Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Themes WMI Copy Management Scheduler' = 'C:\dscp2cdcf\wulwlthxz.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Routing Encrypting TP Wired Modules] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Routing Encrypting TP Wired Modules] 'ImagePath' = 'C:\dscp2cdcf\wulwlthxz.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\dscp2cdcf\qqofhyznv
- C:\dscp2cdcf\qqofhyznv
- C:\dscp2cdcf\mtcody2ostjjuumyggqoh.exe
- C:\dscp2cdcf\wulwlthxz.exe
- C:\dscp2cdcf\n5ubw08zarg4p.exe
- C:\dscp2cdcf\yl2oiskm
Sets the 'hidden' attribute to the following files:
- C:\dscp2cdcf\wulwlthxz.exe
- C:\dscp2cdcf\n5ubw08zarg4p.exe
Deletes the following files:
- %WINDIR%\dscp2cdcf\qqofhyznv
- C:\dscp2cdcf\mtcody2ostjjuumyggqoh.exe
Substitutes the following files:
- %WINDIR%\dscp2cdcf\qqofhyznv
Network activity:
Connects to:
- 'ro#####ltmillhouse.net':80
- 'co#####errupertson.net':80
- 'ra#####lerupertson.net':80
- 'co#####ercarpenter.net':80
- 'ra#####lecarpenter.net':80
- 'co#####errowbottom.net':80
- 'ra#####lerowbottom.net':80
- 'co#####usgranville.net':80
- 'ma#####negranville.net':80
- 'co#####usrupertson.net':80
- 'ma#####nerupertson.net':80
- 'co#####uscarpenter.net':80
- 'ma#####necarpenter.net':80
- 'qu#####lacotterill.net':80
- 'co#####usrowbottom.net':80
- 'ch#####asgranville.net':80
- 'sh#####negranville.net':80
- 'ch#####asrupertson.net':80
- 'sh#####nerupertson.net':80
- 'ch#####ascarpenter.net':80
- 'sh#####necarpenter.net':80
- 'ch#####asrowbottom.net':80
- 'sh#####nerowbottom.net':80
- 'ka#####negranville.net':80
- 'co#####negranville.net':80
- 'ka#####nerupertson.net':80
- 'co#####nerupertson.net':80
- 'co#####ergranville.net':80
- 'ra#####legranville.net':80
- 'se#####errowbottom.net':80
- 'tr#####anrowbottom.net':80
- 'se#####ercarpenter.net':80
- 'ro#####ltlongstaff.net':80
- 'ra#####felongstaff.net':80
- 'ro#####lttittensor.net':80
- 'ra#####fetittensor.net':80
- 'ro#####ltcotterill.net':80
- 'ra#####fecotterill.net':80
- 'ma#####nemillhouse.net':80
- 'qu#####lamillhouse.net':80
- 'ma#####nelongstaff.net':80
- 'qu#####lalongstaff.net':80
- 'ma#####netittensor.net':80
- 'qu#####latittensor.net':80
- 'ka#####necarpenter.net':80
- 'ma#####nerowbottom.net':80
- 'ma#####necotterill.net':80
- 'se#####nagranville.net':80
- 'jo#####nerupertson.net':80
- 'se#####narupertson.net':80
- 'jo#####necarpenter.net':80
- 'se#####nacarpenter.net':80
- 'jo#####nerowbottom.net':80
- 'se#####narowbottom.net':80
- 'tr#####angranville.net':80
- 'se#####ergranville.net':80
- 'tr#####anrupertson.net':80
- 'se#####errupertson.net':80
- 'tr#####ancarpenter.net':80
- 'ra#####femillhouse.net':80
- 'jo#####negranville.net':80
- 'co#####necarpenter.net':80
TCP:
HTTP GET requests:
- http://ro#####ltmillhouse.net/index.php
- http://co#####errupertson.net/index.php
- http://ra#####lerupertson.net/index.php
- http://co#####ercarpenter.net/index.php
- http://ra#####lecarpenter.net/index.php
- http://co#####errowbottom.net/index.php
- http://ra#####lerowbottom.net/index.php
- http://co#####usgranville.net/index.php
- http://ma#####negranville.net/index.php
- http://co#####usrupertson.net/index.php
- http://ma#####nerupertson.net/index.php
- http://co#####uscarpenter.net/index.php
- http://ma#####necarpenter.net/index.php
- http://qu#####lacotterill.net/index.php
- http://co#####usrowbottom.net/index.php
- http://ch#####asgranville.net/index.php
- http://sh#####negranville.net/index.php
- http://ch#####asrupertson.net/index.php
- http://sh#####nerupertson.net/index.php
- http://ch#####ascarpenter.net/index.php
- http://sh#####necarpenter.net/index.php
- http://ch#####asrowbottom.net/index.php
- http://sh#####nerowbottom.net/index.php
- http://ka#####negranville.net/index.php
- http://co#####negranville.net/index.php
