Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe
Modifies file system
Creates the following files
- C:\users\public\vbc.exe
- %TEMP%\rarsfx0\nhtj.mp3
- %TEMP%\rarsfx0\ribomwvhe.docx
- %TEMP%\rarsfx0\qhdhfc.xml
- %TEMP%\rarsfx0\lcuj.xls
- %TEMP%\rarsfx0\xfhbk.xls
- %TEMP%\rarsfx0\nodhv.bin
- %TEMP%\rarsfx0\thmks.dll
- %TEMP%\rarsfx0\afrnpjg.ini
- %TEMP%\rarsfx0\hbwd.bin
- %TEMP%\rarsfx0\mndecbb.ppt
- %TEMP%\rarsfx0\cegol.mp3
- %TEMP%\rarsfx0\fpgx.bmp
- %TEMP%\rarsfx0\lkmeucht.dat
- %TEMP%\rarsfx0\efdeham.dll
- %TEMP%\rarsfx0\enccllwucm.icm
- %TEMP%\rarsfx0\hnstpb.msc
- %TEMP%\rarsfx0\kejbtw.txt
- %TEMP%\rarsfx0\fbibkow.ppt
- %TEMP%\rarsfx0\gjxvn.docx
- %TEMP%\rarsfx0\mpwmgut.ini
- %TEMP%\rarsfx0\skomike.bmp
- %TEMP%\rarsfx0\omdjsc.xml
- %TEMP%\rarsfx0\ougngic.ini
- %TEMP%\rarsfx0\thisfvl.xml
- %TEMP%\rarsfx0\jcposk.exe
- %TEMP%\rarsfx0\aludaguf.msc
- %TEMP%\rarsfx0\uimhiqfg.ini
- %TEMP%\rarsfx0\dkesc.ppt
- %TEMP%\rarsfx0\oraxircsug.dat
- %TEMP%\rarsfx0\hghjf.mp3
- %TEMP%\rarsfx0\ludrkfaw.xml
- %TEMP%\rarsfx0\ndgauk.icm
- %TEMP%\rarsfx0\snqhbvo.dll
- %TEMP%\rarsfx0\qfdhu.nwp
- %TEMP%\rarsfx0\umhr.txt
- %TEMP%\rarsfx0\omuhukg.docx
- %TEMP%\rarsfx0\update-rp.l.vbe
- %TEMP%\rarsfx0\pppej.ppt
- %TEMP%\rarsfx0\mkjrmuvbmc.exe
- %TEMP%\rarsfx0\vgud.txt
- %TEMP%\rarsfx0\tvxilra.xml
- %TEMP%\rarsfx0\bhndvpraxw.msc
- %TEMP%\rarsfx0\qhxqxiu.ini
- %TEMP%\rarsfx0\hpmhoomt.pdf
- %TEMP%\rarsfx0\jjdcvbca.xls
- %TEMP%\rarsfx0\hbuhfcaemg.dll
- %TEMP%\rarsfx0\wqcbvvhe.bmp
- %TEMP%\rarsfx0\aveolfh.txt
- %TEMP%\rarsfx0\cfccskp.txt
- %TEMP%\rarsfx0\neobqchee.icm
- %TEMP%\rarsfx0\mnhqecxwkq.exe
- %TEMP%\rarsfx0\erkkuedk.ini
- %TEMP%\rarsfx0\rqlvjriujr.msc
- %TEMP%\rarsfx0\btclte.xls
- %TEMP%\rarsfx0\psksug.icm
- %TEMP%\rarsfx0\xako.xml
- %TEMP%\rarsfx0\fktrdc.xml
- %TEMP%\rarsfx0\dwolktonxj.dat
- %TEMP%\rarsfx0\vidbnaalj.xls
- %TEMP%\rarsfx0\dvrv.bmp
- %TEMP%\rarsfx0\doiadka.ppt
- %TEMP%\rarsfx0\oxkvwsifq.ppt
- %TEMP%\rarsfx0\qknvplu.xml
- %HOMEPATH%\temp\umhr.txt
Modifies the following files
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.000
Network activity
Connects to
- '66.##1.118.137':80
TCP
HTTP GET requests
- http://66.##1.118.137/1544/vbc.exe
Other
- '34.##0.144.191':443
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\pppej.ppt' omuhukg.docx
- '%WINDIR%\syswow64\cmd.exe' /c pppej.ppt omuhukg.docx' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /release' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /renew' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\wscript.exe' Update-rp.l.vbe
- '%WINDIR%\syswow64\cmd.exe' /c pppej.ppt omuhukg.docx
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /release
- '%WINDIR%\syswow64\ipconfig.exe' /release
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /renew
- '%WINDIR%\syswow64\ipconfig.exe' /renew
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' -x -s 380
