Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\51686289\smb.exe %TEMP%\51686289\ihp=neo'
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\51686289\kwt.docx
- %TEMP%\51686289\xhk.jpg
- %TEMP%\51686289\plg.mp4
- %TEMP%\51686289\ech.pdf
- %TEMP%\51686289\vkt.mp3
- %TEMP%\51686289\udq.icm
- %TEMP%\51686289\gbs.jpg
- %TEMP%\51686289\hvp.mp3
- %TEMP%\51686289\kxv.xl
- %TEMP%\51686289\pub.icm
- %TEMP%\51686289\aqg.mp3
- %TEMP%\51686289\kqj.xl
- %TEMP%\51686289\wtg.txt
- %TEMP%\51686289\ogx.icm
- %TEMP%\51686289\hdo.bmp
- %APPDATA%\23EF5514-3059-436F-A4A7-4CEFAAB20EB1\run.dat
- %TEMP%\51686289\XGVQO
- %TEMP%\51686289\sqt.mp4
- %TEMP%\51686289\qxr.mp4
- %TEMP%\51686289\jbr.bmp
- %TEMP%\51686289\hgi.txt
- %TEMP%\51686289\vac.bmp
- %TEMP%\51686289\snc.mp4
- %TEMP%\51686289\rfm.mp3
- %TEMP%\51686289\nfw.txt
- %TEMP%\51686289\jag.txt
- %TEMP%\51686289\lkg.mp4
- %TEMP%\51686289\rvr.pdf
- %TEMP%\51686289\mwq.ppt
- %TEMP%\51686289\nxo.dat
- %TEMP%\51686289\smb.exe
- %TEMP%\51686289\ihp=neo
- %TEMP%\51686289\iuv.jpg
- %TEMP%\51686289\esm.jpg
- %TEMP%\51686289\ndn.bmp
- %TEMP%\51686289\nvk.icm
- %TEMP%\51686289\rtt.mp3
- %TEMP%\51686289\wwa.mp3
- %TEMP%\51686289\cqm.jpg
- %TEMP%\51686289\gqu.jpg
- %TEMP%\51686289\khg.txt
- %TEMP%\51686289\pmu.mp4
- %TEMP%\51686289\hau.bmp
- %TEMP%\51686289\iql.docx
- %TEMP%\51686289\ugg.jpg
- %TEMP%\51686289\fri.mp3
- %TEMP%\51686289\tqm.mp3
- %TEMP%\51686289\nti.bmp
Sets the 'hidden' attribute to the following files:
- %TEMP%\51686289\pub.icm
- %TEMP%\51686289\pmu.mp4
- %TEMP%\51686289\qxr.mp4
- %TEMP%\51686289\rtt.mp3
- %TEMP%\51686289\rfm.mp3
- %TEMP%\51686289\plg.mp4
- %TEMP%\51686289\nti.bmp
- %TEMP%\51686289\nfw.txt
- %TEMP%\51686289\nvk.icm
- %TEMP%\51686289\ogx.icm
- %TEMP%\51686289\nxo.dat
- %TEMP%\51686289\rvr.pdf
- %TEMP%\51686289\vkt.mp3
- %TEMP%\51686289\vac.bmp
- %TEMP%\51686289\wtg.txt
- %TEMP%\51686289\xhk.jpg
- %TEMP%\51686289\wwa.mp3
- %TEMP%\51686289\ugg.jpg
- %TEMP%\51686289\snc.mp4
- %TEMP%\51686289\smb.exe
- %TEMP%\51686289\sqt.mp4
- %TEMP%\51686289\udq.icm
- %TEMP%\51686289\tqm.mp3
- %TEMP%\51686289\hau.bmp
- %TEMP%\51686289\gqu.jpg
- %TEMP%\51686289\hdo.bmp
- %TEMP%\51686289\hvp.mp3
- %TEMP%\51686289\hgi.txt
- %TEMP%\51686289\gbs.jpg
- %TEMP%\51686289\cqm.jpg
- %TEMP%\51686289\aqg.mp3
- %TEMP%\51686289\ech.pdf
- %TEMP%\51686289\fri.mp3
- %TEMP%\51686289\esm.jpg
- %TEMP%\51686289\ihp=neo
- %TEMP%\51686289\kxv.xl
- %TEMP%\51686289\kwt.docx
- %TEMP%\51686289\lkg.mp4
- %TEMP%\51686289\ndn.bmp
- %TEMP%\51686289\mwq.ppt
- %TEMP%\51686289\kqj.xl
- %TEMP%\51686289\iuv.jpg
- %TEMP%\51686289\iql.docx
- %TEMP%\51686289\jag.txt
- %TEMP%\51686289\khg.txt
- %TEMP%\51686289\jbr.bmp
Deletes the following files:
- %TEMP%\51686289\XGVQO
Network activity:
Connects to:
- 'ta#####4769.ddns.net':4769
UDP:
- DNS ASK ta#####4769.ddns.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\51686289\smb.exe' %TEMP%\51686289\XGVQO
- '%TEMP%\51686289\smb.exe' ihp=neo
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
