Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Level Computer AuthIP Port' = 'C:\pamiwulvynn\pcvvcamboxu.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinHTTP BranchCache Removal Defragmenter Parental] 'ImagePath' = 'C:\pamiwulvynn\pcvvcamboxu.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinHTTP BranchCache Removal Defragmenter Parental] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- C:\pamiwulvynn\pcvvcamboxu.exe
- C:\pamiwulvynn\wxiogxn.exe
- C:\pamiwulvynn\vrrtoqmzwh
- %WINDIR%\pamiwulvynn\kr1ioy
- C:\pamiwulvynn\kr1ioy
- C:\pamiwulvynn\lcrj2vb6wsxycggyd.exe
Sets the 'hidden' attribute to the following files:
- C:\pamiwulvynn\wxiogxn.exe
- C:\pamiwulvynn\pcvvcamboxu.exe
Deletes the following files:
- C:\pamiwulvynn\lcrj2vb6wsxycggyd.exe
- %WINDIR%\pamiwulvynn\kr1ioy
Substitutes the following files:
- %WINDIR%\pamiwulvynn\kr1ioy
Network activity:
Connects to:
- 'ra####always.net':80
- 'mo####galways.net':80
- 'ra###ranger.net':80
- 'mo####ganger.net':80
- 'ra####forest.net':80
- 'hi####ywheat.net':80
- 'st####eanger.net':80
- 'mo####gforest.net':80
- 'st####ewheat.net':80
- 'tw###eanger.net':80
- 'mi####always.net':80
- 'tw###ewheat.net':80
- 'mi###eanger.net':80
- 'tw####always.net':80
- 'ra###rwheat.net':80
- 'mo####gwheat.net':80
- 'mi####forest.net':80
- 'tw####forest.net':80
- 'hi####yanger.net':80
- 'we####rforest.net':80
- 'cl###wheat.net':80
- 'we####ralways.net':80
- 'am####forest.net':80
- 'cl###anger.net':80
- 'th###school.net':80
- 'pr####tschool.net':80
- 'cl###always.net':80
- 'cl###forest.net':80
- 'st####eforest.net':80
- 'hi####yforest.net':80
- 'st####ealways.net':80
- 'hi####yalways.net':80
- 'am###twheat.net':80
- 'we####ranger.net':80
- 'am####always.net':80
- 'we####rwheat.net':80
- 'am###tanger.net':80
- 'cl###circle.net':80
- 'th###wheat.net':80
- 'cl###afraid.net':80
- 'th###circle.net':80
- 'pr####twheat.net':80
- 'th###always.net':80
- 'pr####talways.net':80
- 'th###anger.net':80
- 'pr####tanger.net':80
- 'am####circle.net':80
- 'we####rcircle.net':80
- 'am####afraid.net':80
- 'we####rafraid.net':80
- 'th####easure.net':80
- 'cl###dinner.net':80
- 'th###afraid.net':80
- 'cl####easure.net':80
- 'th###dinner.net':80
- 'th###forest.net':80
- 'of###anger.net':80
- 'al###anger.net':80
- 'of###wheat.net':80
- 'al###wheat.net':80
- 'of###always.net':80
- 'al###forest.net':80
- 'mi###ewheat.net':80
- 'al###always.net':80
- 'of###forest.net':80
- 'co####ewheat.net':80
- 'ch###anger.net':80
- 'pr####tforest.net':80
- 'ch###wheat.net':80
- 'co####eanger.net':80
- 'ch###forest.net':80
- 'co####eforest.net':80
- 'ch###always.net':80
- 'co####ealways.net':80
TCP:
HTTP GET requests:
- http://ra####always.net/index.php
- http://mo####galways.net/index.php
- http://ra###ranger.net/index.php
- http://mo####ganger.net/index.php
- http://ra####forest.net/index.php
- http://hi####ywheat.net/index.php
- http://st####eanger.net/index.php
- http://mo####gforest.net/index.php
- http://st####ewheat.net/index.php
- http://tw###eanger.net/index.php
- http://mi####always.net/index.php
- http://tw###ewheat.net/index.php
- http://mi###eanger.net/index.php
- http://tw####always.net/index.php
- http://ra###rwheat.net/index.php
- http://mo####gwheat.net/index.php
- http://mi####forest.net/index.php
- http://tw####forest.net/index.php
- http://hi####yanger.net/index.php
- http://we####rforest.net/index.php
- http://cl###wheat.net/index.php
- http://we####ralways.net/index.php
- http://am####forest.net/index.php
- http://cl###anger.net/index.php
- http://th###school.net/index.php
- http://pr####tschool.net/index.php
- http://cl###always.net/index.php
- http://cl###forest.net/index.php
- http://st####eforest.net/index.php
- http://hi####yforest.net/index.php
