Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'LAN Service' = '%ProgramFiles%\LAN Service\lansv.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\32131083\fof.exe %TEMP%\32131083\uau=qil'
Malicious functions:
Injects code into
the following user processes:
- RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\32131083\dba.bmp
- %TEMP%\32131083\qub.mp4
- %TEMP%\32131083\kjt.xl
- %TEMP%\32131083\dtc.dat
- %TEMP%\32131083\req.bmp
- %TEMP%\32131083\lfu.dat
- %TEMP%\32131083\ekp.ico
- %TEMP%\32131083\rot.jpg
- %TEMP%\32131083\rni.dat
- %TEMP%\32131083\ndo.jpg
- %TEMP%\32131083\vme.bmp
- %TEMP%\32131083\dag.bmp
- %TEMP%\32131083\cuf.docx
- %TEMP%\32131083\mfo.ppt
- %TEMP%\32131083\hwt.ico
- %ProgramFiles%\LAN Service\lansv.exe
- %APPDATA%\23EF5514-3059-436F-A4A7-4CEFAAB20EB1\run.dat
- %TEMP%\32131083\SSVKC
- %TEMP%\32131083\ram.ico
- %TEMP%\32131083\ljx.ppt
- %TEMP%\32131083\bng.jpg
- %TEMP%\32131083\gqq.icm
- %TEMP%\32131083\srs.mp4
- %TEMP%\32131083\dwj.bmp
- %TEMP%\32131083\glr.mp4
- %TEMP%\32131083\chl.pdf
- %TEMP%\32131083\kjp.mp4
- %TEMP%\32131083\vcu.mp4
- %TEMP%\32131083\xfw.bmp
- %TEMP%\32131083\guf.bmp
- %TEMP%\32131083\dci.txt
- %TEMP%\32131083\fof.exe
- %TEMP%\32131083\uau=qil
- %TEMP%\32131083\btn.xl
- %TEMP%\32131083\fqk.txt
- %TEMP%\32131083\srx.bmp
- %TEMP%\32131083\fkw.mp3
- %TEMP%\32131083\ijf.bmp
- %TEMP%\32131083\cpe.icm
- %TEMP%\32131083\bui.txt
- %TEMP%\32131083\hiq.mp4
- %TEMP%\32131083\qik.pdf
- %TEMP%\32131083\wbg.mp4
- %TEMP%\32131083\lqv.bmp
- %TEMP%\32131083\fvg.docx
- %TEMP%\32131083\roo.docx
- %TEMP%\32131083\gni.mp3
- %TEMP%\32131083\tbp.bmp
- %TEMP%\32131083\wie.mp3
Sets the 'hidden' attribute to the following files:
- %TEMP%\32131083\qik.pdf
- %TEMP%\32131083\ndo.jpg
- %TEMP%\32131083\qub.mp4
- %TEMP%\32131083\req.bmp
- %TEMP%\32131083\ram.ico
- %TEMP%\32131083\mfo.ppt
- %TEMP%\32131083\kjt.xl
- %TEMP%\32131083\kjp.mp4
- %TEMP%\32131083\lfu.dat
- %TEMP%\32131083\lqv.bmp
- %TEMP%\32131083\ljx.ppt
- %TEMP%\32131083\rni.dat
- %TEMP%\32131083\vme.bmp
- %TEMP%\32131083\vcu.mp4
- %TEMP%\32131083\wbg.mp4
- %TEMP%\32131083\xfw.bmp
- %TEMP%\32131083\wie.mp3
- %TEMP%\32131083\uau=qil
- %TEMP%\32131083\rot.jpg
- %TEMP%\32131083\roo.docx
- %TEMP%\32131083\srs.mp4
- %TEMP%\32131083\tbp.bmp
- %TEMP%\32131083\srx.bmp
- %TEMP%\32131083\dba.bmp
- %TEMP%\32131083\dag.bmp
- %TEMP%\32131083\dci.txt
- %TEMP%\32131083\dwj.bmp
- %TEMP%\32131083\dtc.dat
- %TEMP%\32131083\cuf.docx
- %TEMP%\32131083\btn.xl
- %TEMP%\32131083\bng.jpg
- %TEMP%\32131083\bui.txt
- %TEMP%\32131083\cpe.icm
- %TEMP%\32131083\chl.pdf
- %TEMP%\32131083\ekp.ico
- %TEMP%\32131083\guf.bmp
- %TEMP%\32131083\gqq.icm
- %TEMP%\32131083\hiq.mp4
- %TEMP%\32131083\ijf.bmp
- %TEMP%\32131083\hwt.ico
- %TEMP%\32131083\gni.mp3
- %TEMP%\32131083\fof.exe
- %TEMP%\32131083\fkw.mp3
- %TEMP%\32131083\fqk.txt
- %TEMP%\32131083\glr.mp4
- %TEMP%\32131083\fvg.docx
Deletes the following files:
- %TEMP%\32131083\SSVKC
Network activity:
Connects to:
- 'be#####olas.hopto.org':55420
UDP:
- DNS ASK be#####olas.hopto.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\RegSvcs.exe'
- '%TEMP%\32131083\fof.exe' %TEMP%\32131083\SSVKC
- '%TEMP%\32131083\fof.exe' uau=qil
