Trojan.DownLoader26.3502

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Infects the following executable files:

C:\Far2\Far.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Modifies file system:

Creates the following files:

<Current directory>\CiYU.ico
<Current directory>\VgsY.exe
C:\RCX3B.tmp
<Current directory>\ZqMY.ico
<Current directory>\JEsm.exe
C:\RCX3D.tmp
<Current directory>\Tcos.ico
<Current directory>\AEoI.exe
C:\RCX3C.tmp
<Current directory>\JOYQ.ico
C:\RCX3A.tmp
<Current directory>\KkIW.exe
C:\RCX38.tmp
<Current directory>\rwAE.ico
<Current directory>\acIa.exe
C:\RCX37.tmp
<Current directory>\MwMI.ico
<Current directory>\tQMs.exe
C:\RCX39.tmp
<Current directory>\AGsM.ico
<Current directory>\vwMi.exe
<Current directory>\ngsS.exe
<Current directory>\wgkW.exe
C:\RCX43.tmp
<Current directory>\NAwU.ico
<Current directory>\GIoW.exe
C:\RCX42.tmp
<Current directory>\GGoI.ico
<Current directory>\IIca.exe
C:\RCX44.tmp
<Current directory>\gQAE.ico
<Current directory>\fkwY.exe
<Current directory>\Ewck.ico
C:\RCX3F.tmp
<Current directory>\wecw.ico
<Current directory>\Lskk.exe
C:\RCX3E.tmp
<Current directory>\PWww.ico
<Current directory>\EEgM.exe
C:\RCX41.tmp
<Current directory>\GYsc.ico
<Current directory>\eYou.exe
C:\RCX40.tmp
<Current directory>\yMAc.exe
C:\RCX2E.tmp
<Current directory>\HoMg.ico
C:\RCX2D.tmp
<STUBS_DIR>\AVPCC\AVPCC.EXE.exe
C:\RCX2F.tmp
<STUBS_DIR>\AVSYNMGR\AVSYNMGR.EXE.exe
<Current directory>\DkIk.exe
<STUBS_DIR>\AVPM\AVPM.EXE.exe
<Current directory>\ioMw.ico
<Current directory>\vEgc.exe
C:\RCX2B.tmp
<STUBS_DIR>\AVP\AVP.EXE.exe
<Current directory>\VgIO.exe
<STUBS_DIR>\AVGCTRL\AVGCTRL.EXE.exe
<Current directory>\SIsA.ico
<STUBS_DIR>\AVP32\AVP32.EXE.exe
<Current directory>\uSYY.ico
C:\RCX2C.tmp
<Current directory>\TUEE.ico
<Current directory>\PQAo.exe
<Current directory>\Akkw.ico
<Current directory>\FSwE.ico
<Current directory>\KwIa.exe
C:\RCX34.tmp
<Current directory>\vgEw.ico
<Current directory>\UkoI.exe
C:\RCX36.tmp
<Current directory>\fqoc.ico
<Current directory>\igAg.exe
C:\RCX35.tmp
<Current directory>\dGoI.ico
C:\RCX33.tmp
<Current directory>\AkQE.exe
C:\RCX31.tmp
<Current directory>\eSoY.ico
<Current directory>\QgYQ.exe
C:\RCX30.tmp
<Current directory>\qMkk.ico
<Current directory>\bUMK.exe
C:\RCX32.tmp
<Current directory>\sCAA.ico
<Current directory>\LIgI.exe
C:\RCX58.tmp
<STUBS_DIR>\GUARD\GUARD.EXE.exe
<Current directory>\yEMQ.exe
C:\RCX57.tmp
<Current directory>\dogc.ico
<Current directory>\sMwE.ico
<Current directory>\dAUc.exe
C:\RCX59.tmp
<Current directory>\MKQA.ico
<Current directory>\fEUc.exe
<Current directory>\TEgG.exe
<Current directory>\ragM.ico
<Current directory>\ZYcs.exe
C:\RCX54.tmp
<Current directory>\vUwI.ico
<Current directory>\XQII.exe
C:\RCX56.tmp
<Current directory>\rwws.ico
<Current directory>\ogsC.exe
C:\RCX55.tmp
<Current directory>\vukU.ico
C:\RCX5A.tmp
C:\RCX5F.tmp
<Current directory>\KeEw.ico
<Current directory>\VocM.exe
C:\RCX5E.tmp
<Current directory>\ecgs.ico
<Current directory>\dsAE.exe
C:\RCX61.tmp
<Current directory>\OOos.ico
<Current directory>\Ygom.exe
C:\RCX60.tmp
<Current directory>\EYsG.exe
<Current directory>\iCUk.ico
<Current directory>\cgci.exe
C:\RCX5B.tmp
<Current directory>\IsUY.ico
<Current directory>\vwQi.exe
C:\RCX5D.tmp
<Current directory>\jKkM.ico
<Current directory>\TAMo.exe
C:\RCX5C.tmp
<Current directory>\LswA.ico
<Current directory>\XsgG.exe
C:\RCX4A.tmp
<Current directory>\SMss.ico
<Current directory>\aQQe.exe
C:\RCX49.tmp
<Current directory>\uSkI.ico
<Current directory>\RgAy.exe
C:\RCX4B.tmp
<Current directory>\rqYY.ico
<Current directory>\kAQS.exe
<Current directory>\KQQk.ico
C:\RCX46.tmp
<Current directory>\RAMo.ico
<Current directory>\CMMa.exe
C:\RCX45.tmp
<Current directory>\lWco.ico
<Current directory>\nAUY.exe
C:\RCX48.tmp
<Current directory>\lSEw.ico
<Current directory>\DskE.exe
C:\RCX47.tmp
C:\RCX4C.tmp
C:\RCX51.tmp
<Current directory>\cioc.ico
<Current directory>\lgAO.exe
C:\RCX50.tmp
<Current directory>\GYcQ.ico
<Current directory>\YEIM.exe
C:\RCX53.tmp
<Current directory>\SOoU.ico
<Current directory>\DYEs.exe
C:\RCX52.tmp
<Current directory>\SsEI.exe
<Current directory>\BKgI.ico
<Current directory>\sUoC.exe
C:\RCX4D.tmp
<Current directory>\XAoI.ico
<Current directory>\osgE.exe
C:\RCX4F.tmp
<Current directory>\LIYQ.ico
<Current directory>\kYMI.exe
C:\RCX4E.tmp
<Current directory>\nMMg.ico
C:\RCX2A.tmp
<Current directory>\hQgu.exe
C:\RCXC.tmp
<Current directory>\iSgA.ico
C:\RCXB.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
C:\RCXD.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
<Current directory>\akMy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
<Current directory>\nqgk.ico
<Current directory>\swYw.exe
