Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\46699962\qxpugdsr.exe %TEMP%\46699962\nuhlcxl.xhn'
Creates or modifies the following files
- <SYSTEM32>\tasks\udp subsystem
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
Modifies file system
Creates the following files
- %TEMP%\46699962\jepkp.xml
- %TEMP%\46699962\nlfm.msc
- %TEMP%\46699962\hvcirqvf.dat
- %TEMP%\46699962\xixrbdqe.cpl
- %TEMP%\46699962\ubsghg.txt
- %TEMP%\46699962\wltor.dll
- %TEMP%\46699962\jbxklv.msc
- %TEMP%\46699962\rawggcrpm.icm
- %TEMP%\46699962\fnkhuqt.pdf
- %TEMP%\46699962\oqxqovter.ini
- %TEMP%\46699962\veifelfx.xls
- %TEMP%\46699962\ikxtr.txt
- %TEMP%\46699962\pbgmgn.mp3
- %TEMP%\46699962\ofjaghdc.xml
- %TEMP%\46699962\hrrchq.dll
- %TEMP%\46699962\orrutvm.cpl
- %TEMP%\46699962\shqix.txt
- %TEMP%\46699962\lmaausiu.pdf
- %TEMP%\46699962\kdvem.ppt
- %TEMP%\46699962\upgskug.ico
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\run.dat
- %HOMEPATH%\temp\jepkp.xml
- %TEMP%\46699962\barcqpjh.icm
- %TEMP%\46699962\oacpwln.mp3
- %TEMP%\46699962\ihinvhf.xls
- %TEMP%\46699962\ngmlpwrew.ppt
- %TEMP%\46699962\xrncelc.jpg
- %TEMP%\46699962\vbwn.ico
- %TEMP%\46699962\wjodjva.xls
- %TEMP%\46699962\ahoj.xls
- %TEMP%\46699962\tuwawpf.xml
- %TEMP%\46699962\cdoncdkmu.icm
- %TEMP%\46699962\xlnke.jpg
- %TEMP%\46699962\djwi.icm
- %TEMP%\46699962\mefoqcq.msc
- %TEMP%\46699962\vvlv.cpl
- %TEMP%\46699962\jtbecog.dat
- %TEMP%\46699962\sqsb.exe
- %TEMP%\46699962\dhfd.bin
- %TEMP%\46699962\cpfgvnpo.ico
- %TEMP%\46699962\thgphlwbtl.icm
- %TEMP%\46699962\tefebtblfk.xml
- %TEMP%\46699962\tcusqb.xl
- %TEMP%\46699962\uibdorovg.jpg
- %TEMP%\46699962\qudjoi.xls
- %TEMP%\46699962\rdaptb.mp3
- %TEMP%\46699962\xiwhsksvi.bmp
- %TEMP%\46699962\gwitbsvqx.mp3
- %TEMP%\46699962\htnfigw.ini
- %TEMP%\46699962\vpbdnaufo.dll
- %TEMP%\46699962\qxpugdsr.exe
- %TEMP%\46699962\fgbpmewsh.vbs
- %TEMP%\46699962\nuhlcxl.xhn
- %TEMP%\46699962\awxtnovo.ini
- %TEMP%\46699962\rtwikedpt.txt
- %TEMP%\46699962\biuk.cpl
- %TEMP%\46699962\msjbisw.bmp
- %TEMP%\46699962\sxnti.cpl
- %TEMP%\46699962\nitt.exe
- %TEMP%\46699962\nppe.xls
- %TEMP%\46699962\rmkbvepccb.xml
- %TEMP%\46699962\gpht.txt
- %TEMP%\46699962\pceugwr.jpg
- %TEMP%\46699962\dqppqdln.log
- %TEMP%\46699962\hutq.xml
- %TEMP%\46699962\bratbgu.icm
- %TEMP%\tmpb6bf.tmp
- %TEMP%\46699962\frhrkqvc.msc
- %TEMP%\46699962\rwgskw.txt
- %TEMP%\46699962\ukrm.log
- %TEMP%\46699962\jtpex.jpg
- %TEMP%\46699962\vsqeesqw.docx
- %TEMP%\46699962\srritfeoo.dat
- %TEMP%\46699962\qfmoqevlqo.exe
- %TEMP%\46699962\elmbbnfdnk.msc
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\task.dat
Sets the 'hidden' attribute to the following files
- %TEMP%\46699962\qxpugdsr.exe
Deletes the following files
- %TEMP%\46699962\nuhlcxl.xhn
- %TEMP%\tmpb6bf.tmp
Network activity
UDP
- DNS ASK nc####new.hopto.org
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\46699962\fgbpmewsh.vbs"
- '%TEMP%\46699962\qxpugdsr.exe' nuhlcxl.xhn
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "UDP Subsystem" /xml "%TEMP%\tmpB6BF.tmp"