- http://st####ealways.net/index.php
- http://hi####yalways.net/index.php
- http://am###twheat.net/index.php
- http://we####ranger.net/index.php
- http://am####always.net/index.php
- http://we####rwheat.net/index.php
- http://am###tanger.net/index.php
- http://cl###circle.net/index.php
- http://th###wheat.net/index.php
- http://cl###afraid.net/index.php
- http://th###circle.net/index.php
- http://pr####twheat.net/index.php
- http://th###always.net/index.php
- http://pr####talways.net/index.php
- http://th###anger.net/index.php
- http://pr####tanger.net/index.php
- http://am####circle.net/index.php
- http://we####rcircle.net/index.php
- http://am####afraid.net/index.php
- http://we####rafraid.net/index.php
- http://th####easure.net/index.php
- http://cl###dinner.net/index.php
- http://th###afraid.net/index.php
- http://cl####easure.net/index.php
- http://th###dinner.net/index.php
- http://th###forest.net/index.php
- http://of###anger.net/index.php
- http://al###anger.net/index.php
- http://of###wheat.net/index.php
- http://al###wheat.net/index.php
- http://of###always.net/index.php
- http://al###forest.net/index.php
- http://mi###ewheat.net/index.php
- http://al###always.net/index.php
- http://of###forest.net/index.php
- http://co####ewheat.net/index.php
- http://ch###anger.net/index.php
- http://pr####tforest.net/index.php
- http://ch###wheat.net/index.php
- http://co####eanger.net/index.php
- http://ch###forest.net/index.php
- http://co####eforest.net/index.php
- http://ch###always.net/index.php
- http://co####ealways.net/index.php
UDP:
- DNS ASK mo####galways.net
- DNS ASK ra####forest.net
- DNS ASK mo####ganger.net
- DNS ASK ra####always.net
- DNS ASK mo####gforest.net
- DNS ASK st####eanger.net
- DNS ASK hi####yanger.net
- DNS ASK st####ewheat.net
- DNS ASK hi####ywheat.net
- DNS ASK mi####always.net
- DNS ASK tw####always.net
- DNS ASK mi###eanger.net
- DNS ASK tw###eanger.net
- DNS ASK mi####forest.net
- DNS ASK mo####gwheat.net
- DNS ASK ra###ranger.net
- DNS ASK tw####forest.net
- DNS ASK ra###rwheat.net
- DNS ASK st####ealways.net
- DNS ASK cl###wheat.net
- DNS ASK cl###anger.net
- DNS ASK am####forest.net
- DNS ASK we####rforest.net
- DNS ASK cl###always.net
- DNS ASK pr####tschool.net
- DNS ASK th###while.net
- DNS ASK cl###forest.net
- DNS ASK th###school.net
- DNS ASK hi####yforest.net
- DNS ASK am###twheat.net
- DNS ASK hi####yalways.net
- DNS ASK st####eforest.net
- DNS ASK we####rwheat.net
- DNS ASK am####always.net
- DNS ASK we####ralways.net
- DNS ASK am###tanger.net
- DNS ASK we####ranger.net
- DNS ASK tw###ewheat.net
- DNS ASK cl###circle.net
- DNS ASK th###wheat.net
- DNS ASK cl###afraid.net
- DNS ASK th###circle.net
- DNS ASK pr####twheat.net
- DNS ASK th###always.net
- DNS ASK pr####talways.net
- DNS ASK th###anger.net
- DNS ASK pr####tanger.net
- DNS ASK am####circle.net
- DNS ASK we####rcircle.net
- DNS ASK am####afraid.net
- DNS ASK we####rafraid.net
- DNS ASK th####easure.net
- DNS ASK cl###dinner.net
- DNS ASK th###afraid.net
- DNS ASK cl####easure.net
- DNS ASK th###dinner.net
- DNS ASK th###forest.net
- DNS ASK of###anger.net
- DNS ASK al###anger.net
- DNS ASK of###wheat.net
- DNS ASK al###wheat.net
- DNS ASK of###always.net
- DNS ASK al###forest.net
- DNS ASK mi###ewheat.net
- DNS ASK al###always.net
- DNS ASK of###forest.net
- DNS ASK co####ewheat.net
- DNS ASK ch###anger.net
- DNS ASK pr####tforest.net
- DNS ASK ch###wheat.net
- DNS ASK co####eanger.net
- DNS ASK ch###forest.net
- DNS ASK co####eforest.net
- DNS ASK ch###always.net
- DNS ASK co####ealways.net
Miscellaneous:
Creates and executes the following:
- 'C:\pamiwulvynn\wxiogxn.exe' "c:\pamiwulvynn\pcvvcamboxu.exe"
- 'C:\pamiwulvynn\pcvvcamboxu.exe'
- 'C:\pamiwulvynn\lcrj2vb6wsxycggyd.exe'