C:\RCX9.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
<Current directory>\BsAU.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
<Current directory>\bEYw.ico
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
<Current directory>\oukY.ico
C:\RCXA.tmp
<Current directory>\wMoA.ico
<Current directory>\YgIm.exe
<Current directory>\Ouwg.ico
<Current directory>\TwMK.exe
C:\RCX11.tmp
<Current directory>\MIgo.ico
C:\RCX10.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
C:\RCX12.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
<Current directory>\VgYe.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
<Current directory>\riwc.ico
<Current directory>\qMkC.exe
<Current directory>\HWwQ.ico
<Current directory>\fggW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
<Current directory>\SQUc.exe
C:\RCXE.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
<Current directory>\TEAE.ico
%TEMP%\iKwM.vbs
C:\RCXF.tmp
%TEMP%\eMYccMko.bat
<Current directory>\wkoe.exe
C:\RCX1.tmp
<Current directory>\<File name>
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
%TEMP%\oocAMkgc.bat
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
<Current directory>\kyMc.ico
C:\RCX2.tmp
<Current directory>\IyME.ico
<Current directory>\SYcq.exe
<Current directory>\TYYE.ico
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
<Current directory>\<File name>GQVI
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\caQc.txt
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIENRTH
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYwsCOUK
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%HOMEPATH%\gOEYMkgs\SSIkQYgQBLQV
<Current directory>\jscI.exe
<Current directory>\kUIw.ico
<Current directory>\PIQo.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
<Current directory>\fQEO.exe
C:\RCX6.tmp
<Current directory>\nYse.exe
C:\RCX8.tmp
<Current directory>\OMoU.ico
C:\RCX7.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
<Current directory>\wcgw.ico
<Current directory>\FEQa.exe
C:\RCX4.tmp
<Current directory>\fQYY.ico
C:\RCX3.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
C:\RCX5.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
<Current directory>\kcEy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
<Current directory>\SMww.ico
<Current directory>\BIUs.exe
C:\RCX21.tmp
<Current directory>\KQYM.ico
C:\RCX20.tmp
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
<Current directory>\eAQY.ico
<Current directory>\jUcg.exe
C:\RCX22.tmp
<Current directory>\TeYg.ico
<Current directory>\dYkI.exe
<Current directory>\rgoU.exe
C:\RCX1E.tmp
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
<Current directory>\VAcC.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
<Current directory>\bKgM.ico
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
<Current directory>\cOgg.ico
C:\RCX1F.tmp
<Current directory>\doQc.ico
<Current directory>\WMce.exe
C:\RCX23.tmp
C:\RCX28.tmp
<Current directory>\Cyss.ico
<Current directory>\ssIS.exe
C:\RCX27.tmp
<Current directory>\qYwo.ico
<Current directory>\TKYs.ico
<Current directory>\iUkw.exe
<STUBS_DIR>\AVGCC32\AVGCC32.EXE.exe
<Current directory>\rAsO.exe
C:\RCX29.tmp
<Current directory>\vQUe.exe
<Current directory>\iKEo.ico
<Current directory>\mMka.exe
C:\RCX24.tmp
<Current directory>\sGsE.ico
<Current directory>\BcsU.exe
C:\RCX26.tmp
<Current directory>\PmQg.ico
<Current directory>\hocc.exe
C:\RCX25.tmp
<Current directory>\EEoI.ico
C:\RCX16.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
<Current directory>\dEAm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
<Current directory>\mwMw.ico
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
<Current directory>\EgAI.ico
C:\RCX17.tmp
<Current directory>\FigA.ico
<Current directory>\OgAY.exe
C:\RCX15.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
<Current directory>\PyQA.ico
C:\RCX13.tmp
<Current directory>\kqAo.ico
<Current directory>\KUow.exe
<Current directory>\yyIA.ico
<Current directory>\BYwO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
<Current directory>\bowQ.exe
C:\RCX14.tmp
<Current directory>\fIAA.exe
<Current directory>\bqks.ico
<Current directory>\OIQi.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
<Current directory>\iQki.exe
C:\RCX1B.tmp
<Current directory>\tEss.exe
C:\RCX1D.tmp
<Current directory>\MiEw.ico
C:\RCX1C.tmp
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
<Current directory>\KQQo.ico
<Current directory>\SQMw.exe
C:\RCX19.tmp
<Current directory>\WcQI.ico
C:\RCX18.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
C:\RCX1A.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
<Current directory>\kwwQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
<Current directory>\Qqks.ico

