Trojan.KillFiles.61109

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\INIT_PLUG.LNK

Substitutes the following executable system files:

<SYSTEM32>\msvbvm60.dll with <SYSTEM32>\~GLH000d.TMP

Malicious functions:

Executes the following:

'%TEMP%\GLJ2.tmp' <SYSTEM32>\comctl32.ocx
'%TEMP%\GLJ2.tmp' <SYSTEM32>\MSWINSCK.OCX
'%TEMP%\GLJ2.tmp' <SYSTEM32>\wsock32.dll
'%TEMP%\GLJ2.tmp' <SYSTEM32>\Msvbvm60.dll
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\CF_Install_AUTO.bat" "
'%TEMP%\RarSFX0\PluginPE+PI_5.2.52_OCX_CIEGO.EXE' /M="CORREOS_Plugin_PRO.CFG"
'C:\plugin_PE\taskkill.exe' /f /im VisualPlugin.exe

Modifies file system:

Creates the following files:

C:\plugin_PE\~GLH003e.TMP
C:\plugin_PE\~GLH003f.TMP
C:\plugin_PE\~GLH0040.TMP
C:\plugin_PE\~GLH003b.TMP
C:\plugin_PE\~GLH003c.TMP
C:\plugin_PE\~GLH003d.TMP
C:\plugin_PE\~GLH0041.TMP
C:\plugin_PE\data\AllUsers\~GLH0045.TMP
C:\plugin_PE\data\AllUsers\~GLH0046.TMP
C:\plugin_PE\data\AllUsers\~GLH0047.TMP
C:\plugin_PE\~GLH0042.TMP
C:\plugin_PE\~GLH0043.TMP
C:\plugin_PE\data\AllUsers\~GLH0044.TMP
C:\plugin_PE\~GLH003a.TMP
C:\plugin_PE\data\~GLH0030.TMP
C:\plugin_PE\data\~GLH0031.TMP
C:\plugin_PE\~GLH0032.TMP
C:\plugin_PE\data\~GLH002d.TMP
C:\plugin_PE\data\~GLH002e.TMP
C:\plugin_PE\data\~GLH002f.TMP
C:\plugin_PE\~GLH0033.TMP
C:\plugin_PE\~GLH0037.TMP
C:\plugin_PE\~GLH0038.TMP
C:\plugin_PE\~GLH0039.TMP
C:\plugin_PE\~GLH0034.TMP
C:\plugin_PE\~GLH0035.TMP
C:\plugin_PE\~GLH0036.TMP
C:\plugin_PE\data\AllUsers\~GLH0048.TMP
C:\plugin_PE\~GLH005a.TMP
C:\plugin_PE\~GLH005b.TMP
C:\plugin_PE\~GLH005c.TMP
C:\plugin_PE\data\VisualTX\DEFAULT_TEMPLATE\~GLH0057.TMP
C:\plugin_PE\data\VisualTX\DEFAULT_TEMPLATE\~GLH0058.TMP
C:\plugin_PE\data\VisualTX\DEFAULT_TEMPLATE\~GLH0059.TMP
C:\plugin_PE\~GLH005d.TMP
C:\plugin_PE\~GLH0061.TMP
C:\plugin_PE\data\~GLH0062.TMP
C:\plugin_PE\~GLH0063.TMP
C:\plugin_PE\~GLH005e.TMP
C:\plugin_PE\~GLH005f.TMP
C:\plugin_PE\~GLH0060.TMP
C:\plugin_PE\data\VisualTX\INS_TAXFREE\~GLH0056.TMP
C:\plugin_PE\~GLH004c.TMP
C:\plugin_PE\~GLH004d.TMP
C:\plugin_PE\~GLH004e.TMP
C:\plugin_PE\data\AllUsers\~GLH0049.TMP
C:\plugin_PE\data\AllUsers\~GLH004a.TMP
C:\plugin_PE\~GLH004b.TMP
