Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\94815342\lepkg.com %TEMP%\94815342\HLABUN~1.GXE'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'UPNP Service' = '%ProgramFiles%\UPNP Service\upnpsvc.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Injects code into
the following user processes:
- regsvcs.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\mshta.exe
Modifies file system
Creates the following files
- %TEMP%\94815342\ghwgcurght.mp3
- %TEMP%\94815342\bhvfgup.jpg
- %TEMP%\94815342\ttqhevlfg.txt
- %TEMP%\94815342\npoqpgx.log
- %TEMP%\94815342\plgqethc.mp3
- %TEMP%\94815342\tjirrqrxbk.xls
- %TEMP%\94815342\llim.ini
- %TEMP%\94815342\mlvxrch.msc
- %TEMP%\94815342\wdoqstwhki.xl
- %TEMP%\94815342\iunidw.icm
- %TEMP%\94815342\tguoxh.txt
- %TEMP%\94815342\kjsiecxe.xls
- %TEMP%\94815342\uepua.dat
- %TEMP%\94815342\vcqompoc.xml
- %TEMP%\94815342\kuplw.ppt
- %TEMP%\94815342\eppdswm.xl
- %TEMP%\94815342\xaebddokv.dat
- %TEMP%\94815342\ojik.msc
- %TEMP%\94815342\igspuxf.msc
- %TEMP%\94815342\dtcxk.bmp
- %TEMP%\94815342\cawx.ppt
- %TEMP%\94815342\bfqe.exe
- %TEMP%\94815342\apnghop.ini
- %TEMP%\94815342\lgewafrifg.icm
- %TEMP%\94815342\chtdmgb.jpg
- %HOMEPATH%\temp\ghwgcurght.mp3
- %TEMP%\94815342\ini
- %TEMP%\regsvcs.exe
- %TEMP%\94815342\djqnjbksno.exe
- %TEMP%\94815342\liil.ini
- %TEMP%\94815342\qbqb.jpg
- %TEMP%\94815342\lkqbkgs.dat
- %TEMP%\94815342\mjrrapo.txt
- %TEMP%\94815342\lepkg.com
- %TEMP%\94815342\hkqlaklwt.txt
- %TEMP%\94815342\egctk.icm
- %TEMP%\94815342\mnxl.docx
- %TEMP%\94815342\gigxevguw.txt
- %TEMP%\94815342\vqnawp.cpl
- %TEMP%\94815342\ftpcvobvnu.mp3
- %TEMP%\94815342\cjrbeos.log
- %TEMP%\94815342\pcourxvops.exe
- %TEMP%\94815342\fsfxirmbd.ini
- %TEMP%\94815342\vbgoalsi.docx
- %TEMP%\94815342\mokfjewlf.pdf
- %TEMP%\94815342\oiuwvreu.jpg
- %TEMP%\94815342\hlabunfafk.gxe
- %TEMP%\94815342\vapfus.ppt
- %TEMP%\94815342\ueffxhde.log
- %TEMP%\94815342\rovwojik.xl
- %TEMP%\94815342\nxqepcgoqe.cpl
- %TEMP%\94815342\idafmbn.pdf
- %TEMP%\94815342\tfvgkawpjq.dll
- %TEMP%\94815342\mpka.cpl
- %TEMP%\94815342\mucith.bin
- %TEMP%\94815342\jvsct.jpg
- %TEMP%\94815342\genfsx.ini
- %TEMP%\94815342\frcpakbbef.xl
- %TEMP%\94815342\clpncnhrh.exe
- %TEMP%\94815342\rmvhi.ppt
- %TEMP%\94815342\kikiipvo.msc
- %TEMP%\94815342\ddsewgg.icm
- %APPDATA%\597d9903-ea81-40e6-803a-40d3e5258fa4\run.dat
- %ProgramFiles%\upnp service\upnpsvc.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\94815342\lepkg.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\94815342\lepkg.com' hlabunfafk.gxe
- '%TEMP%\regsvcs.exe'
Executes the following
- '<SYSTEM32>\mshta.exe'
- '<SYSTEM32>\schtasks.exe' /create /f /tn "UPNP Service" /xml "%TEMP%\tmp624.tmp"
- '<SYSTEM32>\schtasks.exe' /create /f /tn "UPNP Service Task" /xml "%TEMP%\tmp7C9.tmp"
