Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\ccleaner\cleaner.exe
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\split.avi.exe
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\join.avi.exe
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\toolbar.bmp.exe
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
Modifies file system
Creates the following files
- %PROGRAMDATA%\ccleaner\split.ico
- %TEMP%\vbc946db81a72c54c7f838f4a6a4d32c35.tmp
- %APPDATA%\compiler_x64.exe
- %TEMP%\aftwf0fp.out
- %TEMP%\aftwf0fp.cmdline
- %TEMP%\aftwf0fp.0.vb
- %PROGRAMDATA%\ccleaner\toolbar.ico
- %TEMP%\resb634.tmp
- %TEMP%\vbcadfa1dd4201948cda0783ff3f64e80.tmp
- %TEMP%\vbc3b406c6a2d544efe91d1e7aca15a215b.tmp
- %TEMP%\lyhmwduj.out
- %TEMP%\lyhmwduj.cmdline
- %TEMP%\lyhmwduj.0.vb
- %PROGRAMDATA%\ccleaner\join.ico
- %TEMP%\resb190.tmp
- %TEMP%\vbc8309a22e6b534780988eb7ecb049dfc4.tmp
- %TEMP%\vbc809dbbcd89674e32bc43c8147be1c3b.tmp
- %TEMP%\vhyednvw.out
- %TEMP%\vhyednvw.cmdline
- %TEMP%\vhyednvw.0.vb
- %TEMP%\vbcfc2080749e19415e9bafef265d5022ff.tmp
- %TEMP%\resbb35.tmp
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\ccleaner\cleaner.exe
Deletes the following files
- %TEMP%\resb190.tmp
- %TEMP%\vbc8309a22e6b534780988eb7ecb049dfc4.tmp
- %TEMP%\vbc809dbbcd89674e32bc43c8147be1c3b.tmp
- %TEMP%\vhyednvw.out
- %TEMP%\vhyednvw.cmdline
- %TEMP%\vhyednvw.0.vb
- %TEMP%\resb634.tmp
- %TEMP%\vbcadfa1dd4201948cda0783ff3f64e80.tmp
- %TEMP%\vbc3b406c6a2d544efe91d1e7aca15a215b.tmp
- %TEMP%\lyhmwduj.cmdline
- %TEMP%\lyhmwduj.0.vb
- %TEMP%\lyhmwduj.out
- %TEMP%\aftwf0fp.cmdline
- %TEMP%\resbb35.tmp
- %TEMP%\vbcfc2080749e19415e9bafef265d5022ff.tmp
- %TEMP%\vbc946db81a72c54c7f838f4a6a4d32c35.tmp
Network activity
Connects to
- 'uo####7.ddns.net':2222
- 'uo####11.ddns.net':2222
UDP
- DNS ASK uo####7.ddns.net
- DNS ASK uo####11.ddns.net
Miscellaneous
Creates and executes the following
- '%APPDATA%\compiler_x64.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\vhyednvw.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB190.tmp" "%TEMP%\vbc8309A22E6B534780988EB7ECB049DFC4.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\lyhmwduj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB634.tmp" "%TEMP%\vbcADFA1DD4201948CDA0783FF3F64E80.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\aftwf0fp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB35.tmp" "%TEMP%\vbcFC2080749E19415E9BAFEF265D5022FF.TMP"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\vhyednvw.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB190.tmp" "%TEMP%\vbc8309A22E6B534780988EB7ECB049DFC4.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\lyhmwduj.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB634.tmp" "%TEMP%\vbcADFA1DD4201948CDA0783FF3F64E80.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\aftwf0fp.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB35.tmp" "%TEMP%\vbcFC2080749E19415E9BAFEF265D5022FF.TMP"