C:\plugin_PE\~GLH004f.TMP
C:\plugin_PE\~GLH0053.TMP
C:\plugin_PE\data\VisualTX\INS_TAXFREE\~GLH0054.TMP
C:\plugin_PE\data\VisualTX\INS_TAXFREE\~GLH0055.TMP
C:\plugin_PE\~GLH0050.TMP
C:\plugin_PE\~GLH0051.TMP
C:\plugin_PE\~GLH0052.TMP
C:\plugin_PE\data\Visual\DEFAULT_TEMPLATE\~GLH0005.TMP
C:\plugin_PE\data\Visual\DEFAULT_TEMPLATE\~GLH0006.TMP
C:\plugin_PE\data\Visual\DEFAULT_TEMPLATE\~GLH0007.TMP
C:\plugin_PE\data\Visual\CORREOS\~GLH0002.TMP
C:\plugin_PE\data\Visual\CORREOS\~GLH0003.TMP
C:\plugin_PE\data\Visual\CORREOS\~GLH0004.TMP
C:\plugin_PE\data\Visual\DEFAULT_TEMPLATE\~GLH0008.TMP
C:\plugin_PE\~GLH000c.TMP
C:\plugin_PE\~GLBS383.TMP
<SYSTEM32>\~GLH000d.TMP
C:\plugin_PE\~GLH0009.TMP
C:\plugin_PE\~GLH000a.TMP
C:\plugin_PE\~GLH000b.TMP
C:\plugin_PE\~GLH0001.TMP
%TEMP%\RarSFX0\CORREOS_Citrix_Common.exe
%TEMP%\RarSFX0\CORREOS_CF_AutoConfig.bat
%TEMP%\RarSFX0\GetCODIRED.bat
%TEMP%\RarSFX0\CORREOS_VP_Customizacion.exe
%TEMP%\RarSFX0\getip.bat
%TEMP%\RarSFX0\Oficinas.txt
%TEMP%\RarSFX0\INIT_PLUG.bat
%TEMP%\RarSFX0\CF_Install_AUTO.BAT
%TEMP%\RarSFX0\CORREOS_CF_InitScript.bat
%TEMP%\RarSFX0\CORREOS_Citrix_Data.exe
%TEMP%\RarSFX0\PluginPE+PI_5.2.52_OCX_CIEGO.EXE
%TEMP%\RarSFX0\CORREOS_Plugin_PRO.CFG
%TEMP%\RarSFX0\CORREOS_VisualPlugin_Citrix.CFG
<SYSTEM32>\~GLH000e.TMP
C:\plugin_PE\data\~GLH0023.TMP
C:\plugin_PE\data\~GLH0024.TMP
C:\plugin_PE\data\~GLH0025.TMP
C:\plugin_PE\data\~GLH0020.TMP
C:\plugin_PE\data\~GLH0021.TMP
C:\plugin_PE\data\~GLH0022.TMP
C:\plugin_PE\data\~GLH0026.TMP
C:\plugin_PE\data\~GLH002a.TMP
C:\plugin_PE\data\~GLH002b.TMP
C:\plugin_PE\data\~GLH002c.TMP
C:\plugin_PE\data\~GLH0027.TMP
C:\plugin_PE\data\~GLH0028.TMP
C:\plugin_PE\data\~GLH0029.TMP
C:\plugin_PE\data\~GLH001f.TMP
<SYSTEM32>\~GLH0012.TMP
<SYSTEM32>\~GLH0014.TMP
<SYSTEM32>\~GLH0016.TMP
<SYSTEM32>\~GLH000f.TMP
<SYSTEM32>\temp.000
<SYSTEM32>\~GLH0011.TMP
C:\plugin_PE\~GLH0018.TMP
C:\plugin_PE\data\~GLH001c.TMP
C:\plugin_PE\data\~GLH001d.TMP
C:\plugin_PE\data\~GLH001e.TMP
C:\plugin_PE\~GLH0019.TMP
C:\plugin_PE\~GLH001a.TMP
C:\plugin_PE\~GLH001b.TMP

Sets the 'hidden' attribute to the following files:

C:\plugin_PE\cf.clv

Deletes the following files:

