Win32.HLLW.Autoruner1.34622

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Image Distributed NGEN Registry WinHTTP DHCP' = '<SYSTEM32>\lwpfipaeogre.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\lwpfipaeogre.exe

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Access Discovery Process] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Security Center

Creates and executes the following:

<SYSTEM32>\qqlitetndrm.exe "<SYSTEM32>\lwpfipaeogre.exe"
%WINDIR%\Temp\lfhpejpb4qb2ztvmc.exe -r 42522 tcp
%TEMP%\lfhpejpb4mx4ztvmhmkkw7.exe
<SYSTEM32>\lwpfipaeogre.exe

Modifies file system :

Creates the following files:

<SYSTEM32>\vzgblbrcnzwst\run
<SYSTEM32>\vzgblbrcnzwst\rng
<SYSTEM32>\vzgblbrcnzwst\cfg
<SYSTEM32>\vzgblbrcnzwst\por
%WINDIR%\Temp\lfhpejpb4qb2ztvmc.exe
%TEMP%\lfhpejpb4mx4ztvmhmkkw7.exe
<SYSTEM32>\vzgblbrcnzwst\tst
<SYSTEM32>\vzgblbrcnzwst\etc
<SYSTEM32>\qqlitetndrm.exe
<SYSTEM32>\lwpfipaeogre.exe

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\qqlitetndrm.exe
<SYSTEM32>\lwpfipaeogre.exe

Deletes the following files:

%WINDIR%\Temp\lfhpejpb4qb2ztvmc.exe
%TEMP%\lfhpejpb4mx4ztvmhmkkw7.exe
<DRIVERS>\etc\hosts

Substitutes the HOSTS file.

Network activity:

Connects to:

'fa###ear.net':80
'we###how.net':80
'to###ear.net':80
'to###ule.net':80
'fa###ule.net':80
've###how.net':80
've###ule.net':80
'we###ear.net':80
'we###ule.net':80
'we###unt.net':80
've###unt.net':80
'se###rule.net':80
'le###rule.net':80
'le###hunt.net':80
'le###show.net':80
'se###hunt.net':80
'se###hear.net':80
'to###unt.net':80
'fa###unt.net':80
'fa###how.net':80
'le###hear.net':80
'to###how.net':80
'ta###ule.net':80
'wa###ear.net':80
'wa###ule.net':80
'wa###unt.net':80
'ta###unt.net':80
'ta###ear.net':80
'yo###onday.net':80
'tr###feed.net':80
'tr###monday.net':80
'tr###under.net':80
'yo###nder.net':80
'pi###hunt.net':80
'mu###unt.net':80
'mu###how.net':80
've###ear.net':80
'pi###show.net':80
'pi###rule.net':80
'wa###how.net':80
'ta###how.net':80
'mu###ear.net':80
'mu###ule.net':80
'pi###hear.net':80
'se###show.net':80
'wa###ctober.net':80
'ta###ctober.net':80
'ta###hoe.net':80
'mu###uter.net':80
'wa###hoe.net':80
'wa###oon.net':80
'tr###show.net':80
'yo###how.net':80
'ta###uter.net':80
'ta###oon.net':80
'wa###uter.net':80
'go#####everytime.com':80
'pi###shoe.net':80
'ja###uter.com':80
'do####club-grup.com':80
'el#####arimagine.com':80
'mu###hoe.net':80
'mu###oon.net':80
'pi###outer.net':80
'pi###moon.net':80
'pi####ctober.net':80
'mu###ctober.net':80
'pl###show.net':80
'fi###how.net':80
'vi###ear.net':80
'vi###ule.net':80
'lr###hear.net':80
'pl###hunt.net':80
'pl###hear.net':80
'fi###ear.net':80
'fi###ule.net':80
'fi###unt.net':80
'pl###rule.net':80
'yo###ule.net':80
'tr###hear.net':80
'tr###rule.net':80
'tr###hunt.net':80
'yo###unt.net':80
'yo###ear.net':80
'vi###unt.net':80
'lr###rule.net':80
'lr###hunt.net':80
'lr###show.net':80
'vi###how.net':80

