Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe
Modifies file system
Creates the following files
- %TEMP%\onmskyt.txt
- %TEMP%\vbc5ef1b93a2440474fb0b386cf4203c3f.tmp
- %TEMP%\res6cd0.tmp
- C:\msocache.exe
- %TEMP%\nwmfqunv.0.vb
- %TEMP%\nwmfqunv.cmdline
- %TEMP%\nwmfqunv.out
- %TEMP%\vbc221a3a8160c741d4913f2c89cddff0a7.tmp
- %TEMP%\vbc5f91ccd2b7b34512821dcdce9bbacb49.tmp
- %TEMP%\res7145.tmp
- C:\perflogs.exe
- %TEMP%\hhwun4wz.0.vb
- %TEMP%\hhwun4wz.cmdline
- %TEMP%\hhwun4wz.out
- %TEMP%\vbca9f9f165d3e642c3a3f243eaa0132c6.tmp
- %TEMP%\vbc9f5af993eae54e97b994a245f508275.tmp
- %TEMP%\res757b.tmp
- %ProgramFiles%.exe
- %TEMP%\xxabesfx.0.vb
- %TEMP%\xxabesfx.cmdline
- %TEMP%\xxabesfx.out
- %TEMP%\vbce7c244ebaa0a41c9b6c6c47f1b29d622.tmp
- %APPDATA%\microsoft\windows\templates\ddoser.exe
- %TEMP%\vbca2da78bba25d4c62ad4563a9d1e41a5a.tmp
- %TEMP%\vbc5b5613a53cb4db89ea452b2feeb7e6c.tmp
- %TEMP%\res7abb.tmp
- %TEMP%\ug5r3hhq.out
- %TEMP%\ug5r3hhq.0.vb
- C:\ddos\client.exe
- %PROGRAMDATA%\ddos\ikghdmf.ico
- %TEMP%\ar04su0k.0.vb
- %TEMP%\ar04su0k.cmdline
- %TEMP%\ar04su0k.out
- %TEMP%\vbcc0e1e1466d8a4971adea6b587aa1f3.tmp
- %TEMP%\vbcf509fb671b0c470aa78c6d13f1a864.tmp
- %TEMP%\res5f63.tmp
- C:\$recycle.bin.exe
- %TEMP%\nsq05ocg.0.vb
- %TEMP%\nsq05ocg.cmdline
- %TEMP%\nsq05ocg.out
- %TEMP%\vbc4b0d641bde02449c847af3d837e3b22.tmp
- %TEMP%\vbc8cf8fc4e77514d97baebd5b08759789d.tmp
- %TEMP%\res6406.tmp
- C:\documents and settings.exe
- %TEMP%\juo11p5g.0.vb
- %TEMP%\juo11p5g.cmdline
- %TEMP%\juo11p5g.out
- %TEMP%\vbc59c6573b3d5847d8a81623c5682a1d6.tmp
- %TEMP%\vbc1423d4924e0f4cad8e96b4be9ff1c318.tmp
- %TEMP%\res683c.tmp
- C:\far2.exe
- %TEMP%\ug5r3hhq.cmdline
- C:\recovery.exe
Sets the 'hidden' attribute to the following files
- C:\ddos\client.exe
Deletes the following files
- %TEMP%\res5f63.tmp
- %TEMP%\ug5r3hhq.0.vb
- %TEMP%\res7145.tmp
- %TEMP%\vbc5f91ccd2b7b34512821dcdce9bbacb49.tmp
- %TEMP%\vbc221a3a8160c741d4913f2c89cddff0a7.tmp
- %TEMP%\nwmfqunv.0.vb
- %TEMP%\nwmfqunv.out
- %TEMP%\ug5r3hhq.cmdline
- %TEMP%\ug5r3hhq.out
- %TEMP%\nwmfqunv.cmdline
- %TEMP%\vbca9f9f165d3e642c3a3f243eaa0132c6.tmp
- %TEMP%\hhwun4wz.0.vb
- %TEMP%\hhwun4wz.cmdline
- %TEMP%\hhwun4wz.out
- %TEMP%\xxabesfx.cmdline
- %TEMP%\res7abb.tmp
- %TEMP%\res757b.tmp
- %TEMP%\vbc9f5af993eae54e97b994a245f508275.tmp
- %TEMP%\vbc5b5613a53cb4db89ea452b2feeb7e6c.tmp
- %TEMP%\vbc5ef1b93a2440474fb0b386cf4203c3f.tmp
- %TEMP%\res6cd0.tmp
- %TEMP%\vbcc0e1e1466d8a4971adea6b587aa1f3.tmp
- %TEMP%\ar04su0k.cmdline
- %TEMP%\ar04su0k.0.vb
- %TEMP%\ar04su0k.out
- %TEMP%\res6406.tmp
- %TEMP%\vbc8cf8fc4e77514d97baebd5b08759789d.tmp
- %TEMP%\vbc4b0d641bde02449c847af3d837e3b22.tmp
- %TEMP%\vbcf509fb671b0c470aa78c6d13f1a864.tmp
- %TEMP%\nsq05ocg.cmdline
- %TEMP%\nsq05ocg.0.vb
- %TEMP%\res683c.tmp
- %TEMP%\vbc1423d4924e0f4cad8e96b4be9ff1c318.tmp
- %TEMP%\vbc59c6573b3d5847d8a81623c5682a1d6.tmp
- %TEMP%\juo11p5g.cmdline
- %TEMP%\juo11p5g.out
- %TEMP%\juo11p5g.0.vb
- %TEMP%\nsq05ocg.out
- %TEMP%\vbca2da78bba25d4c62ad4563a9d1e41a5a.tmp
- %TEMP%\vbce7c244ebaa0a41c9b6c6c47f1b29d622.tmp
Network activity
Connects to
- '19#.#61.193.99':61076