- http://ka#####nerupertson.net/index.php
- http://co#####nerupertson.net/index.php
- http://co#####ergranville.net/index.php
- http://ra#####legranville.net/index.php
- http://se#####errowbottom.net/index.php
- http://tr#####anrowbottom.net/index.php
- http://se#####ercarpenter.net/index.php
- http://ro#####ltlongstaff.net/index.php
- http://ra#####felongstaff.net/index.php
- http://ro#####lttittensor.net/index.php
- http://ra#####fetittensor.net/index.php
- http://ro#####ltcotterill.net/index.php
- http://ra#####fecotterill.net/index.php
- http://ma#####nemillhouse.net/index.php
- http://qu#####lamillhouse.net/index.php
- http://ma#####nelongstaff.net/index.php
- http://qu#####lalongstaff.net/index.php
- http://ma#####netittensor.net/index.php
- http://qu#####latittensor.net/index.php
- http://ka#####necarpenter.net/index.php
- http://ma#####nerowbottom.net/index.php
- http://ma#####necotterill.net/index.php
- http://se#####nagranville.net/index.php
- http://jo#####nerupertson.net/index.php
- http://se#####narupertson.net/index.php
- http://jo#####necarpenter.net/index.php
- http://se#####nacarpenter.net/index.php
- http://jo#####nerowbottom.net/index.php
- http://se#####narowbottom.net/index.php
- http://tr#####angranville.net/index.php
- http://se#####ergranville.net/index.php
- http://tr#####anrupertson.net/index.php
- http://se#####errupertson.net/index.php
- http://tr#####ancarpenter.net/index.php
- http://ra#####femillhouse.net/index.php
- http://jo#####negranville.net/index.php
- http://co#####necarpenter.net/index.php
UDP:
- DNS ASK ro#####ltmillhouse.net
- DNS ASK ra#####legranville.net
- DNS ASK co#####errupertson.net
- DNS ASK ra#####lerupertson.net
- DNS ASK co#####ercarpenter.net
- DNS ASK ra#####lecarpenter.net
- DNS ASK co#####errowbottom.net
- DNS ASK ra#####lerowbottom.net
- DNS ASK co#####usgranville.net
- DNS ASK ma#####negranville.net
- DNS ASK co#####usrupertson.net
- DNS ASK ma#####nerupertson.net
- DNS ASK co#####uscarpenter.net
- DNS ASK ma#####necarpenter.net
- DNS ASK ma#####nerowbottom.net
- DNS ASK co#####necarpenter.net
- DNS ASK ch#####asgranville.net
- DNS ASK sh#####negranville.net
- DNS ASK ch#####asrupertson.net
- DNS ASK sh#####nerupertson.net
- DNS ASK ch#####ascarpenter.net
- DNS ASK sh#####necarpenter.net
- DNS ASK ch#####asrowbottom.net
- DNS ASK sh#####nerowbottom.net
- DNS ASK ka#####negranville.net
- DNS ASK co#####negranville.net
- DNS ASK ka#####nerupertson.net
- DNS ASK co#####nerupertson.net
- DNS ASK ka#####necarpenter.net
- DNS ASK co#####ergranville.net
- DNS ASK co#####usrowbottom.net
- DNS ASK se#####errowbottom.net
- DNS ASK ma#####necotterill.net
- DNS ASK ra#####femillhouse.net
- DNS ASK ro#####ltlongstaff.net
- DNS ASK ra#####felongstaff.net
- DNS ASK ro#####lttittensor.net
- DNS ASK ra#####fetittensor.net
- DNS ASK ro#####ltcotterill.net
- DNS ASK ra#####fecotterill.net
- DNS ASK ma#####nemillhouse.net
- DNS ASK qu#####lamillhouse.net
- DNS ASK ma#####nelongstaff.net
- DNS ASK qu#####lalongstaff.net
- DNS ASK ma#####netittensor.net
- DNS ASK qu#####latittensor.net
- DNS ASK qu#####lacotterill.net
- DNS ASK se#####ercarpenter.net
- DNS ASK jo#####negranville.net
- DNS ASK se#####nagranville.net
- DNS ASK jo#####nerupertson.net
- DNS ASK se#####narupertson.net
- DNS ASK jo#####necarpenter.net
- DNS ASK se#####nacarpenter.net
- DNS ASK jo#####nerowbottom.net
- DNS ASK se#####narowbottom.net
- DNS ASK tr#####angranville.net
- DNS ASK se#####ergranville.net
- DNS ASK tr#####anrupertson.net
- DNS ASK se#####errupertson.net
- DNS ASK tr#####ancarpenter.net
- DNS ASK tr#####anrowbottom.net
- DNS ASK ka#####nerowbottom.net
Miscellaneous:
Creates and executes the following:
- 'C:\dscp2cdcf\mtcody2ostjjuumyggqoh.exe'
- 'C:\dscp2cdcf\wulwlthxz.exe'
- 'C:\dscp2cdcf\n5ubw08zarg4p.exe' "c:\dscp2cdcf\wulwlthxz.exe"
