Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\bitc239.tmp
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- '%APPDATA%\vbc.exe'
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
- %WINDIR%\syswow64\chkdsk.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
Modifies file system
Creates the following files
- %APPDATA%\vbc.exe
- %TEMP%\profilepricket.dll
- %TEMP%\trial
- %APPDATA%\ppc\generator\error_log\crtowordscht.dll
- %APPDATA%\ppc\generator\error_log\devenv.exe
- %APPDATA%\ppc\generator\error_log\sqlleui.dll
- %APPDATA%\ppc\generator\error_log\vnd.sun.xml.impress.template.xml
- %APPDATA%\ppc\generator\error_log\microsoftstdformat.dll
- %APPDATA%\ppc\generator\error_log\quatorze.xml
- %APPDATA%\ppc\generator\error_log\23.opends60.dll
- %APPDATA%\ppc\generator\error_log\41.opends60.dll
- %APPDATA%\ppc\generator\error_log\52.opends60.dll
- %APPDATA%\ppc\generator\error_log\x-google-video-pointer.xml
- %APPDATA%\ppc\generator\error_log\accessibility.dll
- %APPDATA%\ppc\generator\error_log\microsoftdataconnectionui.dll
- %APPDATA%\ppc\generator\error_log\ecccountries.xml
- %APPDATA%\ppc\generator\error_log\79.opends60.dll
- %APPDATA%\ppc\generator\error_log\org.freedesktop.avahi.recordbrowser.xml
- %APPDATA%\ppc\generator\error_log\atltracetoolui.dll
- %APPDATA%\ppc\generator\error_log\msdatasrc.dll
- %APPDATA%\ppc\generator\error_log\clientshutdown.exe
- %TEMP%\nsg6005.tmp
- %APPDATA%\icq-profile\update\splash_banner\bitb78a.tmp
- %TEMP%\d51788a4.lnk
Sets the 'hidden' attribute to the following files
- %APPDATA%\icq-profile\update\splash_banner\bitb78a.tmp
- %APPDATA%\microsoft\windows\start menu\programs\startup\bitc239.tmp
Moves the following files
- from %APPDATA%\icq-profile\update\splash_banner\bitb78a.tmp to %APPDATA%\icq-profile\update\splash_banner\diskpart.exe
Network activity
TCP
HTTP GET requests
- http://ra##modu.ga/~zadmin/doc/ap.exe
UDP
- DNS ASK ra##modu.ga
- DNS ASK es######ients-v6-orange.com
- DNS ASK sa####ianjiang.com
- DNS ASK mu##-in.net
- DNS ASK sa#######economiccharrette.com
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\rundll32.exe' ProfilePricket,Pretor
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\chkdsk.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\SysWOW64\cmd.exe"
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
