###llow.net':80
- 'sp###allow.net':80
- 'fr###allow.net':80
- 'of###allow.net':80
- 'of###earth.net':80
- 'of###taste.net':80
- 'fr###earth.net':80
TCP:
HTTP GET requests:
- http://wr###taste.net/index.php
- http://ma###aste.net/index.php
- http://ro###ives.net/index.php
- http://ro###llow.net/index.php
- http://de###ives.net/index.php
- http://ma###llow.net/index.php
- http://wr###gives.net/index.php
- http://wr###allow.net/index.php
- http://wr###earth.net/index.php
- http://ma###arth.net/index.php
- http://jo###ives.net/index.php
- http://wi###ives.net/index.php
- http://wi###llow.net/index.php
- http://wi###arth.net/index.php
- http://jo###llow.net/index.php
- http://ro###arth.net/index.php
- http://de###llow.net/index.php
- http://de###arth.net/index.php
- http://de###aste.net/index.php
- http://ro###aste.net/index.php
- http://ma###ives.net/index.php
- http://mu###come.net/index.php
- http://ya###erve.net/index.php
- http://ya###ome.net/index.php
- http://ya###ook.net/index.php
- http://mu###took.net/index.php
- http://we###ook.net/index.php
- http://sp###took.net/index.php
- http://sp###weight.net/index.php
- http://mu###nerve.net/index.php
- http://we###eight.net/index.php
- http://ha###ook.net/index.php
- http://hu###come.net/index.php
- http://hu###took.net/index.php
- http://hu###weight.net/index.php
- http://ha###eight.net/index.php
- http://ya###eight.net/index.php
- http://mu###weight.net/index.php
- http://ha###erve.net/index.php
- http://ha###ome.net/index.php
- http://hu###nerve.net/index.php
- http://ya###llow.net/index.php
- http://mu###allow.net/index.php
- http://mu###earth.net/index.php
- http://mu###taste.net/index.php
- http://ya###arth.net/index.php
- http://sp###taste.net/index.php
- http://we###arth.net/index.php
- http://we###aste.net/index.php
- http://ya###ives.net/index.php
- http://mu###gives.net/index.php
- http://de###lxc.com/index.php
- http://ha###arth.net/index.php
- http://be##lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://ha###ives.net/index.php
- http://ya###aste.net/index.php
- http://hu###gives.net/index.php
- http://hu###allow.net/index.php
- http://ha###llow.net/index.php
- http://sp###earth.net/index.php
- http://se####bertaste.net/index.php
- http://se####berearth.net/index.php
- http://ha###aste.net/index.php
- http://fr###gives.net/index.php
- http://of###gives.net/index.php
- http://wi###aste.net/index.php
- http://jo###arth.net/index.php
- http://jo###aste.net/index.php
- http://se####berallow.net/index.php
- http://se####bergives.net/index.php
- http://sp###gives.net/index.php
- http://fr###taste.net/index.php
- http://we###ives.net/index.php
- http://we###llow.net/index.php
- http://sp###allow.net/index.php
- http://fr###allow.net/index.php
- http://of###allow.net/index.php
- http://of###earth.net/index.php
- http://of###taste.net/index.php
- http://fr###earth.net/index.php
UDP:
- DNS ASK ma###aste.net
- DNS ASK wr###earth.net
- DNS ASK wr###taste.net
- DNS ASK de###ives.net
- DNS ASK ro###ives.net
- DNS ASK wr###gives.net
- DNS ASK ma###ives.net
- DNS ASK ma###llow.net
- DNS ASK ma###arth.net
- DNS ASK wr###allow.net
- DNS ASK ro###llow.net
- DNS ASK jo###ives.net
- DNS ASK wi###ives.net
- DNS ASK wi###llow.net
- DNS ASK wi###arth.net
- DNS ASK jo###llow.net
- DNS ASK ro###arth.net
- DNS ASK de###llow.net
- DNS ASK de###arth.net
- DNS ASK de###aste.net
- DNS ASK ro###aste.net
- DNS ASK ya###erve.net
- DNS ASK mu###nerve.net
- DNS ASK mu###come.net
- DNS ASK mu###took.net
- DNS ASK ya###ome.net
- DNS ASK sp###took.net
- DNS ASK we###ome.net
- DNS ASK we###ook.net
- DNS ASK we###eight.net
- DNS ASK sp###weight.net
- DNS ASK ya###ook.net
- DNS ASK ha###ook.net
- DNS ASK hu###come.net
- DNS ASK hu###took.net
- DNS ASK hu###weight.net
- DNS ASK ha###eight.net
- DNS ASK ya###eight.net
- DNS ASK mu###weight.net
- DNS ASK ha###erve.net
- DNS ASK ha###ome.net
- DNS ASK hu###nerve.net
- DNS ASK ya###llow.net
- DNS ASK mu###allow.net
- DNS ASK mu###earth.net
- DNS ASK mu###taste.net
- DNS ASK ya###arth.net
- DNS ASK sp###taste.net
- DNS ASK we###arth.net
- DNS ASK we###aste.net
- DNS ASK ya###ives.net
- DNS ASK mu###gives.net
- DNS ASK de###lxc.com
- DNS ASK ha###arth.net
- DNS ASK be##lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK ha###ives.net
- DNS ASK ya###aste.net
- DNS ASK hu###gives.net
- DNS ASK hu###allow.net
- DNS ASK ha###llow.net
- DNS ASK sp###earth.net
- DNS ASK se####bertaste.net
- DNS ASK se####berearth.net
- DNS ASK ha###aste.net
- DNS ASK fr###gives.net
- DNS ASK of###gives.net
- DNS ASK wi###aste.net
- DNS ASK jo###arth.net
- DNS ASK jo###aste.net
- DNS ASK se####berallow.net
- DNS ASK se####bergives.net
- DNS ASK sp###gives.net
- DNS ASK fr###taste.net
- DNS ASK we###ives.net
- DNS ASK we###llow.net
- DNS ASK sp###allow.net
- DNS ASK fr###allow.net
- DNS ASK of###allow.net
- DNS ASK of###earth.net
- DNS ASK of###taste.net
- DNS ASK fr###earth.net
- '23#.#55.255.250':1900
