Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'dssUpdate' = '%TEMP%\27884944\pdb.exe %TEMP%\27884944\exk=ppx'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\27884944\rbi.xl
- %TEMP%\27884944\pgp.ico
- %TEMP%\27884944\txm.ico
- %TEMP%\27884944\bkg.mp3
- %TEMP%\27884944\uct.dat
- %TEMP%\27884944\tpq.mp4
- %TEMP%\27884944\mhm.icm
- %TEMP%\27884944\seb.mp4
- %TEMP%\27884944\odx.docx
- %TEMP%\27884944\cmg.xl
- %TEMP%\27884944\vme.bmp
- %TEMP%\27884944\awr.mp3
- %TEMP%\27884944\cia.dat
- %TEMP%\27884944\fbb.jpg
- %TEMP%\27884944\txp.bmp
- %TEMP%\27884944\mak.mp4
- %TEMP%\27884944\qmb.docx
- %TEMP%\27884944\hgu.txt
- %TEMP%\27884944\upe.mp3
- %TEMP%\27884944\crj.txt
- %TEMP%\27884944\BEGLD
- %TEMP%\27884944\dkk.ppt
- %TEMP%\27884944\xjj.mp3
- %TEMP%\27884944\gps.icm
- %TEMP%\27884944\wrg.jpg
- %TEMP%\27884944\jjo.xl
- %TEMP%\27884944\pdb.exe
- %TEMP%\27884944\qnd.dat
- %TEMP%\27884944\mnq.pdf
- %TEMP%\27884944\mgo.icm
- %TEMP%\27884944\gga.ico
- %TEMP%\27884944\lvr.pdf
- %TEMP%\27884944\vkp.bmp
- %TEMP%\27884944\gjc.icm
- %TEMP%\27884944\bwm.docx
- %TEMP%\27884944\spd
- %TEMP%\27884944\kqi.ico
- %TEMP%\27884944\mxl.jpg
- %TEMP%\27884944\nhe.mp3
- %TEMP%\27884944\trg.xl
- %TEMP%\27884944\xux.pdf
- %TEMP%\27884944\stw.ico
- %TEMP%\27884944\tua.mp4
- %TEMP%\27884944\uwl.dat
- %TEMP%\27884944\jko.pdf
- %TEMP%\27884944\smd.docx
- %TEMP%\27884944\bxr.dat
- %TEMP%\27884944\exk=ppx
- %TEMP%\27884944\bef.ppt
- %APPDATA%\23EF5514-3059-436F-A4A7-4CEFAAB20EB1\run.dat
Sets the 'hidden' attribute to the following files:
- %TEMP%\27884944\awr.mp3
- %TEMP%\27884944\odx.docx
- %TEMP%\27884944\pdb.exe
- %TEMP%\27884944\pgp.ico
- %TEMP%\27884944\qmb.docx
- %TEMP%\27884944\qnd.dat
- %TEMP%\27884944\rbi.xl
- %TEMP%\27884944\seb.mp4
- %TEMP%\27884944\smd.docx
- %TEMP%\27884944\stw.ico
- %TEMP%\27884944\trg.xl
- %TEMP%\27884944\xjj.mp3
- %TEMP%\27884944\tua.mp4
- %TEMP%\27884944\txm.ico
- %TEMP%\27884944\txp.bmp
- %TEMP%\27884944\uct.dat
- %TEMP%\27884944\upe.mp3
- %TEMP%\27884944\uwl.dat
- %TEMP%\27884944\vkp.bmp
- %TEMP%\27884944\vme.bmp
- %TEMP%\27884944\wrg.jpg
- %TEMP%\27884944\nhe.mp3
- %TEMP%\27884944\tpq.mp4
- %TEMP%\27884944\mxl.jpg
- %TEMP%\27884944\fbb.jpg
- %TEMP%\27884944\bef.ppt
- %TEMP%\27884944\bkg.mp3
- %TEMP%\27884944\bwm.docx
- %TEMP%\27884944\bxr.dat
- %TEMP%\27884944\cia.dat
- %TEMP%\27884944\cmg.xl
- %TEMP%\27884944\crj.txt
- %TEMP%\27884944\dkk.ppt
- %TEMP%\27884944\exk=ppx
- %TEMP%\27884944\gga.ico
- %TEMP%\27884944\mhm.icm
- %TEMP%\27884944\gjc.icm
- %TEMP%\27884944\gps.icm
- %TEMP%\27884944\hgu.txt
- %TEMP%\27884944\jjo.xl
- %TEMP%\27884944\jko.pdf
- %TEMP%\27884944\kqi.ico
- %TEMP%\27884944\lvr.pdf
- %TEMP%\27884944\mak.mp4
- %TEMP%\27884944\mgo.icm
- %TEMP%\27884944\mnq.pdf
- %TEMP%\27884944\xux.pdf
Deletes the following files:
- %TEMP%\27884944\BEGLD
Network activity:
Connects to:
- 'di##.#n-the-web.tv':54984
UDP:
- DNS ASK di##.#n-the-web.tv
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\27884944\pdb.exe' exk=ppx
- '%TEMP%\27884944\pdb.exe' %TEMP%\27884944\BEGLD
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
