Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'vened' = '%HOMEPATH%\vened.exe /e'
Creates the following files on removable media
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\rcx32f2.tmp
- <Drive name for removable media>:\rcx32d2.tmp
- <Drive name for removable media>:\rcx32d1.tmp
- <Drive name for removable media>:\dualectls.exe
- <Drive name for removable media>:\rcx26a0.tmp
- <Drive name for removable media>:\rcx2680.tmp
- <Drive name for removable media>:\rcx3a05.tmp
- <Drive name for removable media>:\spib_pima.exe
- <Drive name for removable media>:\rcx20f2.tmp
- <Drive name for removable media>:\video_1.exe
- <Drive name for removable media>:\rcx1b37.tmp
- <Drive name for removable media>:\pushkin.exe
- <Drive name for removable media>:\rcxd22.tmp
- <Drive name for removable media>:\2.exe
- <Drive name for removable media>:\clip_480_5sec_6mbps_h264.exe
- <Drive name for removable media>:\rcx9f82.tmp
- <Drive name for removable media>:\rcx3a54.tmp
- <Drive name for removable media>:\arrow-down.exe
- <Drive name for removable media>:\rcx6786.tmp
- <Drive name for removable media>:\asm.exe
- <Drive name for removable media>:\rcx57db.tmp
- <Drive name for removable media>:\cbz.exe
- <Drive name for removable media>:\rcx4dad.tmp
- <Drive name for removable media>:\dissolveanother.exe
- <Drive name for removable media>:\rcx48fb.tmp
- <Drive name for removable media>:\rcx48cb.tmp
- <Drive name for removable media>:\rcx48ab.tmp
- <Drive name for removable media>:\ff_ot_user_guide.exe
- <Drive name for removable media>:\rcx3f28.tmp
- <Drive name for removable media>:\rcx3ef9.tmp
- <Drive name for removable media>:\rcx3ed8.tmp
- <Drive name for removable media>:\7790_preview.exe
- <Drive name for removable media>:\rcx296.tmp
- <Drive name for removable media>:\rcx2113.tmp
- <Drive name for removable media>:\4f0bf7ff71f28.exe
- <Drive name for removable media>:\rcxfda6.tmp
- <Drive name for removable media>:\rcxfd86.tmp
- <Drive name for removable media>:\archer.exe
- <Drive name for removable media>:\rcx91ab.tmp
- <Drive name for removable media>:\dashborder_144.exe
- <Drive name for removable media>:\rcx8d95.tmp
- <Drive name for removable media>:\dashborder_192.exe
- <Drive name for removable media>:\rcx88f2.tmp
- <Drive name for removable media>:\rcx88e2.tmp
- <Drive name for removable media>:\rcx845e.tmp
- <Drive name for removable media>:\rcx95c1.tmp
- <Drive name for removable media>:\rcx842e.tmp
- <Drive name for removable media>:\000814251_video_01.exe
- <Drive name for removable media>:\rcx7188.tmp
- <Drive name for removable media>:\rcx6142.tmp
- <Drive name for removable media>:\split.exe
- <Drive name for removable media>:\vened.exe
- <Drive name for removable media>:\rcx754c.tmp
- <Drive name for removable media>:\rcx3a74.tmp
- <Drive name for removable media>:\dialmap.exe
- <Drive name for removable media>:\rcxbcd3.tmp
- <Drive name for removable media>:\dashborder_120.exe
- <Drive name for removable media>:\rcxfd65.tmp
- <Drive name for removable media>:\508softwareandos.exe
- <Drive name for removable media>:\rcxf78b.tmp
- <Drive name for removable media>:\rcxf74b.tmp
- <Drive name for removable media>:\rcxf612.tmp
- <Drive name for removable media>:\weeklysheet1215.exe
- <Drive name for removable media>:\rcxebc5.tmp
- <Drive name for removable media>:\rcxeba5.tmp
- <Drive name for removable media>:\rcxeb65.tmp
- <Drive name for removable media>:\cveuropeo.exe
- <Drive name for removable media>:\rcxd15f.tmp
- <Drive name for removable media>:\rcxd14f.tmp
- <Drive name for removable media>:\rcxd13e.tmp
- <Drive name for removable media>:\ovp25012015.exe
- <Drive name for removable media>:\coffee.exe
- <Drive name for removable media>:\breakpoint.exe
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Injects code into
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %HOMEPATH%\iasd8zgo9sjlu4t4lk.exe
- %HOMEPATH%\vened.exe
- %HOMEPATH%\txhost.exe
- %HOMEPATH%\uxhost.exe
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\vened.exe
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\vened.exe
Miscellaneous
Searches for the following windows
- ClassName: 'Class' WindowName: 'Name'
Creates and executes the following
- '%HOMEPATH%\iasd8zgo9sjlu4t4lk.exe'
- '%HOMEPATH%\vened.exe'
- '%HOMEPATH%\txhost.exe'
- '%HOMEPATH%\uxhost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c tasklist&&del iAsD8zgo9sJlU4T4lK.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c tasklist&&del iAsD8zgo9sJlU4T4lK.exe
- '%WINDIR%\syswow64\tasklist.exe'
