Technical Information
Malicious functions:
Creates and executes the following:
- %TEMP%\wgrglvc.exe
- %TEMP%\ddnjjsq.exe
- %TEMP%\cahcqsv.exe
- %TEMP%\wuqtlco.exe
- %TEMP%\-1998166001
- %TEMP%\gvkirltp.exe
- %TEMP%\ptwl.exe
- %TEMP%\xcojf.exe
- %TEMP%\nnrbn.exe
- %TEMP%\drck.exe
- %TEMP%\repgni.exe
- %TEMP%\xblu.exe
- %TEMP%\repgni.exe (downloaded from the Internet)
- %TEMP%\cahcqsv.exe (downloaded from the Internet)
- %TEMP%\wuqtlco.exe (downloaded from the Internet)
- %TEMP%\-1998166001 (downloaded from the Internet)
- %TEMP%\xcojf.exe (downloaded from the Internet)
- %TEMP%\xblu.exe (downloaded from the Internet)
- %TEMP%\nnrbn.exe (downloaded from the Internet)
- %TEMP%\drck.exe (downloaded from the Internet)
- %TEMP%\ptwl.exe (downloaded from the Internet)
- %TEMP%\gvkirltp.exe (downloaded from the Internet)
- %TEMP%\ddnjjsq.exe (downloaded from the Internet)
- %TEMP%\wgrglvc.exe (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\svchost.exe
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\nersim[1].php
- %TEMP%\-1998166001
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ylzzd[1].php
- %TEMP%\ptwl.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\tgtkk[1].php
- %TEMP%\gvkirltp.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ivizm[1].php
- %TEMP%\cahcqsv.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\xxobsfwwn[1].php
- %TEMP%\wuqtlco.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tpggk[1].php
- %TEMP%\repgni.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\jjnaeeiz[1].php
- %TEMP%\drck.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\zzjwaaosf[1].php
- %TEMP%\xcojf.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zimnarrvz[1].php
- %TEMP%\nnrbn.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\pptgxlb[1].php
- %TEMP%\ddnjjsq.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\vijmarrivv[1].php
- %TEMP%\wgrglvc.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\uhuuvl[1].php
- %TEMP%\xblu.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\fcppqhklp[1].php
Deletes the following files:
- <SYSTEM32>\svchost.exe
Deletes itself.
Network activity:
Connects to:
- 'ab###ute.com':80
TCP:
HTTP GET requests:
- ab###ute.com/sjxkoboffw/ylzzd.php?ad####################################
- ab###ute.com/sjxkoboffw/nersim.php?ad####################################
- ab###ute.com/sjxkoboffw/tgtkk.php?ad####################################
- ab###ute.com/sjxkoboffw/xxobsfwwn.php?ad##################################################################
- ab###ute.com/sjxkoboffw/ivizm.php?ad####################################
- ab###ute.com/sjxkoboffw/tpggk.php?ad####################################
- ab###ute.com/sjxkoboffw/jjnaeeiz.php?ad####################################
- ab###ute.com/sjxkoboffw/zzjwaaosf.php?ad####################################
- ab###ute.com/sjxkoboffw/pptgxlb.php?ad####################################
- ab###ute.com/sjxkoboffw/zimnarrvz.php?ad####################################
- ab###ute.com/sjxkoboffw/vijmarrivv.php?ad####################################
- ab###ute.com/sjxkoboffw/fcppqhklp.php?ad####################################
- ab###ute.com/sjxkoboffw/uhuuvl.php?ad####################################
UDP:
- DNS ASK ab###ute.com
- '<Private IP address>':1036
