Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Executes the following:
- '<SYSTEM32>\net.exe' stop wuauserv
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN1.0" dir=in action=block program="%ProgramFiles%\AhnLab\V3Lite30\MUpdate2\MUpdate2.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN1.0" dir=out action=block program="%ProgramFiles%\AhnLab\V3Lite30\MUpdate2\MUpdate2.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN2.0" dir=in action=block program="%ProgramFiles%\ESTsoft\ALYac\AYUpdSrv.aye"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN2.0" dir=out action=block program="%ProgramFiles%\ESTsoft\ALYac\AYUpdSrv.aye"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Torrentservice" dir=in action=block program="%ProgramFiles%\Naver\NaverVaccine\NvcAgent.npc"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Torrentservice" dir=out action=block program="%ProgramFiles%\Naver\NaverVaccine\NvcAgent.npc"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Msn Messenger" dir=in action=block program="%ProgramFiles%\AVAST Software\Avast\setup\instup.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Msn Messenger" dir=out action=block program="%ProgramFiles%\AVAST Software\Avast\setup\instup.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Skype updater" dir=in action=block program="%ProgramFiles%\AhnLab\Safe Transaction\MUpdate2\MUpdate2.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Skype updater" dir=out action=block program="%ProgramFiles%\AhnLab\Safe Transaction\MUpdate2\MUpdate2.exe"
Modifies file system:
Creates the following files:
- %TEMP%\Installer.msi
- %WINDIR%\Installer\MSI5.tmp
- C:\Config.Msi\2502c.rbs
- %WINDIR%\Installer\MSI3.tmp
- %APPDATA%\Windows Defender\is-OMG9U.tmp
- %APPDATA%\Windows Defender\is-FEJ55.tmp
- %APPDATA%\Windows Defender\is-K7QC8.tmp
- %APPDATA%\Windows Defender\is-EPOVT.tmp
- %APPDATA%\Windows Defender\is-KLU7G.tmp
- %APPDATA%\Windows Defender\is-C5CRL.tmp
- %APPDATA%\Windows Defender\is-HC6LB.tmp
- %APPDATA%\Windows Defender\is-6H73U.tmp
- %APPDATA%\Windows Defender\is-8RVHM.tmp
- %APPDATA%\Windows Defender\is-F0BHG.tmp
- %APPDATA%\Windows Defender\is-638KN.tmp
- %TEMP%\is-O944P.tmp\Installer.tmp
- %TEMP%\MW-fec7bfff-4dc3-4194-bf27-d15a7649e395\files\Installer.exe
- %TEMP%\MW-fec7bfff-4dc3-4194-bf27-d15a7649e395\files.cab
- %TEMP%\MW-fec7bfff-4dc3-4194-bf27-d15a7649e395\msiwrapper.ini
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\2502b.ipi
- %WINDIR%\Installer\25029.msi
- %TEMP%\start.exe
- %TEMP%\Install.cmd
- %WINDIR%\Installer\2502d.msi
- %WINDIR%\Installer\MSI7.tmp
Deletes the following files:
- %TEMP%\is-O944P.tmp\Installer.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI3.tmp
- C:\Config.Msi\2502c.rbs
- %TEMP%\MW-fec7bfff-4dc3-4194-bf27-d15a7649e395\files\Installer.exe
- %TEMP%\MW-fec7bfff-4dc3-4194-bf27-d15a7649e395\msiwrapper.ini
- %TEMP%\MW-fec7bfff-4dc3-4194-bf27-d15a7649e395\files.cab
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\25029.msi
- %WINDIR%\Installer\2502b.ipi
- %TEMP%\Installer.msi
- %TEMP%\Install.cmd
Moves the following files:
- from %APPDATA%\Windows Defender\is-638KN.tmp to %APPDATA%\Windows Defender\config.json
- from %APPDATA%\Windows Defender\is-F0BHG.tmp to %APPDATA%\Windows Defender\5WEf9yT5sWfFi1Kl9X400Fn6coNx9Q.7z
- from %APPDATA%\Windows Defender\is-8RVHM.tmp to %APPDATA%\Windows Defender\7z.dll
- from %APPDATA%\Windows Defender\is-6H73U.tmp to %APPDATA%\Windows Defender\7z.exe
- from %APPDATA%\Windows Defender\is-HC6LB.tmp to %APPDATA%\Windows Defender\7z.sfx
- from %APPDATA%\Windows Defender\is-C5CRL.tmp to %APPDATA%\Windows Defender\7zCon.sfx
- from %APPDATA%\Windows Defender\is-KLU7G.tmp to %APPDATA%\Windows Defender\7-zip.dll
- from %APPDATA%\Windows Defender\is-EPOVT.tmp to %APPDATA%\Windows Defender\7-zip32.dll
- from %APPDATA%\Windows Defender\is-K7QC8.tmp to %APPDATA%\Windows Defender\99ViXKOd1VLRtoVj46T5eFd9598qgy.bat
- from %APPDATA%\Windows Defender\is-FEJ55.tmp to %APPDATA%\Windows Defender\99ViXKOd1VLRtoVj46T5eFd9598qgy.vbs
- from %APPDATA%\Windows Defender\is-OMG9U.tmp to %APPDATA%\Windows Defender\W7lG01Z7Axxvic04p4jzRLL2EPQ79r.bat
Miscellaneous:
Creates and executes the following:
- '%TEMP%\start.exe'
- '%TEMP%\MW-fec7bfff-4dc3-4194-bf27-d15a7649e395\files\Installer.exe' /VERYSILENT
- '%TEMP%\is-O944P.tmp\Installer.tmp' /SL5="$400E6,1962859,57856,%TEMP%\MW-fec7bfff-4dc3-4194-bf27-d15a7649e395\files\Installer.exe" /VERYSILENT
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Install.cmd""
- '<SYSTEM32>\msiexec.exe' /i %TEMP%\Installer.msi /quiet
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 15DCA1E1A3548EC92E89C24956241BD0
- '<SYSTEM32>\expand.exe' -R files.cab -F:* files
- '<SYSTEM32>\cmd.exe' /C ""%APPDATA%\Windows Defender\W7lG01Z7Axxvic04p4jzRLL2EPQ79r.bat""
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Windows Defender\99ViXKOd1VLRtoVj46T5eFd9598qgy.vbs"
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\Windows Defender\99ViXKOd1VLRtoVj46T5eFd9598qgy.bat"
- '<SYSTEM32>\net1.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%TEMP%\MW-fec7bfff-4dc3-4194-bf27-d15a7649e395\files"
- '<SYSTEM32>\netsh.exe' Advfirewall set allprofiles state on
- '<SYSTEM32>\schtasks.exe' /create /xml "%APPDATA%\Windows Defender\esHF0D7KPMui4M0wxfpyG866L26xK0.xml" /tn "Windows Local Network Service"
- '<SYSTEM32>\xcopy.exe' /s /y /k /f "%APPDATA%\Windows Defender\Windows Local Network Service.bat" "%HOMEPATH%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