C:\plugin_PE\CFPE_Off.dll
<SYSTEM32>\~GLH0016.TMP
C:\plugin_PE\Weta.ocx
C:\plugin_PE\data\ConfigTaxFree.xml
<SYSTEM32>\~GLH0014.TMP
<SYSTEM32>\msvbvm60.dll
C:\plugin_PE\unwise.ini
<SYSTEM32>\~GLH0012.TMP
<SYSTEM32>\~GLH000f.TMP

Moves the following files:

from C:\plugin_PE\~GLH0042.TMP to C:\plugin_PE\Weta.ocx
from C:\plugin_PE\~GLH0043.TMP to C:\plugin_PE\cf.clv
from C:\plugin_PE\~GLH0041.TMP to C:\plugin_PE\CFPEWeta.dll
from C:\plugin_PE\~GLH003f.TMP to C:\plugin_PE\PUPEmv.dll
from C:\plugin_PE\~GLH0040.TMP to C:\plugin_PE\CriptoFlow.dll
from C:\plugin_PE\data\AllUsers\~GLH0044.TMP to C:\plugin_PE\data\AllUsers\TAPPLPI.TXT
from C:\plugin_PE\data\AllUsers\~GLH0048.TMP to C:\plugin_PE\data\AllUsers\TPARAEMV.txt
from C:\plugin_PE\data\AllUsers\~GLH0049.TMP to C:\plugin_PE\data\AllUsers\TAIDC.txt
from C:\plugin_PE\data\AllUsers\~GLH0047.TMP to C:\plugin_PE\data\AllUsers\TCLAVEMV.txt
from C:\plugin_PE\data\AllUsers\~GLH0045.TMP to C:\plugin_PE\data\AllUsers\TTERM.txt
from C:\plugin_PE\data\AllUsers\~GLH0046.TMP to C:\plugin_PE\data\AllUsers\TAID.txt
from C:\plugin_PE\~GLH003e.TMP to C:\plugin_PE\PDFTlkt.dll
from C:\plugin_PE\~GLH0035.TMP to C:\plugin_PE\CFPFDSrv.dll
from C:\plugin_PE\~GLH0036.TMP to C:\plugin_PE\CFMsgSvr.dll
from C:\plugin_PE\~GLH0034.TMP to C:\plugin_PE\CFP_Emv.dll
from C:\plugin_PE\~GLH0032.TMP to C:\plugin_PE\CFPWL_01.dll
from C:\plugin_PE\~GLH0033.TMP to C:\plugin_PE\CFPMifare_01.dll
from C:\plugin_PE\~GLH0037.TMP to C:\plugin_PE\CFP_Audi.dll
from C:\plugin_PE\~GLH003b.TMP to C:\plugin_PE\CFP_Prox.dll
from C:\plugin_PE\~GLH003d.TMP to C:\plugin_PE\cximagecrt.dll
from C:\plugin_PE\~GLH003a.TMP to C:\plugin_PE\CFP_Dev.dll
from C:\plugin_PE\~GLH0038.TMP to C:\plugin_PE\CFP_Comm.dll
from C:\plugin_PE\~GLH0039.TMP to C:\plugin_PE\CFP_Data.dll
from C:\plugin_PE\data\AllUsers\~GLH004a.TMP to C:\plugin_PE\data\AllUsers\TPARAEMVC.txt
from C:\plugin_PE\~GLH005a.TMP to C:\plugin_PE\CFPTX_ADM.exe
from C:\plugin_PE\~GLH005b.TMP to C:\plugin_PE\CFPTAXFR.dll
from C:\plugin_PE\data\VisualTX\DEFAULT_TEMPLATE\~GLH0059.TMP to C:\plugin_PE\data\VisualTX\DEFAULT_TEMPLATE\logo.gif
from C:\plugin_PE\data\VisualTX\DEFAULT_TEMPLATE\~GLH0057.TMP to C:\plugin_PE\data\VisualTX\DEFAULT_TEMPLATE\VisualTX.ini
from C:\plugin_PE\data\VisualTX\DEFAULT_TEMPLATE\~GLH0058.TMP to C:\plugin_PE\data\VisualTX\DEFAULT_TEMPLATE\fondo.jpg
