Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\mbhxeo.lnk
- <SYSTEM32>\tasks\snvpxk
Modifies file system
Creates the following files
- %TEMP%\aut61be.tmp
- %TEMP%\cxxauwj
- %TEMP%\aut8ec7.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7e3n52x5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\tg1eiwih\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ag0p0um1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\f36yhlzt\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %TEMP%\skyp\oucofz.exe
- %TEMP%\uhyejbt
- %TEMP%\aut7780.tmp
- %TEMP%\uefezwc
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\f36yhlzt\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ag0p0um1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\tg1eiwih\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7e3n52x5\desktop.ini
Deletes the following files
- %TEMP%\aut61be.tmp
- %TEMP%\uhyejbt
- %TEMP%\aut8ec7.tmp
- %TEMP%\cxxauwj
- %TEMP%\aut7780.tmp
- %TEMP%\uefezwc
Network activity
TCP
HTTP GET requests
- http://ip###ore.com/checkip/
UDP
- DNS ASK ip###ore.com
- DNS ASK ey###z.ddns.net
Miscellaneous
Creates and executes the following
- '%TEMP%\skyp\oucofz.exe'
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn "SNVPXK" /tr %TEMP%\Skyp\OUCOFZ.exe /sc minute /mo 1' (with hidden window)
- '%TEMP%\skyp\oucofz.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn "SNVPXK" /tr %TEMP%\Skyp\OUCOFZ.exe /sc minute /mo 1
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "SNVPXK" /tr %TEMP%\Skyp\OUCOFZ.exe /sc minute /mo 1
- '<SYSTEM32>\taskeng.exe' {D6A6C140-8BE0-4D51-8BC4-3018B4E8550B} S-1-5-21-1960123792-2022915161-3775307078-1001:nsxdkch\user:Interactive:[1]
