Technical Information
Modifies file system
Creates the following files
- <Current directory>\504y08y448.exe
- %TEMP%\n3l53n4t.out
- %TEMP%\n3l53n4t.cmdline
- %TEMP%\n3l53n4t.0.vb
- %TEMP%\res7.tmp
- %TEMP%\vbc6.tmp
- %TEMP%\pmmy2ih1.out
- %TEMP%\pmmy2ih1.cmdline
- %TEMP%\pmmy2ih1.0.vb
- %TEMP%\vbcb.tmp
- <Current directory>\user 06a5b6909.res
- <Current directory>\res.log
- <Current directory>\user 06a5b6909.exe
- %TEMP%\res2.tmp
- %TEMP%\vbc1.tmp
- %TEMP%\0iijuj5g.out
- %TEMP%\0iijuj5g.cmdline
- %TEMP%\0iijuj5g.0.vb
- <Current directory>\res.exe
- <Current directory>\res.ini
- %TEMP%\resc.tmp
Deletes the following files
- %TEMP%\res2.tmp
- %TEMP%\n3l53n4t.cmdline
- %TEMP%\vbcb.tmp
- %TEMP%\resc.tmp
- %TEMP%\pmmy2ih1.out
- %TEMP%\pmmy2ih1.cmdline
- %TEMP%\pmmy2ih1.0.vb
- %TEMP%\vbc6.tmp
- %TEMP%\res7.tmp
- <Current directory>\res.ini
- <Current directory>\res.log
- <Current directory>\res.exe
- <Current directory>\user 06a5b6909.res
- <Current directory>\user 06a5b6909.exe
- %TEMP%\0iijuj5g.0.vb
- %TEMP%\0iijuj5g.out
- %TEMP%\0iijuj5g.cmdline
- %TEMP%\vbc1.tmp
- %TEMP%\n3l53n4t.out
- %TEMP%\n3l53n4t.0.vb
Moves the following files
- from <Current directory>\504y08y448.exe to C:\users\user\desktop\user 504y08y448.exe
Substitutes the following files
- <Current directory>\res.exe
- <Current directory>\user 06a5b6909.exe
- <Current directory>\res.log
- <Current directory>\res.ini
- <Current directory>\user 06a5b6909.res
Modifies the HOSTS file.
Deletes itself.
Network activity
UDP
- DNS ASK en###eles.net
- DNS ASK fa###ook.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following
- '<Current directory>\res.exe' -extract <Current directory>\user 06A5B6909.exe,<Current directory>\user 06A5B6909.res,VERSIONINFO,,
- '<Current directory>\res.exe' -delete <Current directory>\504Y08Y448.exe,<Current directory>\res.exe,VERSIONINFO,,
- '<Current directory>\res.exe' -addoverwrite <Current directory>\504Y08Y448.exe,<Current directory>\504Y08Y448.exe,<Current directory>\user 06A5B6909.res,VERSIONINFO,1,
- 'C:\users\user\desktop\user 504y08y448.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0iijuj5g.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\vbc1.tmp"' (with hidden window)
- '<Current directory>\res.exe' -extract <Current directory>\user 06A5B6909.exe,<Current directory>\user 06A5B6909.res,VERSIONINFO,,' (with hidden window)
- '<Current directory>\res.exe' -delete <Current directory>\504Y08Y448.exe,<Current directory>\res.exe,VERSIONINFO,,' (with hidden window)
- '<Current directory>\res.exe' -addoverwrite <Current directory>\504Y08Y448.exe,<Current directory>\504Y08Y448.exe,<Current directory>\user 06A5B6909.res,VERSIONINFO,1,' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pmmy2ih1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7.tmp" "%TEMP%\vbc6.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\n3l53n4t.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC.tmp" "%TEMP%\vbcB.tmp"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 5 & Del "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0iijuj5g.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\vbc1.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pmmy2ih1.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7.tmp" "%TEMP%\vbc6.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\n3l53n4t.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC.tmp" "%TEMP%\vbcB.tmp"
- '<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 5 & Del "<Full path to file>"
