Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\join.avi
Modifies file system
Creates the following files
- C:\system322\system32.exe
- %TEMP%\res684e.tmp
- C:\msocache.exe
- %TEMP%\lusma3sm.0.vb
- %TEMP%\lusma3sm.cmdline
- %TEMP%\lusma3sm.out
- %TEMP%\vbc6cf1.tmp
- %TEMP%\res6cf2.tmp
- %TEMP%\gp7godqo.out
- C:\perflogs.exe
- %TEMP%\wcdt-hgl.cmdline
- %TEMP%\wcdt-hgl.out
- %TEMP%\vbc70c9.tmp
- %TEMP%\res70ca.tmp
- %ProgramFiles%.exe
- %TEMP%\rf9ckdgs.0.vb
- %TEMP%\rf9ckdgs.cmdline
- %TEMP%\guyzsvbd.out
- %TEMP%\vbc684d.tmp
- %TEMP%\guyzsvbd.cmdline
- %TEMP%\guyzsvbd.0.vb
- C:\far2.exe
- %TEMP%\vywgiagv.0.vb
- %TEMP%\vywgiagv.cmdline
- %TEMP%\vywgiagv.out
- %TEMP%\vbc5850.tmp
- %TEMP%\res5851.tmp
- C:\$recycle.bin.exe
- %TEMP%\gp7godqo.0.vb
- %TEMP%\rf9ckdgs.out
- %TEMP%\wcdt-hgl.0.vb
- %TEMP%\gp7godqo.cmdline
- %TEMP%\res5d81.tmp
- C:\documents and settings.exe
- %TEMP%\y-tp8cyk.0.vb
- %TEMP%\y-tp8cyk.cmdline
- %TEMP%\y-tp8cyk.out
- %TEMP%\vbc62b0.tmp
- %TEMP%\res62b1.tmp
- %PROGRAMDATA%\system322\sunowruugh.ico
- %TEMP%\vbc5d70.tmp
- %APPDATA%\update.exe
Sets the 'hidden' attribute to the following files
- C:\system322\system32.exe
Deletes the following files
- %TEMP%\res5851.tmp
- %TEMP%\wcdt-hgl.out
- %TEMP%\wcdt-hgl.cmdline
- %TEMP%\wcdt-hgl.0.vb
- %TEMP%\vbc70c9.tmp
- %TEMP%\res70ca.tmp
- %TEMP%\lusma3sm.0.vb
- %TEMP%\lusma3sm.cmdline
- %TEMP%\lusma3sm.out
- %TEMP%\vbc6cf1.tmp
- %TEMP%\res6cf2.tmp
- %TEMP%\guyzsvbd.0.vb
- %TEMP%\guyzsvbd.cmdline
- %TEMP%\guyzsvbd.out
- %TEMP%\vbc684d.tmp
- %TEMP%\res684e.tmp
- %TEMP%\y-tp8cyk.out
- %TEMP%\y-tp8cyk.0.vb
- %TEMP%\y-tp8cyk.cmdline
- %TEMP%\vbc62b0.tmp
- %TEMP%\res62b1.tmp
- %TEMP%\gp7godqo.out
- %TEMP%\gp7godqo.0.vb
- %TEMP%\gp7godqo.cmdline
- %TEMP%\vbc5d70.tmp
- %TEMP%\res5d81.tmp
- %TEMP%\vywgiagv.out
- %TEMP%\vywgiagv.cmdline
- %TEMP%\vywgiagv.0.vb
- %TEMP%\vbc5850.tmp
- %TEMP%\rf9ckdgs.cmdline
- %TEMP%\rf9ckdgs.0.vb
Network activity
UDP
- DNS ASK sn####at.sytes.net
- DNS ASK sn####at1.sytes.net
- DNS ASK sn####at2.sytes.net
- DNS ASK sn####at3.sytes.net
- DNS ASK sn####at4.sytes.net
- DNS ASK sn####at5.sytes.net
- DNS ASK dw#####scmksacasmk.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\update.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vywgiagv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dmcysbhy.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES24B9.tmp" "%TEMP%\vbc24A8.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\khslcqdo.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ppf1c0v7.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rf9ckdgs.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES70CA.tmp" "%TEMP%\vbc70C9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wcdt-hgl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6CF2.tmp" "%TEMP%\vbc6CF1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lusma3sm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES684E.tmp" "%TEMP%\vbc684D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\guyzsvbd.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES62B1.tmp" "%TEMP%\vbc62B0.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y-tp8cyk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5D81.tmp" "%TEMP%\vbc5D70.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gp7godqo.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5851.tmp" "%TEMP%\vbc5850.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES27F5.tmp" "%TEMP%\vbc27F4.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uk9qguor.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\vywgiagv.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dmcysbhy.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES24B9.tmp" "%TEMP%\vbc24A8.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\khslcqdo.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ppf1c0v7.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rf9ckdgs.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES70CA.tmp" "%TEMP%\vbc70C9.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wcdt-hgl.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES27F5.tmp" "%TEMP%\vbc27F4.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6CF2.tmp" "%TEMP%\vbc6CF1.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES684E.tmp" "%TEMP%\vbc684D.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\guyzsvbd.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES62B1.tmp" "%TEMP%\vbc62B0.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\y-tp8cyk.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5D81.tmp" "%TEMP%\vbc5D70.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gp7godqo.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5851.tmp" "%TEMP%\vbc5850.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lusma3sm.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uk9qguor.cmdline"
