Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Note' = '%TEMP%\91389902\ilm.exe %TEMP%\91389902\jxt=gre'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\91389902\ojk.ppt
- %TEMP%\91389902\mps.xl
- %TEMP%\91389902\crs.xl
- %TEMP%\91389902\bft.txt
- %TEMP%\91389902\rbn.pdf
- %TEMP%\91389902\ndc.pdf
- %TEMP%\91389902\udt.xl
- %TEMP%\91389902\hnj.bmp
- %TEMP%\91389902\guh.dat
- %TEMP%\91389902\maj.xl
- %TEMP%\91389902\lfp.mp3
- %TEMP%\91389902\hro.docx
- %TEMP%\91389902\jvb.dat
- %TEMP%\91389902\mji.ppt
- %TEMP%\91389902\sqb.pdf
- %TEMP%\91389902\ddn.txt
- %TEMP%\91389902\ini
- %TEMP%\91389902\TEXRK
- %TEMP%\91389902\sah.mp3
- %TEMP%\91389902\qiu.docx
- %TEMP%\91389902\lsm.icm
- %TEMP%\91389902\kph.mp4
- %TEMP%\91389902\etw.pdf
- %TEMP%\91389902\akx.mp4
- %TEMP%\91389902\tvu.pdf
- %TEMP%\91389902\qxa.mp4
- %TEMP%\91389902\pqq.mp4
- %TEMP%\91389902\lnp.pdf
- %TEMP%\91389902\qnv.icm
- %TEMP%\91389902\utb.docx
- %TEMP%\91389902\bav.bmp
- %TEMP%\91389902\ilm.exe
- %TEMP%\91389902\jxt=gre
- %TEMP%\91389902\dov.docx
- %TEMP%\91389902\cgh.xl
- %TEMP%\91389902\kgv.xl
- %TEMP%\91389902\big.icm
- %TEMP%\91389902\sik.bmp
- %TEMP%\91389902\kum.icm
- %TEMP%\91389902\eeb.ppt
- %TEMP%\91389902\kma.mp4
- %TEMP%\91389902\cqk.mp3
- %TEMP%\91389902\ulo.ppt
- %TEMP%\91389902\tgn.ppt
- %TEMP%\91389902\vlm.ico
- %TEMP%\91389902\gru.icm
- %TEMP%\91389902\fth.icm
- %TEMP%\91389902\qus.bmp
- %TEMP%\91389902\fhe.pdf
- %TEMP%\91389902\mmi.txt
Sets the 'hidden' attribute to the following files:
- %TEMP%\91389902\ojk.ppt
- %TEMP%\91389902\ndc.pdf
- %TEMP%\91389902\mps.xl
- %TEMP%\91389902\qnv.icm
- %TEMP%\91389902\qiu.docx
- %TEMP%\91389902\pqq.mp4
- %TEMP%\91389902\lsm.icm
- %TEMP%\91389902\lnp.pdf
- %TEMP%\91389902\lfp.mp3
- %TEMP%\91389902\mmi.txt
- %TEMP%\91389902\mji.ppt
- %TEMP%\91389902\maj.xl
- %TEMP%\91389902\udt.xl
- %TEMP%\91389902\tvu.pdf
- %TEMP%\91389902\tgn.ppt
- %TEMP%\91389902\vlm.ico
- %TEMP%\91389902\utb.docx
- %TEMP%\91389902\ulo.ppt
- %TEMP%\91389902\rbn.pdf
- %TEMP%\91389902\qxa.mp4
- %TEMP%\91389902\qus.bmp
- %TEMP%\91389902\sqb.pdf
- %TEMP%\91389902\sik.bmp
- %TEMP%\91389902\sah.mp3
- %TEMP%\91389902\dov.docx
- %TEMP%\91389902\ddn.txt
- %TEMP%\91389902\crs.xl
- %TEMP%\91389902\fhe.pdf
- %TEMP%\91389902\etw.pdf
- %TEMP%\91389902\eeb.ppt
- %TEMP%\91389902\bft.txt
- %TEMP%\91389902\bav.bmp
- %TEMP%\91389902\akx.mp4
- %TEMP%\91389902\cqk.mp3
- %TEMP%\91389902\cgh.xl
- %TEMP%\91389902\big.icm
- %TEMP%\91389902\kgv.xl
- %TEMP%\91389902\jxt=gre
- %TEMP%\91389902\jvb.dat
- %TEMP%\91389902\kum.icm
- %TEMP%\91389902\kph.mp4
- %TEMP%\91389902\kma.mp4
- %TEMP%\91389902\guh.dat
- %TEMP%\91389902\gru.icm
- %TEMP%\91389902\fth.icm
- %TEMP%\91389902\ilm.exe
- %TEMP%\91389902\hro.docx
- %TEMP%\91389902\hnj.bmp
Deletes the following files:
- %TEMP%\91389902\TEXRK
Network activity:
Connects to:
- 'el####ns.hopto.org':1905
- 'el#####s.eluma101.com':1905
- 'jm####.daniel2you.com':1905
UDP:
- DNS ASK el####ns.hopto.org
- DNS ASK el#####s.eluma101.com
- DNS ASK jm####.daniel2you.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\91389902\ilm.exe' %TEMP%\91389902\TEXRK
- '%TEMP%\91389902\ilm.exe' jxt=gre
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
