Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\uig\usd.exe %TEMP%\uig\jvl-pml'
Malicious functions:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
- '%ProgramFiles%\%LocalAppData%\temp\uig\usd.exe' %ProgramFiles%\%LocalAppData%\temp\uig\RNADK
- '%ProgramFiles%\%LocalAppData%\temp\uig\usd.exe' jvl-pml
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Modifies file system:
Creates the following files:
- %ProgramFiles%\%LocalAppData%\temp\uig\tfu.dat
- %ProgramFiles%\%LocalAppData%\temp\uig\vvf.txt
- %ProgramFiles%\%LocalAppData%\temp\uig\ada.dat
- %ProgramFiles%\%LocalAppData%\temp\uig\xeo.jpg
- %ProgramFiles%\%LocalAppData%\temp\uig\ujl.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\var.docx
- %ProgramFiles%\%LocalAppData%\temp\uig\cbi.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\kqd.ppt
- %ProgramFiles%\%LocalAppData%\temp\uig\emw.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\jmx.ppt
- %ProgramFiles%\%LocalAppData%\temp\uig\hha.ico
- %ProgramFiles%\%LocalAppData%\temp\uig\nqj.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\arj.bmp
- %ProgramFiles%\%LocalAppData%\temp\uig\ubc.mp4
- %ProgramFiles%\%LocalAppData%\temp\uig\sse.txt
- %ProgramFiles%\%LocalAppData%\temp\uig\RNADK
- %ProgramFiles%\%LocalAppData%\temp\uig\nke.pdf
- %ProgramFiles%\%LocalAppData%\temp\uig\gqk.docx
- %ProgramFiles%\%LocalAppData%\temp\uig\dfb.docx
- %ProgramFiles%\%LocalAppData%\temp\uig\bgp.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\hvh.mp4
- %ProgramFiles%\%LocalAppData%\temp\uig\rje.ppt
- %ProgramFiles%\%LocalAppData%\temp\uig\qbj.bmp
- %ProgramFiles%\%LocalAppData%\temp\uig\wjd.bmp
- %ProgramFiles%\%LocalAppData%\temp\uig\ohj.jpg
- %ProgramFiles%\%LocalAppData%\temp\uig\jnh.mp3
- %ProgramFiles%\%LocalAppData%\temp\uig\lug.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\npp.ppt
- %ProgramFiles%\%LocalAppData%\temp\uig\umx.jpg
- %ProgramFiles%\%LocalAppData%\temp\uig\vqi.txt
- %ProgramFiles%\%LocalAppData%\temp\uig\usd.exe
- %ProgramFiles%\%LocalAppData%\temp\uig\jvl-pml
- %ProgramFiles%\%LocalAppData%\temp\uig\aqx.ico
- %ProgramFiles%\%LocalAppData%\temp\uig\pgn.ico
- %ProgramFiles%\%LocalAppData%\temp\uig\uoh.mp3
- %ProgramFiles%\%LocalAppData%\temp\uig\ehv.dat
- %ProgramFiles%\%LocalAppData%\temp\uig\uqb.mp3
- %ProgramFiles%\%LocalAppData%\temp\uig\bth.dat
- %ProgramFiles%\%LocalAppData%\temp\uig\ojf.txt
- %ProgramFiles%\%LocalAppData%\temp\uig\ajl.mp4
- %ProgramFiles%\%LocalAppData%\temp\uig\hlv.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\hcc.bmp
- %ProgramFiles%\%LocalAppData%\temp\uig\qlr.icm
- %ProgramFiles%\%LocalAppData%\temp\uig\bkx.dat
- %ProgramFiles%\%LocalAppData%\temp\uig\cju.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\gfn.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\oqp.pdf
- %ProgramFiles%\%LocalAppData%\temp\uig\job.txt
Sets the 'hidden' attribute to the following files:
- %ProgramFiles%\%LocalAppData%\temp\uig\qbj.bmp
- %ProgramFiles%\%LocalAppData%\temp\uig\pgn.ico
- %ProgramFiles%\%LocalAppData%\temp\uig\qlr.icm
- %ProgramFiles%\%LocalAppData%\temp\uig\sse.txt
- %ProgramFiles%\%LocalAppData%\temp\uig\rje.ppt
- %ProgramFiles%\%LocalAppData%\temp\uig\oqp.pdf
- %ProgramFiles%\%LocalAppData%\temp\uig\npp.ppt
- %ProgramFiles%\%LocalAppData%\temp\uig\nke.pdf
- %ProgramFiles%\%LocalAppData%\temp\uig\nqj.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\ojf.txt
- %ProgramFiles%\%LocalAppData%\temp\uig\ohj.jpg
- %ProgramFiles%\%LocalAppData%\temp\uig\tfu.dat
- %ProgramFiles%\%LocalAppData%\temp\uig\vqi.txt
- %ProgramFiles%\%LocalAppData%\temp\uig\var.docx
- %ProgramFiles%\%LocalAppData%\temp\uig\vvf.txt
- %ProgramFiles%\%LocalAppData%\temp\uig\xeo.jpg
- %ProgramFiles%\%LocalAppData%\temp\uig\wjd.bmp
- %ProgramFiles%\%LocalAppData%\temp\uig\usd.exe
- %ProgramFiles%\%LocalAppData%\temp\uig\ujl.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\ubc.mp4
- %ProgramFiles%\%LocalAppData%\temp\uig\umx.jpg
- %ProgramFiles%\%LocalAppData%\temp\uig\uqb.mp3
- %ProgramFiles%\%LocalAppData%\temp\uig\uoh.mp3
- %ProgramFiles%\%LocalAppData%\temp\uig\lug.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\cbi.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\bth.dat
- %ProgramFiles%\%LocalAppData%\temp\uig\cju.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\ehv.dat
- %ProgramFiles%\%LocalAppData%\temp\uig\dfb.docx
- %ProgramFiles%\%LocalAppData%\temp\uig\bkx.dat
- %ProgramFiles%\%LocalAppData%\temp\uig\ajl.mp4
- %ProgramFiles%\%LocalAppData%\temp\uig\ada.dat
- %ProgramFiles%\%LocalAppData%\temp\uig\aqx.ico
- %ProgramFiles%\%LocalAppData%\temp\uig\bgp.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\arj.bmp
- %ProgramFiles%\%LocalAppData%\temp\uig\emw.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\jnh.mp3
- %ProgramFiles%\%LocalAppData%\temp\uig\jmx.ppt
- %ProgramFiles%\%LocalAppData%\temp\uig\job.txt
- %ProgramFiles%\%LocalAppData%\temp\uig\kqd.ppt
- %ProgramFiles%\%LocalAppData%\temp\uig\jvl-pml
- %ProgramFiles%\%LocalAppData%\temp\uig\hvh.mp4
- %ProgramFiles%\%LocalAppData%\temp\uig\gqk.docx
- %ProgramFiles%\%LocalAppData%\temp\uig\gfn.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\hcc.bmp
- %ProgramFiles%\%LocalAppData%\temp\uig\hlv.xl
- %ProgramFiles%\%LocalAppData%\temp\uig\hha.ico
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
