Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\djdbfhfi.lnk
- <SYSTEM32>\tasks\opera scheduled autoupdate 711520318
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\hrgquuzy] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\hrgquuzy] 'ImagePath' = '%WINDIR%\SysWOW64\hrgquuzy\mohszhvl.exe /d"%TEMP%\99B1.tmp.exe"'
Modifies master boot record (MBR).
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\djdbfhfi\vgdutaja.exe
- %TEMP%\99b1.tmp.exe
- %TEMP%\b077.tmp.exe
- %TEMP%\mohszhvl.exe
- %TEMP%\c884.tmp.exe
- %TEMP%\649.tmp.exe
- %TEMP%\<INETFILES>\content.ie5\index.dat
- %TEMP%\<INETFILES>\content.ie5\desktop.ini
- %TEMP%\cookies\index.dat
- %TEMP%\history\history.ie5\index.dat
- %TEMP%\history\history.ie5\desktop.ini
- %HOMEPATH%\wihvgqys.exe
- %TEMP%\2246.bat
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\djdbfhfi\vgdutaja.exe
- %TEMP%\<INETFILES>\content.ie5\desktop.ini
Deletes the following files
- %HOMEPATH%\wihvgqys.exe
Moves the following files
- from %TEMP%\mohszhvl.exe to %WINDIR%\syswow64\hrgquuzy\mohszhvl.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.ms###csi.com/ncsi.txt
- http://37.##.127.236/2.php
- http://sa###kha1n.xyz/him.exe
HTTP POST requests
- http://cl####leankkl.net/
UDP
- DNS ASK gh###8kjhb.net
- DNS ASK cl####leankkl.net
- DNS ASK sa###kha1n.xyz
- DNS ASK ap#.2ip.ua
Miscellaneous
Creates and executes the following
- '%TEMP%\99b1.tmp.exe'
- '%TEMP%\b077.tmp.exe'
- '%TEMP%\c884.tmp.exe'
- '%TEMP%\649.tmp.exe'
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\hrgquuzy\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\mohszhvl.exe" %WINDIR%\SysWOW64\hrgquuzy\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create hrgquuzy binPath= "%WINDIR%\SysWOW64\hrgquuzy\mohszhvl.exe /d\"%TEMP%\99B1.tmp.exe\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description hrgquuzy "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start hrgquuzy' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\hrgquuzy\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\mohszhvl.exe" %WINDIR%\SysWOW64\hrgquuzy\
- '%WINDIR%\syswow64\sc.exe' create hrgquuzy binPath= "%WINDIR%\SysWOW64\hrgquuzy\mohszhvl.exe /d\"%TEMP%\99B1.tmp.exe\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description hrgquuzy "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start hrgquuzy