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\templates\ddoser.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ar04su0k.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\01qfs3ln.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES144B.tmp" "%TEMP%\vbcF9722478D8E240648E4CFEDFE69A4184.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\kiu5ttem.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7ABB.tmp" "%TEMP%\vbcA2DA78BBA25D4C62AD4563A9D1E41A5A.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\xxabesfx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES757B.tmp" "%TEMP%\vbc9F5AF993EAE54E97B994A245F508275.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\hhwun4wz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7145.tmp" "%TEMP%\vbc5F91CCD2B7B34512821DCDCE9BBACB49.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\nwmfqunv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6CD0.tmp" "%TEMP%\vbc5EF1B93A2440474FB0B386CF4203C3F.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ug5r3hhq.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES683C.tmp" "%TEMP%\vbc1423D4924E0F4CAD8E96B4BE9FF1C318.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\juo11p5g.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6406.tmp" "%TEMP%\vbc8CF8FC4E77514D97BAEBD5B08759789D.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\nsq05ocg.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5F63.tmp" "%TEMP%\vbcF509FB671B0C470AA78C6D13F1A864.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES192D.tmp" "%TEMP%\vbc2D68D879859F45C3B87982B6407B55C2.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\y40fm1zg.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\01qfs3ln.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES144B.tmp" "%TEMP%\vbcF9722478D8E240648E4CFEDFE69A4184.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\kiu5ttem.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7ABB.tmp" "%TEMP%\vbcA2DA78BBA25D4C62AD4563A9D1E41A5A.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\xxabesfx.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES757B.tmp" "%TEMP%\vbc9F5AF993EAE54E97B994A245F508275.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\hhwun4wz.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7145.tmp" "%TEMP%\vbc5F91CCD2B7B34512821DCDCE9BBACB49.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\nwmfqunv.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6CD0.tmp" "%TEMP%\vbc5EF1B93A2440474FB0B386CF4203C3F.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ug5r3hhq.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES683C.tmp" "%TEMP%\vbc1423D4924E0F4CAD8E96B4BE9FF1C318.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\juo11p5g.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6406.tmp" "%TEMP%\vbc8CF8FC4E77514D97BAEBD5B08759789D.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\nsq05ocg.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5F63.tmp" "%TEMP%\vbcF509FB671B0C470AA78C6D13F1A864.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ar04su0k.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES192D.tmp" "%TEMP%\vbc2D68D879859F45C3B87982B6407B55C2.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\y40fm1zg.cmdline"