TCP:

HTTP GET requests:

fa###ear.net/forum/search.php?me#########################################
we###how.net/forum/search.php?me#########################################
to###ear.net/forum/search.php?me#########################################
to###ule.net/forum/search.php?me#########################################
fa###ule.net/forum/search.php?me#########################################
ve###how.net/forum/search.php?me#########################################
ve###ule.net/forum/search.php?me#########################################
we###ear.net/forum/search.php?me#########################################
we###ule.net/forum/search.php?me#########################################
we###unt.net/forum/search.php?me#########################################
ve###unt.net/forum/search.php?me#########################################
se###rule.net/forum/search.php?me#########################################
le###rule.net/forum/search.php?me#########################################
le###hunt.net/forum/search.php?me#########################################
le###show.net/forum/search.php?me#########################################
se###hunt.net/forum/search.php?me#########################################
se###hear.net/forum/search.php?me#########################################
to###unt.net/forum/search.php?me#########################################
fa###unt.net/forum/search.php?me#########################################
fa###how.net/forum/search.php?me#########################################
le###hear.net/forum/search.php?me#########################################
to###how.net/forum/search.php?me#########################################
ta###ule.net/forum/search.php?me#########################################
wa###ear.net/forum/search.php?me#########################################
wa###ule.net/forum/search.php?me#########################################
wa###unt.net/forum/search.php?me#########################################
ta###unt.net/forum/search.php?me#########################################
ta###ear.net/forum/search.php?me#########################################
yo###onday.net/forum/search.php?me#########################################
tr###feed.net/forum/search.php?me#########################################
tr###monday.net/forum/search.php?me#########################################
tr###under.net/forum/search.php?me#########################################
yo###nder.net/forum/search.php?me#########################################
pi###hunt.net/forum/search.php?me#########################################
mu###unt.net/forum/search.php?me#########################################
mu###how.net/forum/search.php?me#########################################
ve###ear.net/forum/search.php?me#########################################
pi###show.net/forum/search.php?me#########################################
pi###rule.net/forum/search.php?me#########################################
wa###how.net/forum/search.php?me#########################################
ta###how.net/forum/search.php?me#########################################
mu###ear.net/forum/search.php?me#########################################
mu###ule.net/forum/search.php?me#########################################
pi###hear.net/forum/search.php?me#########################################
se###show.net/forum/search.php?me#########################################
wa###ctober.net/forum/search.php?me#########################################
ta###ctober.net/forum/search.php?me#########################################
ta###hoe.net/forum/search.php?me#########################################
mu###uter.net/forum/search.php?me#########################################
wa###hoe.net/forum/search.php?me#########################################
wa###oon.net/forum/search.php?me#########################################
tr###show.net/forum/search.php?me#########################################
yo###how.net/forum/search.php?me#########################################
ta###uter.net/forum/search.php?me#########################################
ta###oon.net/forum/search.php?me#########################################
wa###uter.net/forum/search.php?me#########################################
go#####everytime.com/forum/search.php?me#########################################
pi###shoe.net/forum/search.php?me#########################################
ja###uter.com/forum/search.php?me#########################################
do####club-grup.com/forum/search.php?me#########################################
el#####arimagine.com/forum/search.php?me#########################################
mu###hoe.net/forum/search.php?me#########################################
mu###oon.net/forum/search.php?me#########################################
pi###outer.net/forum/search.php?me#########################################
pi###moon.net/forum/search.php?me#########################################
pi####ctober.net/forum/search.php?me#########################################
mu###ctober.net/forum/search.php?me#########################################
pl###show.net/forum/search.php?me#########################################
fi###how.net/forum/search.php?me#########################################
vi###ear.net/forum/search.php?me#########################################
vi###ule.net/forum/search.php?me#########################################
lr###hear.net/forum/search.php?me#########################################
pl###hunt.net/forum/search.php?me#########################################
pl###hear.net/forum/search.php?me#########################################
fi###ear.net/forum/search.php?me#########################################
fi###ule.net/forum/search.php?me#########################################
fi###unt.net/forum/search.php?me#########################################
pl###rule.net/forum/search.php?me#########################################
yo###ule.net/forum/search.php?me#########################################
tr###hear.net/forum/search.php?me#########################################
tr###rule.net/forum/search.php?me#########################################
tr###hunt.net/forum/search.php?me#########################################
yo###unt.net/forum/search.php?me#########################################
yo###ear.net/forum/search.php?me#########################################
vi###unt.net/forum/search.php?me#########################################
lr###rule.net/forum/search.php?me#########################################
lr###hunt.net/forum/search.php?me#########################################
lr###show.net/forum/search.php?me#########################################
vi###how.net/forum/search.php?me#########################################

