Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\46139151\mxeudb.bat %TEMP%\46139151\rctr.ees'
Malicious functions
Injects code into
the following user processes:
- regsvcs.exe
Modifies file system
Creates the following files
- %TEMP%\46139151\oxcjh.log
- %TEMP%\46139151\rqbserxg.bin
- %TEMP%\46139151\kcjpi.ppt
- %TEMP%\46139151\owujkv.pdf
- %TEMP%\46139151\npdmhohjtw.ico
- %TEMP%\46139151\bdmppw.bin
- %TEMP%\46139151\klsnb.cpl
- %TEMP%\46139151\ackmv.jpg
- %TEMP%\46139151\mbqfjxdoj.xls
- %TEMP%\46139151\oioikugem.docx
- %TEMP%\46139151\nmcsw.dat
- %TEMP%\46139151\vggwj.pdf
- %TEMP%\46139151\jgjligqqc.msc
- %TEMP%\46139151\jemm.bin
- %TEMP%\46139151\flltgw.jpg
- %TEMP%\46139151\ufbehu.docx
- %TEMP%\46139151\idwdbodvt.icm
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\storage.dat
- %TEMP%\46139151\otehqvwsj.ini
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\catalog.dat
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\run.dat
- %TEMP%\regsvcs.exe
- %HOMEPATH%\temp\oxcjh.log
- %TEMP%\46139151\bommrjkx.bmp
- %TEMP%\46139151\xhiwbjf.bmp
- %TEMP%\46139151\npfa.dat
- %TEMP%\46139151\ivkkdnf.dat
- %TEMP%\46139151\hflcdhp.mp3
- %TEMP%\46139151\iqgowbtnsh.txt
- %TEMP%\46139151\kwhiqrkhh.xml
- %TEMP%\46139151\qaieok.ini
- %TEMP%\46139151\jwouigirsw.pdf
- %TEMP%\46139151\viaxstdh.xml
- %TEMP%\46139151\bhkewbhlc.txt
- %TEMP%\46139151\qsrdvivdj.xl
- %TEMP%\46139151\gbgnxhe.log
- %TEMP%\46139151\bvqnj.ico
- %TEMP%\46139151\oaqknbe.msc
- %TEMP%\46139151\mqcl.bin
- %TEMP%\46139151\mcqforuq.mp3
- %TEMP%\46139151\divhs.log
- %TEMP%\46139151\pakj.jpg
- %TEMP%\46139151\bhjscjnihu.cpl
- %TEMP%\46139151\dgklrvc.cpl
- %TEMP%\46139151\ihwfmowtix.bmp
- %TEMP%\46139151\exda.ico
- %TEMP%\46139151\jnmbubn.ppt
- %TEMP%\46139151\elist.ini
- %TEMP%\46139151\uwvgo.bin
- %TEMP%\46139151\mxeudb.bat
- %TEMP%\46139151\rctr.ees
- %TEMP%\46139151\mius.mp3
- %TEMP%\46139151\mxjtbkgbs.log
- %TEMP%\46139151\mcxhhbxpwr.dll
- %TEMP%\46139151\uuvxirgoe.xl
- %TEMP%\46139151\inuoocijr.cpl
- %TEMP%\46139151\mehailguah.exe
- %TEMP%\46139151\vfhvpndno.xls
- %TEMP%\46139151\smji.ico
- %TEMP%\46139151\slxsrskck.txt
- %TEMP%\46139151\ukrlvkw.exe
- %TEMP%\46139151\qhibs.icm
- %TEMP%\46139151\ibuh.dat
- %TEMP%\46139151\mgorvqe.xl
- %TEMP%\46139151\ifcewqw.icm
- %TEMP%\46139151\aootxuues.mp3
- %TEMP%\46139151\creivdjqk.msc
- %TEMP%\46139151\dlstha.mp3
- %TEMP%\46139151\dnukvx.log
- %TEMP%\46139151\vxldbkl.ico
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\settings.bin
Sets the 'hidden' attribute to the following files
- %TEMP%\46139151\mxeudb.bat
Network activity
UDP
- DNS ASK hu#####e.tjsosda.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\46139151\mxeudb.bat' rctr.ees
- '%TEMP%\regsvcs.exe'
