Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\51837178\upv.exe' %TEMP%\51837178\KNTUR
- '%TEMP%\51837178\upv.exe' kug=xjx
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /stext "%TEMP%\tmp1.tmp"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Modifies file system:
Creates the following files:
- %TEMP%\51837178\wsr.xl
- %TEMP%\51837178\xkg.bmp
- %TEMP%\51837178\umq.jpg
- %TEMP%\51837178\fkw.jpg
- %TEMP%\51837178\aaa.mp3
- %TEMP%\51837178\rwt.xl
- %TEMP%\51837178\lpd.bmp
- %TEMP%\51837178\ptq.icm
- %TEMP%\51837178\xrr.docx
- %TEMP%\51837178\etu.dat
- %TEMP%\51837178\rxe.bmp
- %TEMP%\51837178\sov.bmp
- %TEMP%\51837178\lkf.icm
- %TEMP%\51837178\gra.icm
- %TEMP%\51837178\pjx.ppt
- %TEMP%\51837178\KNTUR
- %TEMP%\51837178\tnr.txt
- %TEMP%\51837178\luj.dat
- %TEMP%\51837178\whb.ppt
- %TEMP%\51837178\iol.jpg
- %TEMP%\51837178\rkb.txt
- %TEMP%\51837178\ljl.txt
- %TEMP%\51837178\rca.ico
- %TEMP%\51837178\qhn.ppt
- %TEMP%\51837178\ubj.docx
- %TEMP%\51837178\mgs.dat
- %TEMP%\51837178\eas.mp4
- %TEMP%\51837178\wve.jpg
- %TEMP%\51837178\odc.xl
- %TEMP%\51837178\awk.icm
- %TEMP%\51837178\kug=xjx
- %TEMP%\51837178\atp.ppt
- %TEMP%\51837178\upv.exe
- %TEMP%\51837178\otv.bmp
- %TEMP%\51837178\bqv.ppt
- %TEMP%\51837178\rlc.mp4
- %TEMP%\51837178\rkn.mp3
- %TEMP%\51837178\pav.ico
- %TEMP%\51837178\glt.mp4
- %TEMP%\51837178\mpe.mp3
- %TEMP%\51837178\qbb.txt
- %TEMP%\51837178\hto.dat
- %TEMP%\51837178\kxw.txt
- %TEMP%\51837178\kkb.docx
- %TEMP%\51837178\uqp.ppt
- %TEMP%\51837178\uac.dat
- %TEMP%\51837178\ges.mp3
Sets the 'hidden' attribute to the following files:
- %TEMP%\51837178\rkn.mp3
- %TEMP%\51837178\rkb.txt
- %TEMP%\51837178\rlc.mp4
- %TEMP%\51837178\rxe.bmp
- %TEMP%\51837178\rwt.xl
- %TEMP%\51837178\rca.ico
- %TEMP%\51837178\pjx.ppt
- %TEMP%\51837178\pav.ico
- %TEMP%\51837178\ptq.icm
- %TEMP%\51837178\qhn.ppt
- %TEMP%\51837178\qbb.txt
- %TEMP%\51837178\sov.bmp
- %TEMP%\51837178\wsr.xl
- %TEMP%\51837178\whb.ppt
- %TEMP%\51837178\wve.jpg
- %TEMP%\51837178\xrr.docx
- %TEMP%\51837178\xkg.bmp
- %TEMP%\51837178\uqp.ppt
- %TEMP%\51837178\uac.dat
- %TEMP%\51837178\tnr.txt
- %TEMP%\51837178\ubj.docx
- %TEMP%\51837178\upv.exe
- %TEMP%\51837178\umq.jpg
- %TEMP%\51837178\ges.mp3
- %TEMP%\51837178\fkw.jpg
- %TEMP%\51837178\glt.mp4
- %TEMP%\51837178\hto.dat
- %TEMP%\51837178\gra.icm
- %TEMP%\51837178\etu.dat
- %TEMP%\51837178\atp.ppt
- %TEMP%\51837178\aaa.mp3
- %TEMP%\51837178\awk.icm
- %TEMP%\51837178\eas.mp4
- %TEMP%\51837178\bqv.ppt
- %TEMP%\51837178\iol.jpg
- %TEMP%\51837178\mgs.dat
- %TEMP%\51837178\luj.dat
- %TEMP%\51837178\mpe.mp3
- %TEMP%\51837178\otv.bmp
- %TEMP%\51837178\odc.xl
- %TEMP%\51837178\lpd.bmp
- %TEMP%\51837178\kug=xjx
- %TEMP%\51837178\kkb.docx
- %TEMP%\51837178\kxw.txt
- %TEMP%\51837178\lkf.icm
- %TEMP%\51837178\ljl.txt
Deletes the following files:
- %TEMP%\51837178\KNTUR
Network activity:
Connects to:
- 'sm##.#sychem.com':587
- 'bo#.####ismyipaddress.com':80
- 'wp#d':80
TCP:
HTTP GET requests:
- http://bo#.####ismyipaddress.com/
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK sm##.#sychem.com
- DNS ASK bo#.####ismyipaddress.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
