Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\net.exe' stop qmMgr
- '<SYSTEM32>\net.exe' stop qmwatchdog
Modifies file system:
Creates the following files:
- C:\PSMeterBilling\DartWeb.dll
- C:\PSMeterBilling\Util\htsjava.dll
- C:\PSMeterBilling\Util\htsswf.dll
- C:\PSMeterBilling\Util\httrack.exe
- C:\PSMeterBilling\Util\lang.def
- C:\PSMeterBilling\Util\libeay32.dll
- C:\PSMeterBilling\Util\libhttrack.dll
- C:\PSMeterBilling\Util\mfc90.dll
- C:\PSMeterBilling\Util\MIBFerret.exe
- C:\PSMeterBilling\Util\Microsoft.VC90.CRT.manifest
- C:\PSMeterBilling\Util\Microsoft.VC90.MFC.manifest
- C:\PSMeterBilling\Util\msvcr90.dll
- C:\PSMeterBilling\Util\snmprecorder.exe
- C:\PSMeterBilling\Util\ssleay32.dll
- C:\PSMeterBilling\Util\tpk.exe
- C:\PSMeterBilling\Util\WinHTTrackIEBar.dll
- C:\PSMeterBilling\Util\zlib1.dll
- C:\PSMeterBilling\DartSnmp2.dll
- C:\PSMeterBilling\DartSock.dll
- C:\PSMeterBilling\SATTool.exe
- C:\PSMeterBilling\ipcdb.mdb
- C:\PSMeterBilling\_TSTool.exe
- C:\PSMeterBilling\mPointer.ico
- C:\PSMeterBilling\preloadlog.txt
- C:\PSMeterBilling\Util\DartZipLite.dll
- C:\PSMeterBilling\qmSetup.txt
- C:\PSMeterBilling\Util\DartZip.dll
- C:\PSMeterBilling\wshom.ocx
- C:\PSMeterBilling\DartZip.dll
- C:\PSMeterBilling\DartZipLite.dll
- C:\PSMeterBilling\ExtLVCTL.ocx
- C:\PSMeterBilling\ExtTimer.ocx
- C:\PSMeterBilling\lgNotOk.gif
- C:\PSMeterBilling\lgOk.gif
- C:\PSMeterBilling\Mscomct2.ocx
- C:\PSMeterBilling\MSCOMCTL.OCX
- C:\PSMeterBilling\MSWINSCK.OCX
- C:\PSMeterBilling\PreLoad.exe
- C:\PSMeterBilling\PrintMIB3.mdb
- C:\PSMeterBilling\QMD_Blank.mdb
- C:\PSMeterBilling\qmgui.exe
- C:\PSMeterBilling\qmib.exe
- C:\PSMeterBilling\qmInstaller.exe
- C:\PSMeterBilling\qmUninstall.exe
- C:\PSMeterBilling\Restart.exe
- C:\PSMeterBilling\restart_services.bat
- C:\PSMeterBilling\rs.exe
- C:\PSMeterBilling\smNotOk.gif
- C:\PSMeterBilling\smOk.gif
- C:\PSMeterBilling\splash.gif
- C:\PSMeterBilling\Watchdog.exe
- C:\PSMeterBilling\XYNTService.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\login[1].asp
Network activity:
Connects to:
- 'localhost':1036
- 'ps#####billing.co.uk':80
TCP:
HTTP GET requests:
- http://www.ps#####billing.co.uk/install/login.asp?se#############################################################################################################################################...
UDP:
- DNS ASK www.ps#####billing.co.uk
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- 'C:\PSMeterBilling\PreLoad.exe' -HOST:www.ps#####billing.co.uk -PATH:PSMeterBilling -LOG
- 'C:\PSMeterBilling\qmInstaller.exe' -HOST:www.ps#####billing.co.uk -PATH:PSMeterBilling -LOG
Executes the following:
- '<SYSTEM32>\net1.exe' stop qmMgr
- '<SYSTEM32>\net1.exe' stop qmwatchdog
