Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18.exe' = '%APPDATA%Microsoft\System\Services\18.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Policies' = 'c:\dir\install\install\server.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Policies' = 'c:\dir\install\install\server.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}] 'StubPath' = 'c:\dir\install\install\server.exe Restart'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe
Modifies file system
Creates the following files
- %APPDATA%microsoft\system\services\18.exe
- C:\dir\install\install\server.exe
- %TEMP%\xx--xx--xx.txt
- %APPDATA%\logs.dat
- %TEMP%\xxx.xxx
- %TEMP%\kin yonh.jpg
- %TEMP%\uuu.uuu
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020042920200430\index.dat
Sets the 'hidden' attribute to the following files
- %APPDATA%\logs.dat
Deletes the following files
- %TEMP%\xx--xx--xx.txt
- %TEMP%\uuu.uuu
- %TEMP%\xxx.xxx
Substitutes the following files
- %TEMP%\uuu.uuu
- %TEMP%\xxx.xxx
Network activity
TCP
HTTP GET requests
- http://www.google.com/
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
UDP
- DNS ASK google.com
- DNS ASK el####347.dns.net
- DNS ASK microsoft.com
- DNS ASK oc##.thawte.com
- DNS ASK oc##.#tartssl.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'C:\dir\install\install\server.exe'
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe'
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