Deletes the following files:

<Current directory>\wecw.ico
<Current directory>\eYou.exe
<Current directory>\PWww.ico
<Current directory>\GIoW.exe
<Current directory>\GYsc.ico
<Current directory>\EEgM.exe
<Current directory>\JOYQ.ico
<Current directory>\AEoI.exe
<Current directory>\CiYU.ico
<Current directory>\Lskk.exe
<Current directory>\Tcos.ico
<Current directory>\ngsS.exe
<Current directory>\lWco.ico
<Current directory>\CMMa.exe
<Current directory>\GGoI.ico
<Current directory>\nAUY.exe
<Current directory>\RAMo.ico
<Current directory>\DskE.exe
<Current directory>\NAwU.ico
<Current directory>\wgkW.exe
<Current directory>\Ewck.ico
<Current directory>\IIca.exe
<Current directory>\gQAE.ico
<Current directory>\fkwY.exe
<Current directory>\VgsY.exe
<Current directory>\UkoI.exe
<Current directory>\qMkk.ico
<Current directory>\bUMK.exe
<Current directory>\FSwE.ico
<Current directory>\KwIa.exe
<Current directory>\vgEw.ico
<Current directory>\AkQE.exe
<Current directory>\Akkw.ico
<Current directory>\QgYQ.exe
<Current directory>\sCAA.ico
<Current directory>\LIgI.exe
<Current directory>\eSoY.ico
<Current directory>\tQMs.exe
<Current directory>\AGsM.ico
<Current directory>\vwMi.exe
<Current directory>\ZqMY.ico
<Current directory>\JEsm.exe
<Current directory>\MwMI.ico
<Current directory>\acIa.exe
<Current directory>\dGoI.ico
<Current directory>\igAg.exe
<Current directory>\rwAE.ico
<Current directory>\KkIW.exe
<Current directory>\fqoc.ico
<Current directory>\fEUc.exe
<Current directory>\dogc.ico
<Current directory>\yEMQ.exe
<Current directory>\sMwE.ico
<Current directory>\dAUc.exe
<Current directory>\MKQA.ico
<Current directory>\ogsC.exe
<Current directory>\ragM.ico
<Current directory>\ZYcs.exe
<Current directory>\rwws.ico
<Current directory>\TEgG.exe
<Current directory>\vukU.ico
<Current directory>\VocM.exe
<Current directory>\jKkM.ico
<Current directory>\EYsG.exe
<Current directory>\KeEw.ico
<Current directory>\Ygom.exe
<Current directory>\ecgs.ico
<Current directory>\cgci.exe
<Current directory>\IsUY.ico
<Current directory>\vwQi.exe
<Current directory>\LswA.ico
<Current directory>\TAMo.exe
<Current directory>\iCUk.ico
<Current directory>\vUwI.ico
<Current directory>\uSkI.ico
<Current directory>\RgAy.exe
<Current directory>\rqYY.ico
<Current directory>\sUoC.exe
<Current directory>\XAoI.ico
<Current directory>\osgE.exe
<Current directory>\KQQk.ico
<Current directory>\aQQe.exe
<Current directory>\lSEw.ico
<Current directory>\kAQS.exe
<Current directory>\SMss.ico
<Current directory>\XsgG.exe
<Current directory>\cioc.ico
<Current directory>\DYEs.exe
<Current directory>\GYcQ.ico
<Current directory>\XQII.exe
<Current directory>\SOoU.ico
<Current directory>\YEIM.exe
<Current directory>\nMMg.ico
<Current directory>\kYMI.exe
<Current directory>\BKgI.ico
<Current directory>\lgAO.exe
<Current directory>\LIYQ.ico
<Current directory>\SsEI.exe
<Current directory>\ioMw.ico
