Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%HOMEPATH%\My Documents\whost.exe,%HOMEPATH%\My Documents\AlUD0SaRwSSx\whost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicroUpdate' = '%HOMEPATH%\My Documents\AlUD0SaRwSSx\whost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%HOMEPATH%\My Documents\whost.exe,%HOMEPATH%\My Documents\AlUD0SaRwSSx\whost.exe,%HOMEPATH%\...
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicroUpdate' = '%HOMEPATH%\My Documents\AlUD0SaRwSSx\AlUD0SaRwSSx\whost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'microsoft-temp.exe' = '%APPDATA%\<File name>.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'microsoft-temp.exe' = '<Full path to file>'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%HOMEPATH%\My Documents\whost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicroUpdate' = '%HOMEPATH%\My Documents\whost.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Security Center
blocks the following features:
- User Account Control (UAC)
Creates and executes the following:
- '%HOMEPATH%\My Documents\AlUD0SaRwSSx\whost.exe'
- '%HOMEPATH%\My Documents\AlUD0SaRwSSx\AlUD0SaRwSSx\whost.exe'
- '%APPDATA%\<File name>.exe'
- '%HOMEPATH%\My Documents\whost.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /k attrib "%WINDIR%\Microsoft.NET\Framework\v4.0.30319" +s +h
- '<SYSTEM32>\attrib.exe' "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe" +s +h
- '<SYSTEM32>\attrib.exe' "%WINDIR%\Microsoft.NET\Framework\v4.0.30319" +s +h
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe'
- '<SYSTEM32>\cmd.exe' /k attrib "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe" +s +h
- '<SYSTEM32>\notepad.exe'
Injects code into
the following system processes:
- <SYSTEM32>\notepad.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe
the following user processes:
- vbc.exe
Modifies file system:
Creates the following files:
- %TEMP%\aut2B.tmp
- %TEMP%\aut2C.tmp
- %TEMP%\aut29.tmp
- %TEMP%\aut2A.tmp
- %TEMP%\aut2F.tmp
- %TEMP%\aut30.tmp
- %TEMP%\aut2D.tmp
- %TEMP%\aut2E.tmp
- %TEMP%\aut28.tmp
- %TEMP%\aut22.tmp
- %TEMP%\aut23.tmp
- %TEMP%\aut20.tmp
- %TEMP%\aut21.tmp
- %TEMP%\aut26.tmp
- %TEMP%\aut27.tmp
- %TEMP%\aut24.tmp
- %TEMP%\aut25.tmp
- %TEMP%\aut31.tmp
- %TEMP%\aut3D.tmp
- %TEMP%\aut3E.tmp
- %TEMP%\aut3B.tmp
- %TEMP%\aut3C.tmp
- %TEMP%\aut41.tmp
- %TEMP%\aut42.tmp
- %TEMP%\aut3F.tmp
- %TEMP%\aut40.tmp
- %TEMP%\aut3A.tmp
- %TEMP%\aut34.tmp
- %TEMP%\aut35.tmp
- %TEMP%\aut32.tmp
- %TEMP%\aut33.tmp
- %TEMP%\aut38.tmp
- %TEMP%\aut39.tmp
- %TEMP%\aut36.tmp
- %TEMP%\aut37.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut9.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut7.tmp
- %TEMP%\autC.tmp
- %TEMP%\autD.tmp
- %TEMP%\autA.tmp
- %TEMP%\autB.tmp
- %HOMEPATH%\My Documents\AlUD0SaRwSSx\whost.exe
- %APPDATA%\<File name>.exe
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\1.resource
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- %HOMEPATH%\My Documents\whost.exe
- %TEMP%\aut3.tmp
- %TEMP%\autE.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut1B.tmp
- %TEMP%\aut18.tmp
- %TEMP%\aut19.tmp
- %TEMP%\aut1D.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut1C.tmp
- %HOMEPATH%\My Documents\AlUD0SaRwSSx\AlUD0SaRwSSx\whost.exe
- %TEMP%\aut17.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut12.tmp
- %TEMP%\autF.tmp
- %TEMP%\aut10.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut14.tmp
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\My Documents\AlUD0SaRwSSx\AlUD0SaRwSSx\whost.exe
- %HOMEPATH%\My Documents\AlUD0SaRwSSx\whost.exe
- %HOMEPATH%\My Documents\whost.exe
Deletes the following files:
- %TEMP%\aut2C.tmp
- %TEMP%\aut2D.tmp
- %TEMP%\aut2A.tmp
- %TEMP%\aut2B.tmp
- %TEMP%\aut30.tmp
- %TEMP%\aut31.tmp
- %TEMP%\aut2E.tmp
- %TEMP%\aut2F.tmp
- %TEMP%\aut24.tmp
- %TEMP%\aut25.tmp
- %TEMP%\aut22.tmp
- %TEMP%\aut23.tmp
- %TEMP%\aut28.tmp
- %TEMP%\aut29.tmp
- %TEMP%\aut26.tmp
- %TEMP%\aut27.tmp
- %TEMP%\aut32.tmp
- %TEMP%\aut3D.tmp
- %TEMP%\aut3E.tmp
- %TEMP%\aut3B.tmp
- %TEMP%\aut3C.tmp
- %TEMP%\aut41.tmp
- %TEMP%\aut42.tmp
- %TEMP%\aut3F.tmp
- %TEMP%\aut40.tmp
- %TEMP%\aut35.tmp
- %TEMP%\aut36.tmp
- %TEMP%\aut33.tmp
- %TEMP%\aut34.tmp
- %TEMP%\aut39.tmp
- %TEMP%\aut3A.tmp
- %TEMP%\aut37.tmp
- %TEMP%\aut38.tmp
- %TEMP%\aut21.tmp
- %TEMP%\autA.tmp
- %TEMP%\autB.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut9.tmp
- %TEMP%\autE.tmp
- %TEMP%\autF.tmp
- %TEMP%\autC.tmp
- %TEMP%\autD.tmp
- %TEMP%\aut3.tmp
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut10.tmp
- %TEMP%\aut1B.tmp
- %TEMP%\aut1C.tmp
- %TEMP%\aut19.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\aut20.tmp
- %TEMP%\aut1D.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut18.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut16.tmp
Network activity:
Connects to:
- 'el#####mez.duckdns.org':1604
- 'localhost':1604
UDP:
- DNS ASK el#####mez.duckdns.org
Miscellaneous:
Searches for the following windows:
- ClassName: '#32770' WindowName: '%HOMEPATH%\My Documents\whost.exe'
- ClassName: '#32770' WindowName: '%HOMEPATH%\My Documents\AlUD0SaRwSSx\whost.exe'
- ClassName: '#32770' WindowName: '%HOMEPATH%\My Documents\AlUD0SaRwSSx\AlUD0SaRwSSx\whost.exe'
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '#32770' WindowName: 'AngarCl'
- ClassName: '#32770' WindowName: ''
