Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,"%TEMP%\rknrl.vbs"'
- [<HKCU>\software\microsoft\windows\currentversion\run] 'winstart' = 'wscript.exe //B "%TEMP%\rknrl.vbs"'
- [<HKLM>\software\microsoft\windows\currentversion\run] 'winstart' = 'wscript.exe //B "%TEMP%\rknrl.vbs"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\rknrl.vbs
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\RemoteAccess] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\RemoteAccess] 'ImagePath' = '<SYSTEM32>\wscript.exe //B C:\autoexec.vbs'
Creates the following files on removable media
- <Drive name for removable media>:\recycl\rkrl.vbs
Malicious functions
Creates and executes the following
- '%TEMP%\explorer.exe' //B "%TEMP%\winstart.vbs"
- '%WINDIR%\temp\svchost.exe' //B "%WINDIR%\TEMP\winstart.vbs"
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\wscript.exe
Modifies file system
Creates the following files
- %TEMP%\winstart.vbs
- %TEMP%\rknrl.reg
- %TEMP%\explorer.exe
- %ProgramFiles%\microsoft office\office14\officeset.log
- C:\autoexec.vbs
- %WINDIR%\temp\rknrl.tmp
- %TEMP%\rknrl.vbs
- %WINDIR%\temp\winstart.vbs
- %WINDIR%\temp\svchost.exe
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\playback[1].php
Sets the 'hidden' attribute to the following files
- C:\autoexec.vbs
Deletes the following files
- %TEMP%\rknrl.reg
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\playback[1].php
Network activity
Connects to
- 'ai########orld.airobotheworld.com':80
TCP
HTTP GET requests
- http://ai########orld.airobotheworld.com/ctrl/Normal.xls
- http://ai########orld.airobotheworld.com/ctrl/Normal.doc
HTTP POST requests
- http://ai########orld.airobotheworld.com/ctrl/playback.php
UDP
- DNS ASK ai#####heworld.gicp.net
- DNS ASK ai########orld.airobotheworld.com
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' //B C:\autoexec.vbs
- '<SYSTEM32>\cmd.exe' /c regedit /s /q %TEMP%\rknrl.reg' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop RemoteAccess' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config RemoteAccess binpath= "<SYSTEM32>\wscript.exe //B C:\autoexec.vbs" start= auto' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc start RemoteAccess' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c regedit /s /q %TEMP%\rknrl.reg
- '%WINDIR%\regedit.exe' /s /q %TEMP%\rknrl.reg
- '<SYSTEM32>\cmd.exe' /c sc stop RemoteAccess
- '<SYSTEM32>\cmd.exe' /c sc config RemoteAccess binpath= "<SYSTEM32>\wscript.exe //B C:\autoexec.vbs" start= auto
- '<SYSTEM32>\cmd.exe' /c sc start RemoteAccess
- '<SYSTEM32>\sc.exe' config RemoteAccess binpath= "<SYSTEM32>\wscript.exe //B C:\autoexec.vbs" start= auto
- '<SYSTEM32>\sc.exe' stop RemoteAccess
- '<SYSTEM32>\sc.exe' start RemoteAccess