<Current directory>\fggW.exe
<Current directory>\Ouwg.ico
<Current directory>\SQUc.exe
<Current directory>\TEAE.ico
<Current directory>\qMkC.exe
<Current directory>\HWwQ.ico
<Current directory>\hQgu.exe
<Current directory>\oukY.ico
<Current directory>\swYw.exe
<Current directory>\nqgk.ico
<Current directory>\akMy.exe
<Current directory>\iSgA.ico
<Current directory>\BYwO.exe
<Current directory>\PyQA.ico
<Current directory>\bowQ.exe
<Current directory>\mwMw.ico
<Current directory>\dEAm.exe
<Current directory>\yyIA.ico
<Current directory>\VgYe.exe
<Current directory>\MIgo.ico
<Current directory>\TwMK.exe
<Current directory>\kqAo.ico
<Current directory>\KUow.exe
<Current directory>\riwc.ico
<Current directory>\wMoA.ico
<Current directory>\IyME.ico
<Current directory>\SYcq.exe
<Current directory>\TYYE.ico
<Current directory>\FEQa.exe
<Current directory>\kyMc.ico
<Current directory>\jscI.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYwsCOUK
%HOMEPATH%\gOEYMkgs\SSIkQYgQBLQV
<Current directory>\<File name>GQVI
<Current directory>\wkoe.exe
%TEMP%\oocAMkgc.bat
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIENRTH
<Current directory>\OMoU.ico
<Current directory>\nYse.exe
<Current directory>\kUIw.ico
<Current directory>\YgIm.exe
<Current directory>\bEYw.ico
<Current directory>\BsAU.exe
<Current directory>\SMww.ico
<Current directory>\kcEy.exe
<Current directory>\fQYY.ico
<Current directory>\PIQo.exe
<Current directory>\wcgw.ico
<Current directory>\fQEO.exe
<Current directory>\PmQg.ico
<Current directory>\vQUe.exe
<Current directory>\EEoI.ico
<Current directory>\rAsO.exe
<Current directory>\qYwo.ico
<Current directory>\ssIS.exe
<Current directory>\sGsE.ico
<Current directory>\BcsU.exe
<Current directory>\eAQY.ico
<Current directory>\hocc.exe
<Current directory>\iKEo.ico
<Current directory>\mMka.exe
<Current directory>\uSYY.ico
<Current directory>\vEgc.exe
<Current directory>\TUEE.ico
<Current directory>\DkIk.exe
<Current directory>\HoMg.ico
<Current directory>\yMAc.exe
<Current directory>\TKYs.ico
<Current directory>\iUkw.exe
<Current directory>\Cyss.ico
<Current directory>\PQAo.exe
<Current directory>\SIsA.ico
<Current directory>\VgIO.exe
<Current directory>\jUcg.exe
<Current directory>\iQki.exe
<Current directory>\Qqks.ico
<Current directory>\kwwQ.exe
<Current directory>\bqks.ico
<Current directory>\OIQi.exe
<Current directory>\KQQo.ico
<Current directory>\fIAA.exe
<Current directory>\FigA.ico
<Current directory>\OgAY.exe
<Current directory>\WcQI.ico
<Current directory>\SQMw.exe
<Current directory>\EgAI.ico
<Current directory>\BIUs.exe
<Current directory>\cOgg.ico
<Current directory>\rgoU.exe
<Current directory>\TeYg.ico
<Current directory>\dYkI.exe
<Current directory>\KQYM.ico
<Current directory>\VAcC.exe
<Current directory>\MiEw.ico
<Current directory>\tEss.exe
<Current directory>\doQc.ico
<Current directory>\WMce.exe
<Current directory>\bKgM.ico

