Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\44005577\pto.exe %TEMP%\44005577\plf=arv'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Injects code into
the following user processes:
- RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\44005577\gpl.mp3
- %TEMP%\44005577\jmk.dat
- %TEMP%\44005577\iie.docx
- %TEMP%\44005577\jts.docx
- %TEMP%\44005577\uxt.jpg
- %TEMP%\44005577\akx.jpg
- %TEMP%\44005577\pqo.docx
- %TEMP%\44005577\uno.docx
- %TEMP%\44005577\swa.txt
- %TEMP%\44005577\ogv.jpg
- %TEMP%\44005577\eho.icm
- %TEMP%\RegSvcs.exe
- %TEMP%\44005577\nuo.jpg
- %TEMP%\44005577\vxo.pdf
- %TEMP%\44005577\wsj.mp4
- %TEMP%\44005577\geh.mp3
- %TEMP%\44005577\afb.dat
- %TEMP%\44005577\chh.pdf
- %TEMP%\44005577\vdf.xl
- %TEMP%\44005577\npm.pdf
- %TEMP%\44005577\NGLZO
- %TEMP%\44005577\exs.dat
- %TEMP%\44005577\ood.bmp
- %TEMP%\44005577\exe.xl
- %TEMP%\44005577\hlk.bmp
- %TEMP%\44005577\plf=arv
- %TEMP%\44005577\pto.exe
- %TEMP%\44005577\sse.jpg
- %TEMP%\44005577\xrc.ico
- %TEMP%\44005577\brq.jpg
- %TEMP%\44005577\qar.mp3
- %TEMP%\44005577\mos.pdf
- %TEMP%\44005577\tbp.dat
- %TEMP%\44005577\juu.icm
- %TEMP%\44005577\dpc.dat
- %TEMP%\44005577\ocp.xl
- %TEMP%\44005577\iqr.ico
- %TEMP%\44005577\bfo.mp3
- %TEMP%\44005577\nen.pdf
- %TEMP%\44005577\wgu.xl
- %TEMP%\44005577\ipx.pdf
- %TEMP%\44005577\keq.dat
- %TEMP%\44005577\lft.xl
- %TEMP%\44005577\wjw.xl
- %TEMP%\44005577\brq.xl
- %TEMP%\44005577\jua.mp4
- %APPDATA%\remcos\logs.dat
Sets the 'hidden' attribute to the following files:
- %TEMP%\44005577\afb.dat
- %TEMP%\44005577\nuo.jpg
- %TEMP%\44005577\ocp.xl
- %TEMP%\44005577\ogv.jpg
- %TEMP%\44005577\ood.bmp
- %TEMP%\44005577\plf=arv
- %TEMP%\44005577\pqo.docx
- %TEMP%\44005577\pto.exe
- %TEMP%\44005577\nen.pdf
- %TEMP%\44005577\npm.pdf
- %TEMP%\44005577\qar.mp3
- %TEMP%\44005577\tbp.dat
- %TEMP%\44005577\uno.docx
- %TEMP%\44005577\uxt.jpg
- %TEMP%\44005577\vdf.xl
- %TEMP%\44005577\vxo.pdf
- %TEMP%\44005577\wgu.xl
- %TEMP%\44005577\wjw.xl
- %TEMP%\44005577\sse.jpg
- %TEMP%\44005577\swa.txt
- %TEMP%\44005577\mos.pdf
- %TEMP%\44005577\lft.xl
- %TEMP%\44005577\keq.dat
- %TEMP%\44005577\bfo.mp3
- %TEMP%\44005577\brq.jpg
- %TEMP%\44005577\brq.xl
- %TEMP%\44005577\chh.pdf
- %TEMP%\44005577\dpc.dat
- %TEMP%\44005577\eho.icm
- %TEMP%\44005577\exe.xl
- %TEMP%\44005577\exs.dat
- %TEMP%\44005577\akx.jpg
- %TEMP%\44005577\geh.mp3
- %TEMP%\44005577\hlk.bmp
- %TEMP%\44005577\iie.docx
- %TEMP%\44005577\ipx.pdf
- %TEMP%\44005577\iqr.ico
- %TEMP%\44005577\jmk.dat
- %TEMP%\44005577\jts.docx
- %TEMP%\44005577\jua.mp4
- %TEMP%\44005577\juu.icm
- %TEMP%\44005577\gpl.mp3
- %TEMP%\44005577\wsj.mp4
- %TEMP%\44005577\xrc.ico
Deletes the following files:
- %TEMP%\44005577\NGLZO
Network activity:
Connects to:
- '19#.#.99.170':2407
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\44005577\pto.exe' plf=arv
- '%TEMP%\44005577\pto.exe' %TEMP%\44005577\NGLZO
- '%TEMP%\RegSvcs.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' <SYSTEM32>\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