from C:\plugin_PE\~GLH005c.TMP to C:\plugin_PE\CFPTX01.ocx
from C:\plugin_PE\~GLH0060.TMP to C:\plugin_PE\AxInterop.MSWinsockLib.dll
from C:\plugin_PE\~GLH0061.TMP to C:\plugin_PE\Interop.MSWinsockLib.dll
from C:\plugin_PE\~GLH005f.TMP to C:\plugin_PE\Interop.CFPTXOCXLib.dll
from C:\plugin_PE\~GLH005d.TMP to C:\plugin_PE\VisualPluginTX.exe
from C:\plugin_PE\~GLH005e.TMP to C:\plugin_PE\AxInterop.CFPTXOCXLib.dll
from C:\plugin_PE\data\VisualTX\INS_TAXFREE\~GLH0056.TMP to C:\plugin_PE\data\VisualTX\INS_TAXFREE\logo.gif
from C:\plugin_PE\~GLH004e.TMP to C:\plugin_PE\CFPG_Updater.exe
from C:\plugin_PE\~GLH004f.TMP to C:\plugin_PE\VisualPlugin.exe
from C:\plugin_PE\~GLH004d.TMP to C:\plugin_PE\CFFirmUpdater.exe
from C:\plugin_PE\~GLH004b.TMP to C:\plugin_PE\CFPEJava.dll
from C:\plugin_PE\~GLH004c.TMP to C:\plugin_PE\CFPEJAVA.jar
from C:\plugin_PE\~GLH0050.TMP to C:\plugin_PE\VPConfig.exe
from C:\plugin_PE\data\VisualTX\INS_TAXFREE\~GLH0054.TMP to C:\plugin_PE\data\VisualTX\INS_TAXFREE\VisualTX.ini
from C:\plugin_PE\data\VisualTX\INS_TAXFREE\~GLH0055.TMP to C:\plugin_PE\data\VisualTX\INS_TAXFREE\fondo.jpg
from C:\plugin_PE\~GLH0053.TMP to C:\plugin_PE\VisualPluginBK.exe
from C:\plugin_PE\~GLH0051.TMP to C:\plugin_PE\VisualTicket.exe
from C:\plugin_PE\~GLH0052.TMP to C:\plugin_PE\OperDoc.exe
from <SYSTEM32>\temp.000 to <SYSTEM32>\~GLH0013.TMP
from <SYSTEM32>\~GLH0013.TMP to <SYSTEM32>\richtx32.ocx
from <SYSTEM32>\~GLH0010.TMP to <SYSTEM32>\MSWINSCK.OCX
from <SYSTEM32>\~GLH000e.TMP to <SYSTEM32>\comctl32.ocx
from <SYSTEM32>\temp.000 to <SYSTEM32>\~GLH0010.TMP
from <SYSTEM32>\temp.000 to <SYSTEM32>\~GLH0015.TMP
from C:\plugin_PE\~GLH0018.TMP to C:\plugin_PE\CFPG_ADM.exe
from C:\plugin_PE\~GLH0019.TMP to C:\plugin_PE\CFPlugin_TversionModify.exe
from <SYSTEM32>\~GLH0017.TMP to <SYSTEM32>\MSCOMCT2.OCX
from <SYSTEM32>\~GLH0015.TMP to <SYSTEM32>\MSCOMCTL.OCX
from <SYSTEM32>\temp.000 to <SYSTEM32>\~GLH0017.TMP
from C:\plugin_PE\~GLH000c.TMP to C:\plugin_PE\unwise.ini
from C:\plugin_PE\data\Visual\CORREOS\~GLH0004.TMP to C:\plugin_PE\data\Visual\CORREOS\botonera.jpg
from C:\plugin_PE\data\Visual\DEFAULT_TEMPLATE\~GLH0005.TMP to C:\plugin_PE\data\Visual\DEFAULT_TEMPLATE\VisualPG.ini
from C:\plugin_PE\data\Visual\CORREOS\~GLH0003.TMP to C:\plugin_PE\data\Visual\CORREOS\fondo.jpg
from C:\plugin_PE\~GLH0001.TMP to C:\plugin_PE\taskkill.exe
