Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Peer Defender AutoConfig Link' = 'C:\l75xccmitl6u\r5twfzxyvjlt.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Framework Builder Program Virtual Interface] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Framework Builder Program Virtual Interface] 'ImagePath' = 'C:\l75xccmitl6u\r5twfzxyvjlt.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\l75xccmitl6u\vmpbqel
- C:\l75xccmitl6u\vmpbqel
- C:\l75xccmitl6u\qayzhfp31lqpfnmu3b0vs.exe
- C:\l75xccmitl6u\r5twfzxyvjlt.exe
- C:\l75xccmitl6u\hz2azvegetym.exe
- C:\l75xccmitl6u\zymqxuz9
Sets the 'hidden' attribute to the following files:
- C:\l75xccmitl6u\r5twfzxyvjlt.exe
- C:\l75xccmitl6u\hz2azvegetym.exe
Deletes the following files:
- %WINDIR%\l75xccmitl6u\vmpbqel
- C:\l75xccmitl6u\qayzhfp31lqpfnmu3b0vs.exe
Substitutes the following files:
- %WINDIR%\l75xccmitl6u\vmpbqel
Network activity:
Connects to:
- 'ma#####anfleurette.net':80
- 'ch######ecollingwood.net':80
- 'cl#####ndgabrielson.net':80
- 'ch#####negabrielson.net':80
- 'cl######dchristinsen.net':80
- 'ch######echristinsen.net':80
- 'se#####anstephenson.net':80
- 'ch#####nastephenson.net':80
- 'se######ncollingwood.net':80
- 'ch######acollingwood.net':80
- 'se#####angabrielson.net':80
- 'ch#####nagabrielson.net':80
- 'se######nchristinsen.net':80
- 'ch######achristinsen.net':80
- 'cl######dcollingwood.net':80
- 'la#####iajermaine.net':80
- 'la#####iamackenzie.net':80
- 'de#####stmackenzie.net':80
- 'la#####iawinthrop.net':80
- 'de#####stwinthrop.net':80
- 'la#####iafleurette.net':80
- 'de#####stfleurette.net':80
- 'pr#####lajermaine.net':80
- 'ma#####anjermaine.net':80
- 'pr#####lamackenzie.net':80
- 'ma#####anmackenzie.net':80
- 'pr#####lawinthrop.net':80
- 'ma#####anwinthrop.net':80
- 'pr#####lafleurette.net':80
- 'de#####stjermaine.net':80
- 'ch#####nestephenson.net':80
TCP:
HTTP GET requests:
- http://ma#####anfleurette.net/index.php
- http://ch######ecollingwood.net/index.php
- http://cl#####ndgabrielson.net/index.php
- http://ch#####negabrielson.net/index.php
- http://cl######dchristinsen.net/index.php
- http://ch######echristinsen.net/index.php
- http://se#####anstephenson.net/index.php
- http://ch#####nastephenson.net/index.php
- http://se######ncollingwood.net/index.php
- http://ch######acollingwood.net/index.php
- http://se#####angabrielson.net/index.php
- http://ch#####nagabrielson.net/index.php
- http://se######nchristinsen.net/index.php
- http://ch######achristinsen.net/index.php
- http://cl######dcollingwood.net/index.php
- http://la#####iajermaine.net/index.php
- http://la#####iamackenzie.net/index.php
- http://de#####stmackenzie.net/index.php
- http://la#####iawinthrop.net/index.php
- http://de#####stwinthrop.net/index.php
- http://la#####iafleurette.net/index.php
- http://de#####stfleurette.net/index.php
- http://pr#####lajermaine.net/index.php
- http://ma#####anjermaine.net/index.php
- http://pr#####lamackenzie.net/index.php
- http://ma#####anmackenzie.net/index.php
- http://pr#####lawinthrop.net/index.php
- http://ma#####anwinthrop.net/index.php
- http://pr#####lafleurette.net/index.php
- http://de#####stjermaine.net/index.php
- http://ch#####nestephenson.net/index.php
UDP:
- DNS ASK ma#####anfleurette.net
- DNS ASK cl######dcollingwood.net
- DNS ASK ch######ecollingwood.net
- DNS ASK cl#####ndgabrielson.net
- DNS ASK ch#####negabrielson.net
- DNS ASK cl######dchristinsen.net
- DNS ASK ch######echristinsen.net
- DNS ASK se#####anstephenson.net
- DNS ASK ch#####nastephenson.net
- DNS ASK se######ncollingwood.net
- DNS ASK ch######acollingwood.net
- DNS ASK se#####angabrielson.net
- DNS ASK ch#####nagabrielson.net
- DNS ASK se######nchristinsen.net
- DNS ASK ch######achristinsen.net
- DNS ASK la#####iajermaine.net
- DNS ASK de#####stjermaine.net
- DNS ASK la#####iamackenzie.net
- DNS ASK de#####stmackenzie.net
- DNS ASK la#####iawinthrop.net
- DNS ASK de#####stwinthrop.net
- DNS ASK la#####iafleurette.net
- DNS ASK de#####stfleurette.net
- DNS ASK pr#####lajermaine.net
- DNS ASK ma#####anjermaine.net
- DNS ASK pr#####lamackenzie.net
- DNS ASK ma#####anmackenzie.net
- DNS ASK pr#####lawinthrop.net
- DNS ASK ma#####anwinthrop.net
- DNS ASK pr#####lafleurette.net
- DNS ASK ch#####nestephenson.net
- DNS ASK cl#####ndstephenson.net
Miscellaneous:
Creates and executes the following:
- 'C:\l75xccmitl6u\qayzhfp31lqpfnmu3b0vs.exe'
- 'C:\l75xccmitl6u\r5twfzxyvjlt.exe'
- 'C:\l75xccmitl6u\hz2azvegetym.exe' "c:\l75xccmitl6u\r5twfzxyvjlt.exe"
