Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\48528185\ife.exe %TEMP%\48528185\omf=jhk'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Injects code into
the following user processes:
- RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\48528185\apv.icm
- %TEMP%\48528185\urw.pdf
- %TEMP%\48528185\ggh.icm
- %TEMP%\48528185\bra.ppt
- %TEMP%\48528185\som.dat
- %TEMP%\48528185\pwt.mp3
- %TEMP%\48528185\ssu.txt
- %TEMP%\48528185\buj.docx
- %TEMP%\48528185\lbc.jpg
- %TEMP%\48528185\wqd.docx
- %TEMP%\48528185\kkp.txt
- %TEMP%\48528185\mgm.xl
- %TEMP%\RegSvcs.exe
- %TEMP%\48528185\vqo.mp3
- %TEMP%\48528185\tip.xl
- %TEMP%\48528185\ekk.dat
- %TEMP%\48528185\xud.icm
- %TEMP%\48528185\tkg.docx
- %TEMP%\48528185\uie.dat
- %TEMP%\48528185\ktw.dat
- %TEMP%\48528185\ihk.xl
- %TEMP%\48528185\psp.docx
- %TEMP%\48528185\OOCHR
- %TEMP%\48528185\hbn.txt
- %TEMP%\48528185\ppj.ico
- %TEMP%\48528185\npl.bmp
- %TEMP%\48528185\kxv.ppt
- %TEMP%\48528185\omf=jhk
- %TEMP%\48528185\ife.exe
- %TEMP%\48528185\teu.icm
- %TEMP%\48528185\cmd.xl
- %TEMP%\48528185\dkn.pdf
- %TEMP%\48528185\dcb.pdf
- %TEMP%\48528185\adk.ico
- %TEMP%\48528185\ghb.txt
- %TEMP%\48528185\nob.ico
- %TEMP%\48528185\bms.pdf
- %TEMP%\48528185\tvn.pdf
- %TEMP%\48528185\lao.txt
- %TEMP%\48528185\wdi.bmp
- %TEMP%\48528185\nnq.mp4
- %TEMP%\48528185\erh.ico
- %TEMP%\48528185\wvp.mp4
- %TEMP%\48528185\lqv.mp3
- %TEMP%\48528185\rln.pdf
- %TEMP%\48528185\vhm.mp3
- %TEMP%\48528185\ebu.xl
- %TEMP%\48528185\tbf.pdf
- %TEMP%\48528185\xjv.ico
- %TEMP%\48528185\oeq.ico
- %APPDATA%\remcos\logs.dat
Sets the 'hidden' attribute to the following files:
- %TEMP%\48528185\adk.ico
- %TEMP%\48528185\omf=jhk
- %TEMP%\48528185\ppj.ico
- %TEMP%\48528185\psp.docx
- %TEMP%\48528185\pwt.mp3
- %TEMP%\48528185\rln.pdf
- %TEMP%\48528185\som.dat
- %TEMP%\48528185\ssu.txt
- %TEMP%\48528185\tbf.pdf
- %TEMP%\48528185\npl.bmp
- %TEMP%\48528185\oeq.ico
- %TEMP%\48528185\teu.icm
- %TEMP%\48528185\tvn.pdf
- %TEMP%\48528185\uie.dat
- %TEMP%\48528185\urw.pdf
- %TEMP%\48528185\vhm.mp3
- %TEMP%\48528185\vqo.mp3
- %TEMP%\48528185\wdi.bmp
- %TEMP%\48528185\wqd.docx
- %TEMP%\48528185\wvp.mp4
- %TEMP%\48528185\tip.xl
- %TEMP%\48528185\tkg.docx
- %TEMP%\48528185\nob.ico
- %TEMP%\48528185\nnq.mp4
- %TEMP%\48528185\mgm.xl
- %TEMP%\48528185\bms.pdf
- %TEMP%\48528185\bra.ppt
- %TEMP%\48528185\buj.docx
- %TEMP%\48528185\cmd.xl
- %TEMP%\48528185\dcb.pdf
- %TEMP%\48528185\dkn.pdf
- %TEMP%\48528185\ebu.xl
- %TEMP%\48528185\ekk.dat
- %TEMP%\48528185\erh.ico
- %TEMP%\48528185\apv.icm
- %TEMP%\48528185\ggh.icm
- %TEMP%\48528185\hbn.txt
- %TEMP%\48528185\ife.exe
- %TEMP%\48528185\ihk.xl
- %TEMP%\48528185\kkp.txt
- %TEMP%\48528185\ktw.dat
- %TEMP%\48528185\kxv.ppt
- %TEMP%\48528185\lao.txt
- %TEMP%\48528185\lbc.jpg
- %TEMP%\48528185\lqv.mp3
- %TEMP%\48528185\ghb.txt
- %TEMP%\48528185\xjv.ico
- %TEMP%\48528185\xud.icm
Deletes the following files:
- %TEMP%\48528185\OOCHR
Network activity:
Connects to:
- '19#.#.99.170':2407
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\48528185\ife.exe' omf=jhk
- '%TEMP%\48528185\ife.exe' %TEMP%\48528185\OOCHR
- '%TEMP%\RegSvcs.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' <SYSTEM32>\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