from C:\plugin_PE\data\Visual\CORREOS\~GLH0002.TMP to C:\plugin_PE\data\Visual\CORREOS\VisualPG.ini
from C:\plugin_PE\data\Visual\DEFAULT_TEMPLATE\~GLH0006.TMP to C:\plugin_PE\data\Visual\DEFAULT_TEMPLATE\fondo.jpg
from C:\plugin_PE\~GLH000a.TMP to C:\plugin_PE\CFPG_ADM_STOP.exe
from C:\plugin_PE\~GLH000b.TMP to C:\plugin_PE\unwise.exe
from C:\plugin_PE\~GLH0009.TMP to C:\plugin_PE\uninstall_CFPG_ADM.EXE
from C:\plugin_PE\data\Visual\DEFAULT_TEMPLATE\~GLH0007.TMP to C:\plugin_PE\data\Visual\DEFAULT_TEMPLATE\botonera.jpg
from C:\plugin_PE\data\Visual\DEFAULT_TEMPLATE\~GLH0008.TMP to C:\plugin_PE\data\Visual\DEFAULT_TEMPLATE\logo.gif
from C:\plugin_PE\~GLH001a.TMP to C:\plugin_PE\INIT_PLUG.bat
from C:\plugin_PE\data\~GLH002a.TMP to C:\plugin_PE\data\voucher_ca.xml
from C:\plugin_PE\data\~GLH002b.TMP to C:\plugin_PE\data\voucher_es.xml
from C:\plugin_PE\data\~GLH0029.TMP to C:\plugin_PE\data\ticket_pt.xml
from C:\plugin_PE\data\~GLH0027.TMP to C:\plugin_PE\data\ticket_eu.xml
from C:\plugin_PE\data\~GLH0028.TMP to C:\plugin_PE\data\ticket_gl.xml
from C:\plugin_PE\data\~GLH002c.TMP to C:\plugin_PE\data\voucher_es_ca.xml
from C:\plugin_PE\data\~GLH0030.TMP to C:\plugin_PE\data\voucher_gl.xml
from C:\plugin_PE\data\~GLH0031.TMP to C:\plugin_PE\data\voucher_pt.xml
from C:\plugin_PE\data\~GLH002f.TMP to C:\plugin_PE\data\voucher_eu.xml
from C:\plugin_PE\data\~GLH002d.TMP to C:\plugin_PE\data\voucher_es_eu.xml
from C:\plugin_PE\data\~GLH002e.TMP to C:\plugin_PE\data\voucher_es_gl.xml
from C:\plugin_PE\data\~GLH0026.TMP to C:\plugin_PE\data\ticket_es_gl.xml
from C:\plugin_PE\data\~GLH001e.TMP to C:\plugin_PE\data\msgpi.ini
from C:\plugin_PE\data\~GLH001f.TMP to C:\plugin_PE\data\pinpad.ini
from C:\plugin_PE\data\~GLH001d.TMP to C:\plugin_PE\data\msgwt.ini
from C:\plugin_PE\~GLH001b.TMP to C:\plugin_PE\CFPE_Off.dll
from C:\plugin_PE\data\~GLH001c.TMP to C:\plugin_PE\data\msgpe.ini
from C:\plugin_PE\data\~GLH0020.TMP to C:\plugin_PE\data\ConfigTaxFree.xml
from C:\plugin_PE\data\~GLH0024.TMP to C:\plugin_PE\data\ticket_es_ca.xml
from C:\plugin_PE\data\~GLH0025.TMP to C:\plugin_PE\data\ticket_es_eu.xml
from C:\plugin_PE\data\~GLH0023.TMP to C:\plugin_PE\data\ticket_es.xml
from C:\plugin_PE\data\~GLH0021.TMP to C:\plugin_PE\data\ticketdcc_es.xml
from C:\plugin_PE\data\~GLH0022.TMP to C:\plugin_PE\data\ticket_ca.xml

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней