Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'LAN Service' = '%ProgramFiles%\LAN Service\lansv.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\61203512\kba.exe %TEMP%\61203512\lvf=oli'
Malicious functions:
Injects code into
the following user processes:
- RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\61203512\ipa.dat
- %TEMP%\61203512\jgj.docx
- %TEMP%\61203512\sxp.xl
- %TEMP%\61203512\lad.dat
- %TEMP%\61203512\etm.xl
- %TEMP%\61203512\wsv.dat
- %TEMP%\61203512\qfl.dat
- %TEMP%\61203512\wld.mp4
- %TEMP%\61203512\kct.ppt
- %TEMP%\61203512\paj.ppt
- %TEMP%\61203512\aof.xl
- %TEMP%\61203512\ixc.mp4
- %TEMP%\61203512\nhx.ico
- %TEMP%\61203512\vfj.ico
- %TEMP%\61203512\pgm.bmp
- %TEMP%\61203512\cbu.mp4
- %ProgramFiles%\LAN Service\lansv.exe
- %APPDATA%\23EF5514-3059-436F-A4A7-4CEFAAB20EB1\run.dat
- %TEMP%\61203512\REVHZ
- %TEMP%\61203512\lav.icm
- %TEMP%\61203512\jje.xl
- %TEMP%\61203512\kbo.mp3
- %TEMP%\61203512\tdb.ppt
- %TEMP%\61203512\flk.mp3
- %TEMP%\61203512\fso.mp4
- %TEMP%\61203512\psm.ppt
- %TEMP%\61203512\bje.mp4
- %TEMP%\61203512\lla.mp3
- %TEMP%\61203512\mgb.xl
- %TEMP%\61203512\gjs.ppt
- %TEMP%\61203512\sxb.pdf
- %TEMP%\61203512\oqx.dat
- %TEMP%\61203512\tlx.ppt
- %TEMP%\61203512\kba.exe
- %TEMP%\61203512\lvf=oli
- %TEMP%\61203512\eie.ppt
- %TEMP%\61203512\cvr.txt
- %TEMP%\61203512\ahv.ico
- %TEMP%\61203512\tvt.dat
- %TEMP%\61203512\jed.icm
- %TEMP%\61203512\usu.dat
- %TEMP%\61203512\cto.ico
- %TEMP%\61203512\frv.dat
- %TEMP%\61203512\noi.bmp
- %TEMP%\61203512\hda.jpg
- %TEMP%\61203512\iui.docx
- %TEMP%\61203512\iot.xl
- %TEMP%\61203512\kxj.txt
- %TEMP%\61203512\fhh.dat
- %TEMP%\61203512\gkh.ico
- %TEMP%\61203512\pum.ppt
- %TEMP%\61203512\iqg.docx
Sets the 'hidden' attribute to the following files:
- %TEMP%\61203512\noi.bmp
- %TEMP%\61203512\nhx.ico
- %TEMP%\61203512\mgb.xl
- %TEMP%\61203512\pgm.bmp
- %TEMP%\61203512\paj.ppt
- %TEMP%\61203512\oqx.dat
- %TEMP%\61203512\lad.dat
- %TEMP%\61203512\kxj.txt
- %TEMP%\61203512\kct.ppt
- %TEMP%\61203512\lvf=oli
- %TEMP%\61203512\lla.mp3
- %TEMP%\61203512\lav.icm
- %TEMP%\61203512\usu.dat
- %TEMP%\61203512\tvt.dat
- %TEMP%\61203512\tlx.ppt
- %TEMP%\61203512\wsv.dat
- %TEMP%\61203512\wld.mp4
- %TEMP%\61203512\vfj.ico
- %TEMP%\61203512\qfl.dat
- %TEMP%\61203512\pum.ppt
- %TEMP%\61203512\psm.ppt
- %TEMP%\61203512\tdb.ppt
- %TEMP%\61203512\sxp.xl
- %TEMP%\61203512\sxb.pdf
- %TEMP%\61203512\kbo.mp3
- %TEMP%\61203512\fhh.dat
- %TEMP%\61203512\etm.xl
- %TEMP%\61203512\eie.ppt
- %TEMP%\61203512\fso.mp4
- %TEMP%\61203512\frv.dat
- %TEMP%\61203512\flk.mp3
- %TEMP%\61203512\bje.mp4
- %TEMP%\61203512\aof.xl
- %TEMP%\61203512\ahv.ico
- %TEMP%\61203512\cvr.txt
- %TEMP%\61203512\cto.ico
- %TEMP%\61203512\cbu.mp4
- %TEMP%\61203512\jed.icm
- %TEMP%\61203512\ixc.mp4
- %TEMP%\61203512\iui.docx
- %TEMP%\61203512\kba.exe
- %TEMP%\61203512\jje.xl
- %TEMP%\61203512\jgj.docx
- %TEMP%\61203512\hda.jpg
- %TEMP%\61203512\gkh.ico
- %TEMP%\61203512\gjs.ppt
- %TEMP%\61203512\iqg.docx
- %TEMP%\61203512\ipa.dat
- %TEMP%\61203512\iot.xl
Deletes the following files:
- %TEMP%\61203512\REVHZ
Network activity:
Connects to:
- 'be#####olas.hopto.org':55420
UDP:
- DNS ASK be#####olas.hopto.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\RegSvcs.exe'
- '%TEMP%\61203512\kba.exe' %TEMP%\61203512\REVHZ
- '%TEMP%\61203512\kba.exe' lvf=oli
