Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <LS_APPDATA>\start\update_backup.exe
- <LS_APPDATA>\start\rcx1faf.tmp
Infects the following executable files
- <Drive name for removable media>:\notepad_backup.exe
Creates the following files on removable media
- <Drive name for removable media>:\bloc-notes.exe
- <Drive name for removable media>:\notepad_backup.exe
- <Drive name for removable media>:\rcxdb30.tmp
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Modifies file system
Creates the following files
- %TEMP%\iegspqw.resources
- %TEMP%\qgyig8t7.out
- %TEMP%\qgyig8t7.cmdline
- %TEMP%\qgyig8t7.0.vb
- %TEMP%\fnla.resources
- %TEMP%\dzt.resources
- %TEMP%\windowsupdate.ico
- %TEMP%\res1252.tmp
- %TEMP%\vbc1222.tmp
- %TEMP%\7vpzrryh.out
- %TEMP%\7vpzrryh.cmdline
- %TEMP%\7vpzrryh.0.vb
- %TEMP%\whatdafock.txt
- %TEMP%\dh.resources
- %TEMP%\gahu.resources
- %TEMP%\9rkuhd8j.exe
- %TEMP%\resc95.tmp
- %TEMP%\vbcc85.tmp
- %TEMP%\9rkuhd8j.out
- %TEMP%\9rkuhd8j.cmdline
- %TEMP%\9rkuhd8j.0.vb
- %TEMP%\msnpsharp.dll
- %TEMP%\mir17s7.resources
- <LS_APPDATA>\start\update.exe
- %TEMP%\svchost.exe
- %TEMP%\update.exe
- %TEMP%\vbcd90c.tmp
- %TEMP%\resd92c.tmp
Deletes the following files
- %TEMP%\resc95.tmp
- %TEMP%\qgyig8t7.cmdline
- %TEMP%\qgyig8t7.out
- %TEMP%\qgyig8t7.0.vb
- %TEMP%\vbcd90c.tmp
- %TEMP%\resd92c.tmp
- <LS_APPDATA>\start\update.exe
- %TEMP%\windowsupdate.ico
- %TEMP%\dh.resources
- %TEMP%\gahu.resources
- %TEMP%\7vpzrryh.0.vb
- %TEMP%\7vpzrryh.out
- %TEMP%\7vpzrryh.cmdline
- %TEMP%\vbc1222.tmp
- %TEMP%\res1252.tmp
- %TEMP%\9rkuhd8j.exe
- %TEMP%\9rkuhd8j.out
- %TEMP%\9rkuhd8j.0.vb
- %TEMP%\9rkuhd8j.cmdline
- %TEMP%\vbcc85.tmp
- %TEMP%\dzt.resources
- %TEMP%\fnla.resources
Substitutes the following executable files
- <Drive name for removable media>:\notepad.exe
Substitutes the following files
- %TEMP%\windowsupdate.ico
Network activity
Connects to
- '17#.#3.169.14':80
Miscellaneous
Creates and executes the following
- '%TEMP%\update.exe'
- '%TEMP%\svchost.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9rkuhd8j.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC95.tmp" "%TEMP%\vbcC85.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7vpzrryh.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1252.tmp" "%TEMP%\vbc1222.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qgyig8t7.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD92C.tmp" "%TEMP%\vbcD90C.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9rkuhd8j.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC95.tmp" "%TEMP%\vbcC85.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\7vpzrryh.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1252.tmp" "%TEMP%\vbc1222.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qgyig8t7.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD92C.tmp" "%TEMP%\vbcD90C.tmp"