Substitutes the following files:

<Current directory>\eYou.exe
<Current directory>\EEgM.exe
<Current directory>\GIoW.exe
<Current directory>\AEoI.exe
<Current directory>\ngsS.exe
<Current directory>\Lskk.exe
<Current directory>\CMMa.exe
<Current directory>\DskE.exe
<Current directory>\nAUY.exe
<Current directory>\wgkW.exe
<Current directory>\fkwY.exe
<Current directory>\IIca.exe
<Current directory>\UkoI.exe
<Current directory>\KwIa.exe
<Current directory>\igAg.exe
<Current directory>\AkQE.exe
<Current directory>\LIgI.exe
<Current directory>\bUMK.exe
<Current directory>\tQMs.exe
<Current directory>\JEsm.exe
<Current directory>\VgsY.exe
<Current directory>\acIa.exe
<Current directory>\KkIW.exe
<Current directory>\vwMi.exe
<Current directory>\yEMQ.exe
<Current directory>\fEUc.exe
<Current directory>\dAUc.exe
<Current directory>\ZYcs.exe
<Current directory>\ogsC.exe
<Current directory>\TEgG.exe
<Current directory>\EYsG.exe
<Current directory>\VocM.exe
<Current directory>\Ygom.exe
<Current directory>\vwQi.exe
<Current directory>\cgci.exe
<Current directory>\TAMo.exe
<Current directory>\RgAy.exe
<Current directory>\osgE.exe
<Current directory>\sUoC.exe
<Current directory>\aQQe.exe
<Current directory>\XsgG.exe
<Current directory>\kAQS.exe
<Current directory>\DYEs.exe
<Current directory>\YEIM.exe
<Current directory>\XQII.exe
<Current directory>\kYMI.exe
<Current directory>\SsEI.exe
<Current directory>\lgAO.exe
<Current directory>\QgYQ.exe
<Current directory>\fggW.exe
<Current directory>\qMkC.exe
<Current directory>\TwMK.exe
<Current directory>\hQgu.exe
<Current directory>\akMy.exe
<Current directory>\SQUc.exe
<Current directory>\BYwO.exe
<Current directory>\dEAm.exe
<Current directory>\OgAY.exe
<Current directory>\VgYe.exe
<Current directory>\KUow.exe
<Current directory>\bowQ.exe
<Current directory>\jscI.exe
<Current directory>\FEQa.exe
<Current directory>\kcEy.exe
<Current directory>\<File name>GQVI
<Current directory>\wkoe.exe
<Current directory>\SYcq.exe
<Current directory>\BsAU.exe
<Current directory>\YgIm.exe
<Current directory>\swYw.exe
<Current directory>\fQEO.exe
<Current directory>\PIQo.exe
<Current directory>\nYse.exe
<Current directory>\vQUe.exe
<Current directory>\ssIS.exe
<Current directory>\rAsO.exe
<Current directory>\BcsU.exe
<Current directory>\mMka.exe
<Current directory>\hocc.exe
<Current directory>\vEgc.exe
<Current directory>\yMAc.exe
<Current directory>\DkIk.exe
<Current directory>\iUkw.exe
<Current directory>\VgIO.exe
<Current directory>\PQAo.exe
<Current directory>\iQki.exe
<Current directory>\OIQi.exe
<Current directory>\tEss.exe
<Current directory>\fIAA.exe
<Current directory>\SQMw.exe
<Current directory>\kwwQ.exe
<Current directory>\BIUs.exe
<Current directory>\dYkI.exe
<Current directory>\jUcg.exe
<Current directory>\VAcC.exe
<Current directory>\WMce.exe
<Current directory>\rgoU.exe

Network activity:

Connects to:

'74.##5.232.51':80

TCP:

HTTP GET requests:

http://google.com/ via 74.##5.232.51

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'lacMcYws.exe'

Creates and executes the following:

'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
'<SYSTEM32>\cscript.exe' %TEMP%\iKwM.vbs
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
'<Full path to file>'
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'

Executes the following:

'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\eMYccMko.bat" "<Full path to file>""
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней