Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, <Current directory>\svchost32.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, <Current directory>\svchost32.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\0fb9655100a67ae19674de964588ae42
- <SYSTEM32>\tasks\l5rcwctu
- <SYSTEM32>\tasks\5ovb2vpe
- <SYSTEM32>\tasks\lcvapwfm
- <SYSTEM32>\tasks\tdsmep1e
- <SYSTEM32>\tasks\u5mesplq
- <SYSTEM32>\tasks\twgnxqns
- <SYSTEM32>\tasks\go5ohzha
- <SYSTEM32>\tasks\zfrwmrou
- <SYSTEM32>\tasks\oe4wcf0k
- <SYSTEM32>\tasks\hs0gfy3i
Modifies file system
Creates the following files
- <Current directory>\svchost32.exe
- %TEMP%\5sose2of.out
- C:\documents and settings\csce3ff.tmp
- %TEMP%\rese400.tmp
- C:\documents and settings\idle.exe
- %TEMP%\3m2lrufm.0.cs
- %TEMP%\3m2lrufm.cmdline
- %TEMP%\3m2lrufm.out
- %ProgramFiles%\safari\cscea77.tmp
- %TEMP%\resea88.tmp
- %ProgramFiles%\safari\mdm.exe
- %TEMP%\paqo2qwu.0.cs
- %TEMP%\paqo2qwu.cmdline
- C:\totalcmd\language\cscf0a2.tmp
- %TEMP%\resfd55.tmp
- %TEMP%\resf0a3.tmp
- C:\totalcmd\language\mdm.exe
- %TEMP%\tk2zhyf0.0.cs
- %TEMP%\tk2zhyf0.cmdline
- %TEMP%\tk2zhyf0.out
- %PROGRAMDATA%\microsoft\assistance\client\1.0\en-us\cscf6cc.tmp
- %TEMP%\resf6dc.tmp
- %PROGRAMDATA%\microsoft\assistance\client\1.0\en-us\dwm.exe
- %TEMP%\zr5mgagw.0.cs
- %TEMP%\zr5mgagw.cmdline
- %TEMP%\zr5mgagw.out
- %WINDIR%\prefetch\readyboot\cscfd54.tmp
- %TEMP%\5sose2of.cmdline
- %TEMP%\paqo2qwu.out
- %TEMP%\5sose2of.0.cs
- <Current directory>\mdm.exe
- C:\users\all users\documents\gv0k2h1u\svchost32.exe
- %TEMP%\ym1kmkes.0.cs
- %TEMP%\ym1kmkes.cmdline
- %TEMP%\ym1kmkes.out
- C:\totalcmd\language\cscb35a.tmp
- %TEMP%\resb37a.tmp
- C:\totalcmd\language\wudfhost.exe
- %TEMP%\knafowq0.0.cs
- %TEMP%\knafowq0.cmdline
- %TEMP%\knafowq0.out
- <Current directory>\cscbd9b.tmp
- %TEMP%\resbd9c.tmp
- %TEMP%\ixee35jz.0.cs
- %TEMP%\ib2xrggo.cmdline
- %TEMP%\ixee35jz.cmdline
- %TEMP%\ixee35jz.out
- C:\perflogs\admin\cscca1e.tmp
- %TEMP%\rescacb.tmp
- C:\perflogs\admin\svchost.exe
- %TEMP%\cy531d23.0.cs
- %TEMP%\cy531d23.cmdline
- %TEMP%\cy531d23.out
- C:\far2\fexcept\cscd72e.tmp
- %TEMP%\resd72f.tmp
- C:\far2\fexcept\mdm.exe
- %TEMP%\ib2xrggo.0.cs
- %TEMP%\ib2xrggo.out
- %WINDIR%\prefetch\readyboot\taskhost.exe
Deletes the following files
- %TEMP%\resb37a.tmp
- %TEMP%\5sose2of.cmdline
- %TEMP%\resea88.tmp
- %ProgramFiles%\safari\cscea77.tmp
- %TEMP%\3m2lrufm.0.cs
- %TEMP%\3m2lrufm.out
- %TEMP%\3m2lrufm.cmdline
- %TEMP%\resf0a3.tmp
- C:\totalcmd\language\cscf0a2.tmp
- %TEMP%\5sose2of.0.cs
- %TEMP%\5sose2of.out
- %TEMP%\paqo2qwu.cmdline
- %TEMP%\resf6dc.tmp
- %PROGRAMDATA%\microsoft\assistance\client\1.0\en-us\cscf6cc.tmp
- %TEMP%\tk2zhyf0.cmdline
- %TEMP%\tk2zhyf0.out
- %TEMP%\tk2zhyf0.0.cs
- %TEMP%\resfd55.tmp
- %WINDIR%\prefetch\readyboot\cscfd54.tmp
- %TEMP%\zr5mgagw.0.cs
- %TEMP%\paqo2qwu.out
- %TEMP%\paqo2qwu.0.cs
- C:\documents and settings\csce3ff.tmp
- %TEMP%\rese400.tmp
- %TEMP%\ib2xrggo.out
- %TEMP%\ym1kmkes.cmdline
- %TEMP%\ym1kmkes.0.cs
- %TEMP%\ym1kmkes.out
- %TEMP%\resbd9c.tmp
- <Current directory>\cscbd9b.tmp
- %TEMP%\knafowq0.out
- %TEMP%\knafowq0.0.cs
- %TEMP%\knafowq0.cmdline
- %TEMP%\rescacb.tmp
- C:\totalcmd\language\cscb35a.tmp
- C:\perflogs\admin\cscca1e.tmp
- %TEMP%\ixee35jz.cmdline
- %TEMP%\ixee35jz.out
- %TEMP%\resd72f.tmp
- C:\far2\fexcept\cscd72e.tmp
- %TEMP%\cy531d23.cmdline
- %TEMP%\cy531d23.0.cs
- %TEMP%\cy531d23.out
- %TEMP%\ib2xrggo.0.cs
- %TEMP%\ib2xrggo.cmdline
- %TEMP%\ixee35jz.0.cs
- %TEMP%\zr5mgagw.cmdline
- %TEMP%\zr5mgagw.out
Network activity
TCP
HTTP GET requests
- http://ni##.#azz.fvds.ru/yhl77sy2rif9er0ckysgz040/ok8c1rm6n1c2vfz3lywbp9iwxp19dgbqiw0jpuoqynlsckcn0ad4m8h95yt5bt62x5fubgta/3f81075dd68482a25deb5dac4f9acf7e0efc15dd.php?96#######################...
- http://ni##.#azz.fvds.ru/yhl77sy2rif9er0ckysgz040/ok8c1rm6n1c2vfz3lywbp9iwxp19dgbqiw0jpuoqynlsckcn0ad4m8h95yt5bt62x5fubgta/3f81075dd68482a25deb5dac4f9acf7e0efc15dd.php?32#######################...
- http://ni##.#azz.fvds.ru/yhl77sy2rif9er0ckysgz040/ok8c1rm6n1c2vfz3lywbp9iwxp19dgbqiw0jpuoqynlsckcn0ad4m8h95yt5bt62x5fubgta/wksgywug7lwkycazmbn4n0lyk9a3qhjvh60mjhicx13dt2zq0fu8i/2466b134ae1bdbe4...
- http://ip##fo.io/ip
UDP
- DNS ASK ni##.#azz.fvds.ru
- DNS ASK ip##fo.io
Miscellaneous
Creates and executes the following
- '<Current directory>\svchost32.exe'
- 'C:\documents and settings\idle.exe'
- 'C:\totalcmd\language\mdm.exe'
- '%ProgramFiles%\safari\mdm.exe'
- '<Current directory>\mdm.exe'
- '%PROGRAMDATA%\microsoft\assistance\client\1.0\en-us\dwm.exe'
- 'C:\perflogs\admin\svchost.exe'
- '%WINDIR%\prefetch\readyboot\taskhost.exe'
- 'C:\totalcmd\language\wudfhost.exe'
- 'C:\far2\fexcept\mdm.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF0A3.tmp" "c:\totalcmd\LANGUAGE\CSCF0A2.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCACB.tmp" "c:\PerfLogs\Admin\CSCCA1E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zr5mgagw.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ym1kmkes.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF6DC.tmp" "%PROGRAMDATA%\Microsoft\Assistance\Client\1.0\en-US\CSCF6CC.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ixee35jz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB37A.tmp" "c:\totalcmd\LANGUAGE\CSCB35A.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\paqo2qwu.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ib2xrggo.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\3m2lrufm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE400.tmp" "c:\Documents and Settings\CSCE3FF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFD55.tmp" "%WINDIR%\Prefetch\ReadyBoot\CSCFD54.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEA88.tmp" "%ProgramFiles%\Safari\CSCEA77.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBD9C.tmp" "<Current directory>\CSCBD9B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD72F.tmp" "c:\Far2\FExcept\CSCD72E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cy531d23.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\knafowq0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tk2zhyf0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5sose2of.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ym1kmkes.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF6DC.tmp" "%PROGRAMDATA%\Microsoft\Assistance\Client\1.0\en-US\CSCF6CC.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tk2zhyf0.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF0A3.tmp" "c:\totalcmd\LANGUAGE\CSCF0A2.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\paqo2qwu.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEA88.tmp" "%ProgramFiles%\Safari\CSCEA77.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\3m2lrufm.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE400.tmp" "c:\Documents and Settings\CSCE3FF.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zr5mgagw.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5sose2of.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD72F.tmp" "c:\Far2\FExcept\CSCD72E.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cy531d23.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCACB.tmp" "c:\PerfLogs\Admin\CSCCA1E.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ixee35jz.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBD9C.tmp" "<Current directory>\CSCBD9B.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\knafowq0.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB37A.tmp" "c:\totalcmd\LANGUAGE\CSCB35A.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ib2xrggo.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFD55.tmp" "%WINDIR%\Prefetch\ReadyBoot\CSCFD54.tmp"
