Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\aliide] 'Start' = '00000002'
Substitutes the following executable system files
- <SYSTEM32>\en-US\user32.dll.mui with <SYSTEM32>\en-us\user32.dll.mui.tmp
- %WINDIR%\SysWOW64\en-US\user32.dll.mui with %WINDIR%\syswow64\en-us\user32.dll.mui.tmp
- <DRIVERS>\aliide.sys with %WINDIR%\aliides
Infects the following executable files
- <SYSTEM32>\en-us\user32.dll.mui.tmp
- %WINDIR%\syswow64\en-us\user32.dll.mui.tmp
Modifies file system
Creates the following files
- <SYSTEM32>\en-us\user32.dll.mui.tmp
- %WINDIR%\rescache\wip\segment4.cmf
- %WINDIR%\rescache\wip\segment3.toc
- %WINDIR%\rescache\wip\segment3.cmf
- %WINDIR%\rescache\wip\segment2.toc
- %WINDIR%\rescache\wip\segment2.cmf
- %WINDIR%\rescache\wip\segment1.toc
- %WINDIR%\rescache\wip\segment1.cmf
- %WINDIR%\rescache\wip\segment0.toc
- %WINDIR%\rescache\wip\segment0.cmf
- %WINDIR%\rescache\wip\rescache.hit
- %WINDIR%\rescache\rc0000\rescache.hit
- %WINDIR%\rescache\rescache.mni
- %WINDIR%\rescache\rc0000\rescache.dir
- %WINDIR%\aliides
- %WINDIR%\syswow64\en-us\user32.dll.mui.tmp
- %WINDIR%\rescache\wip\segment4.toc
- %WINDIR%\rescache\wip\rescache.dir
Deletes the following files
- %TEMP%\_@a025.tmp
- %TEMP%\_@b1b3.tmp
Moves the following system files
- from <SYSTEM32>\en-us\user32.dll.mui to %TEMP%\_@a025.tmp
- from %WINDIR%\syswow64\en-us\user32.dll.mui to %TEMP%\_@b1b3.tmp
Deletes itself.
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' "ping localhost -n 8 & move /Y "%WINDIR%\aliides" "<DRIVERS>\aliide.sys" & ping localhost -n 3 & net start aliide"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "for /L %i in (1,1,100) do (del /F "<Full path to file>" & ping localhost -n 2 & if not exist "<Full path to file>" Exit 1)"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\takeown.exe /f "<SYSTEM32>\en-US\user32.dll.mui"
- '<SYSTEM32>\ping.exe' localhost -n 3
- '%WINDIR%\syswow64\ping.exe' localhost -n 2
- '<SYSTEM32>\ping.exe' localhost -n 8
- '%WINDIR%\syswow64\cmd.exe' /c "for /L %i in (1,1,100) do (del /F "<Full path to file>" & ping localhost -n 2 & if not exist "<Full path to file>" Exit 1)"
- '<SYSTEM32>\cmd.exe' "ping localhost -n 8 & move /Y "%WINDIR%\aliides" "<DRIVERS>\aliide.sys" & ping localhost -n 3 & net start aliide"
- '%WINDIR%\syswow64\mcbuilder.exe'
- '%WINDIR%\syswow64\icacls.exe' %WINDIR%\SysWOW64\en-US\user32.dll.mui /grant *S-1-1-0:(F)
- '%WINDIR%\syswow64\cmd.exe' /c "<SYSTEM32>\icacls.exe %WINDIR%\SysWOW64\en-US\user32.dll.mui /grant *S-1-1-0:(F)"
- '%WINDIR%\syswow64\icacls.exe' %WINDIR%\SysWOW64\en-US\user32.dll.mui /grant user:F
- '%WINDIR%\syswow64\cmd.exe' /c "<SYSTEM32>\icacls.exe %WINDIR%\SysWOW64\en-US\user32.dll.mui /grant %username%:F"
- '%WINDIR%\syswow64\takeown.exe' /f "%WINDIR%\SysWOW64\en-US\user32.dll.mui"
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\takeown.exe /f "%WINDIR%\SysWOW64\en-US\user32.dll.mui"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\en-US\user32.dll.mui /grant *S-1-1-0:(F)
- '<SYSTEM32>\cmd.exe' /c "<SYSTEM32>\icacls.exe <SYSTEM32>\en-US\user32.dll.mui /grant *S-1-1-0:(F)"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\en-US\user32.dll.mui /grant user:F
- '<SYSTEM32>\cmd.exe' /c "<SYSTEM32>\icacls.exe <SYSTEM32>\en-US\user32.dll.mui /grant %username%:F"
- '<SYSTEM32>\takeown.exe' /f "<SYSTEM32>\en-US\user32.dll.mui"
- '<SYSTEM32>\net.exe' start aliide
- '<SYSTEM32>\net1.exe' start aliide
