Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\NGEN47925_32] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\NGEN47925_32] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\odbcad32.exe'
Creates the following services
- 'NGEN47925_32' %ALLUSERSPROFILE%\Microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\odbcad32.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\odbcad32.exe
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\sysmond.ocx
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\dmviewa.ocx
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\msdxmd.ocx
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\activedsu.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\msdatsrct.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\msralegacys.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\amcompato.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\msdxmw.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\msdatsrcn.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\slmgrt.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\slmgro.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\slmgrd.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\slmgrc.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\desky.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\msdxmi.ocx
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\wscuia.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\hdwwizk.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\inetcple.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\appwizd.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\ndfeventviewr.xml
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\wsmanconfig_schemaw.xml
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\locationnotificationsviewe.xml
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\nativehooksx.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\odbcconfe.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\pcwumv.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\userenvw.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\wabsyncprovidern.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\rcxa9c8.tmp
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\rcxa9b7.tmp
- %TEMP%\tmpa9b6.tmp
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\timedatee.cpl
- nul
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\odbcad32.exe
Moves the following files
- from %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\rcxa9b7.tmp to %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\odbcad32.exe
- from %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\rcxa9c8.tmp to %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\odbcad32.exe
Deletes itself.
Network activity
Connects to
- '11#.#9.98.244':10204
- '11#.#9.58.244':10204
- '61.##.140.152':10204
- '61.##.208.123':10204
- '62.##2.163.50':10204
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__94dbbf8869775bfe\odbcad32.exe'
- '%WINDIR%\syswow64\cmd.exe' /d /c ping -n 2 127.0.0.1 > NUL & fsutil file setzerodata offset=0 length=524288 "<Full path to file>" & del "<Full path to file>" > NUL & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /d /c ping -n 2 127.0.0.1 > NUL & fsutil file setzerodata offset=0 length=524288 "<Full path to file>" & del "<Full path to file>" > NUL & exit
- '%WINDIR%\syswow64\ping.exe' -n 2 127.0.0.1
- '%WINDIR%\syswow64\fsutil.exe' file setzerodata offset=0 length=524288 "<Full path to file>"
