Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft' = '%TEMP%\syshost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'regClient' = '%TEMP%\[Client]\client.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Policies' = '<SYSTEM32>\WinDir\svchost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Policies' = '<SYSTEM32>\WinDir\svchost.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Intel(R) Common User Interface' = '<SYSTEM32>\WinDir\svchost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Intel(R) Common User Interface' = '<SYSTEM32>\WinDir\svchost.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{S372LQF0-4U6N-5O5G-P0T6-3NU4DK3P14F1}] 'StubPath' = '<SYSTEM32>\WinDir\svchost.exe Restart'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{S372LQF0-4U6N-5O5G-P0T6-3NU4DK3P14F1}] 'StubPath' = '<SYSTEM32>\WinDir\svchost.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\winini.exe
- %TEMP%\ltq_bipw.0.vb
- %TEMP%\ltq_bipw.cmdline
- %TEMP%\ltq_bipw.out
- %TEMP%\vbc23da.tmp
- %TEMP%\res23db.tmp
- %TEMP%\syshost.exe
- %TEMP%\svchost.exe
- %TEMP%\[client]\client.exe
- %WINDIR%\syswow64\windir\svchost.exe
- %TEMP%\user2.txt
- %APPDATA%\userlog.dat
- %TEMP%\user7
- %TEMP%\user8
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\windir\svchost.exe
- %APPDATA%\userlog.dat
Deletes the following files
- %TEMP%\res23db.tmp
- %TEMP%\vbc23da.tmp
- %TEMP%\ltq_bipw.cmdline
- %TEMP%\ltq_bipw.0.vb
- %TEMP%\ltq_bipw.out
- %TEMP%\user2.txt
- %TEMP%\user8
- %TEMP%\user7
Substitutes the following files
- %TEMP%\user8
- %TEMP%\user7
Network activity
Connects to
- 'ph#####ric.no-ip.biz':3080
UDP
- DNS ASK sw###.no-ip.biz
- DNS ASK ph#####ric.no-ip.biz
Miscellaneous
Creates and executes the following
- '%TEMP%\syshost.exe'
- '%TEMP%\winini.exe'
- '%TEMP%\svchost.exe'
- '%WINDIR%\syswow64\windir\svchost.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ltq_bipw.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES23DB.tmp" "%TEMP%\vbc23DA.tmp"' (with hidden window)
- '%TEMP%\winini.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ltq_bipw.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES23DB.tmp" "%TEMP%\vbc23DA.tmp"
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\explorer.exe'
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
Uses NTFS alternate data streams