UDP:

DNS ASK to###ear.net
DNS ASK fa###ear.net
DNS ASK fa###ule.net
DNS ASK fa###unt.net
DNS ASK to###ule.net
DNS ASK we###how.net
DNS ASK we###ule.net
DNS ASK ve###ule.net
DNS ASK ve###unt.net
DNS ASK ve###how.net
DNS ASK we###unt.net
DNS ASK le###hunt.net
DNS ASK se###rule.net
DNS ASK se###hunt.net
DNS ASK se###show.net
DNS ASK le###show.net
DNS ASK le###rule.net
DNS ASK fa###how.net
DNS ASK to###unt.net
DNS ASK to###how.net
DNS ASK se###hear.net
DNS ASK le###hear.net
DNS ASK we###ear.net
DNS ASK ta###ule.net
DNS ASK wa###ear.net
DNS ASK wa###ule.net
DNS ASK wa###unt.net
DNS ASK ta###unt.net
DNS ASK ta###ear.net
DNS ASK yo###onday.net
DNS ASK tr###feed.net
DNS ASK tr###monday.net
DNS ASK tr###under.net
DNS ASK yo###nder.net
DNS ASK pi###hunt.net
DNS ASK mu###unt.net
DNS ASK mu###how.net
DNS ASK ve###ear.net
DNS ASK pi###show.net
DNS ASK pi###rule.net
DNS ASK wa###how.net
DNS ASK ta###how.net
DNS ASK mu###ear.net
DNS ASK mu###ule.net
DNS ASK pi###hear.net
DNS ASK wa###ctober.net
DNS ASK ta###ctober.net
DNS ASK ta###hoe.net
DNS ASK mu###uter.net
DNS ASK wa###hoe.net
DNS ASK wa###oon.net
DNS ASK tr###show.net
DNS ASK yo###how.net
DNS ASK ta###uter.net
DNS ASK ta###oon.net
DNS ASK wa###uter.net
DNS ASK go#####everytime.com
DNS ASK pi###shoe.net
DNS ASK ja###uter.com
DNS ASK do####club-grup.com
DNS ASK el#####arimagine.com
DNS ASK mu###hoe.net
DNS ASK mu###oon.net
DNS ASK pi###outer.net
DNS ASK pi###moon.net
DNS ASK pi####ctober.net
DNS ASK mu###ctober.net
DNS ASK pl###show.net
DNS ASK fi###how.net
DNS ASK vi###ear.net
DNS ASK vi###ule.net
DNS ASK lr###hear.net
DNS ASK pl###hunt.net
DNS ASK pl###hear.net
DNS ASK fi###ear.net
DNS ASK fi###ule.net
DNS ASK fi###unt.net
DNS ASK pl###rule.net
DNS ASK yo###ule.net
DNS ASK tr###hear.net
DNS ASK tr###rule.net
DNS ASK tr###hunt.net
DNS ASK yo###unt.net
DNS ASK yo###ear.net
DNS ASK vi###unt.net
DNS ASK lr###rule.net
DNS ASK lr###hunt.net
DNS ASK lr###show.net
DNS ASK vi###how.net
'23#.#55.255.250':1900

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information