Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%ProgramFiles%\Intel\ResA32.dll'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%ProgramFiles%\Intel\ResA64.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\DNSConnect] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\DNSConnect] 'ImagePath' = '<SYSTEM32>\svchost.exe -k NetWorkConnect'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\DNSConnect\Parameters] 'ServiceDll' = '%ProgramFiles%\Intel\ResA32.dll'
Modifies file system
Creates the following files
- %TEMP%\resa.dat
- %WINDIR%\temp\___bf7f.tmp
- %WINDIR%\temp\tembf9f.tmp
- %WINDIR%\temp\___bfa0.tmp
- C:\users\public\downloads\update\glp.uin
- C:\users\public\downloads\update\dtl.dat
- %WINDIR%\temp\tembfc1.tmp
- %WINDIR%\temp\___bfc2.tmp
- %WINDIR%\temp\tembff1.tmp
- %WINDIR%\temp\temc003.tmp
- %ProgramFiles%\intel\resa.dat
- %WINDIR%\temp\___c004.tmp
- C:\users\public\downloads\update\pldc082.tmp
- C:\users\public\downloads\update\utd_ce31\kb1032406_pldc082.tmp.bmp
- C:\users\public\downloads\update\dc0f0.tmp
- C:\users\public\downloads\update\utd_ce31\kb1032437_dc0f0.tmp.bmp
- C:\users\public\downloads\update\dc101.tmp
- C:\users\public\downloads\update\utd_ce31\kb1032453_dc101.tmp.bmp
- C:\users\public\downloads\update\dc112.tmp
- %WINDIR%\temp\tembf7e.tmp
- %WINDIR%\temp\___bff2.tmp
- %PROGRAMDATA%\intel\resa0.dat
- %PROGRAMDATA%\intel\bvfd15.dat
- %TEMP%\tembca0.tmp
- %TEMP%\___bca1.tmp
- %TEMP%\dllloader.dll
- %TEMP%\insta.dat
- %TEMP%\tembde8.tmp
- %TEMP%\___bde9.tmp
- %PROGRAMDATA%\intel\gsds5.dat
- %PROGRAMDATA%\intel\gf546.dat
- %PROGRAMDATA%\intel\gdf5.dat
- %PROGRAMDATA%\intel\resa64.dll
- %PROGRAMDATA%\intel\litter.dat
- %PROGRAMDATA%\intel\data\dtl.dat
- %PROGRAMDATA%\intel\data\glp.uin
- %PROGRAMDATA%\intel\resa.dat
- %TEMP%\tembe38.tmp
- %TEMP%\___be39.tmp
- %TEMP%\___be4a.tmp
- %PROGRAMDATA%\intel\resa32.dll
- %PROGRAMDATA%\intel\nrtdfc.dat
- C:\users\public\downloads\update\mot.dat
Deletes the following files
- %TEMP%\tembca0.tmp
- C:\users\public\downloads\update\utd_ce31\kb1032406_pldc082.tmp.bmp
- %WINDIR%\temp\___c004.tmp
- %WINDIR%\temp\temc003.tmp
- %WINDIR%\temp\___bff2.tmp
- %WINDIR%\temp\tembff1.tmp
- %WINDIR%\temp\___bfc2.tmp
- %WINDIR%\temp\tembfc1.tmp
- %WINDIR%\temp\___bfa0.tmp
- %WINDIR%\temp\tembf9f.tmp
- C:\users\public\downloads\update\utd_ce31\kb1032437_dc0f0.tmp.bmp
- %WINDIR%\temp\___bf7f.tmp
- %PROGRAMDATA%\intel\resa.dat
- %TEMP%\___be4a.tmp
- %TEMP%\___be39.tmp
- %TEMP%\tembe38.tmp
- %PROGRAMDATA%\intel\litter.dat
- %TEMP%\___bde9.tmp
- %TEMP%\tembde8.tmp
- %TEMP%\resa.dat
- %TEMP%\___bca1.tmp
- %WINDIR%\temp\tembf7e.tmp
- C:\users\public\downloads\update\utd_ce31\kb1032453_dc101.tmp.bmp
Substitutes the following files
- %PROGRAMDATA%\intel\resa.dat
Network activity
Connects to
- '60.##.161.70':8080
Miscellaneous
Creates and executes the following
- '<Full path to file>' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' %TEMP%\DllLoader.dll,Run %TEMP%\InstA.dat Install "<Full path to file> %TEMP%\DllLoader.dll %TEMP%\InstA.dat"
- '%WINDIR%\syswow64\svchost.exe' -k NetWorkConnect
