Technical Information
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- %TEMP%\gapbevv2.out
- %TEMP%\gapbevv2.cmdline
- %TEMP%\gapbevv2.0.vb
- %TEMP%\RES7.tmp
- %TEMP%\vbc6.tmp
- %TEMP%\yio7l9dl.out
- %TEMP%\yio7l9dl.cmdline
- %TEMP%\yio7l9dl.0.vb
- C:\ProgramData\System\boot.ico
- %APPDATA%\Random\Optional\Launch Internet Explorer Browser.exe
- C:\AUTOEXEC.BAT.exe
- %TEMP%\RES5.tmp
- %TEMP%\vbc4.tmp
- %TEMP%\xuc-hjpt.out
- %TEMP%\xuc-hjpt.cmdline
- %TEMP%\xuc-hjpt.0.vb
- %APPDATA%\System.exe
- %TEMP%\RES3.tmp
- %TEMP%\vbc2.tmp
- %TEMP%\uarwx8ie.out
- %TEMP%\uarwx8ie.cmdline
- %TEMP%\uarwx8ie.0.vb
- C:\ProgramData\System\AUTOEXEC.ico
- C:\System\System.exe
- %HOMEPATH%\Local Settings\TempGNsDf.QV
- %TEMP%\vbc8.tmp
- %TEMP%\RES9.tmp
Sets the 'hidden' attribute to the following files:
- C:\System\System.exe
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\RES3.tmp
- %TEMP%\vbc2.tmp
- %TEMP%\RES5.tmp
- %TEMP%\vbc4.tmp
- %TEMP%\uarwx8ie.0.vb
- %TEMP%\uarwx8ie.cmdline
- %TEMP%\uarwx8ie.out
- %TEMP%\xuc-hjpt.out
- %TEMP%\xuc-hjpt.cmdline
- %TEMP%\xuc-hjpt.0.vb
Moves the following files:
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk to %APPDATA%\Random\Optional\Launch Internet Explorer Browser.lnk
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk to %APPDATA%\Random\Optional\Windows Media Player.lnk
Substitutes the following files:
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
Network activity:
Connects to:
- '13####00.ddns.net':444
UDP:
- DNS ASK 13####00.ddns.net
Miscellaneous:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe'
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uarwx8ie.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3.tmp" "%TEMP%\vbc2.tmp"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xuc-hjpt.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5.tmp" "%TEMP%\vbc4.tmp"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yio7l9dl.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7.tmp" "%TEMP%\vbc6.tmp"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gapbevv2.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9.tmp" "%TEMP%\vbc8.tmp"
