Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\iwliivlrzn.lnk
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Google\Google Talk\Accounts]
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Identities\{91255D00-95D9-49F5-8E84-7C027F5283B7}\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKCU>\Identities\{91255D00-95D9-49F5-8E84-7C027F5283B7}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Software\Microsoft\MSNMessenger]
- [<HKCU>\Software\Yahoo\Pager]
- [<HKCU>\Software\Microsoft\IdentityCRL]
- [<HKCU>\Software\Microsoft\Windows Live Mail]
Searches for windows to
detect programs and games:
- ClassName: '', WindowName: 'Yahoo! Messenger'
Modifies file system
Creates the following files
- %APPDATA%\qhjklnnl94gd\8783.xml
- %TEMP%\gv1dmoyazg.ini
- %TEMP%\zqvyxwce7b.ini
- %TEMP%\nycz83ln74.ini
- %TEMP%\j1kuc8imga.ini
- %TEMP%\m33evaezka.ini
Deletes the following files
- %TEMP%\gv1dmoyazg.ini
- %TEMP%\zqvyxwce7b.ini
- %TEMP%\nycz83ln74.ini
- %TEMP%\j1kuc8imga.ini
- %TEMP%\m33evaezka.ini
Moves the following files
- from %APPDATA%\qhjklnnl94gd\8783.xml to %APPDATA%\qhjklnnl94gd\e8hii9f.exe
Network activity
UDP
- DNS ASK vi#######tmovies.allalla.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /scomma "%TEMP%\gv1dmOYaZG.ini"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /scomma "%TEMP%\pmADdAuWLN.ini"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /scomma "%TEMP%\ZqVYxwcE7B.ini"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /scomma "%TEMP%\PnmQtecuYY.ini"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /scomma "%TEMP%\nYCz83Ln74.ini"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /scomma "%TEMP%\h896MgANuA.ini"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /scomma "%TEMP%\J1kUC8IMGA.ini"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /scomma "%TEMP%\ZL9JEdgk5y.ini"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /scomma "%TEMP%\M33EvAezKA.ini"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /scomma "%TEMP%\jSz7m6yja2.ini"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /scomma "%TEMP%\2eL8t76eIP.ini"
