Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\system32clientghj\system32clientnt.exe
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\ovp25012015.doc.exe
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\testee.cer.exe
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\pmd.cer.exe
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\contoso_1.cer.exe
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\coffee.bmp.exe
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\tileimage.bmp.exe
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dashborder_192.bmp.exe
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dial.bmp.exe
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\archer.avi.exe
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\split.avi.exe
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\holycrosschurchinstructions.docx
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\aspnet_compiler.exe
Modifies file system
Creates the following files
- %TEMP%\server.exe
- %TEMP%\jzhbpqkj.cmdline
- %TEMP%\jzhbpqkj.out
- %TEMP%\vbcaa60.tmp
- %TEMP%\resaa61.tmp
- %PROGRAMDATA%\system32clientghj\contoso_1.ico
- %TEMP%\toozvah_.0.vb
- %TEMP%\toozvah_.cmdline
- %TEMP%\toozvah_.out
- %TEMP%\vbcadfa.tmp
- %TEMP%\resadfb.tmp
- %PROGRAMDATA%\system32clientghj\pmd.ico
- %TEMP%\860onzd4.0.vb
- %PROGRAMDATA%\system32clientghj\coffee.ico
- %TEMP%\jzhbpqkj.0.vb
- %TEMP%\860onzd4.cmdline
- %TEMP%\resb1b4.tmp
- %PROGRAMDATA%\system32clientghj\testee.ico
- %TEMP%\xtwh_xkn.0.vb
- %TEMP%\xtwh_xkn.cmdline
- %TEMP%\xtwh_xkn.out
- %TEMP%\vbcb58b.tmp
- %TEMP%\resb58c.tmp
- %PROGRAMDATA%\system32clientghj\ovp25012015.ico
- %TEMP%\imqh8ubk.0.vb
- %TEMP%\imqh8ubk.cmdline
- %TEMP%\imqh8ubk.out
- %WINDIR%\syswow64\clientcurre.exe
- %TEMP%\860onzd4.out
- %TEMP%\vbcb1a3.tmp
- %TEMP%\resa6f6.tmp
- %TEMP%\vbca6f5.tmp
- %TEMP%\5zdv6aoa.out
- %TEMP%\xhrhxjvbcg.txt
- %PROGRAMDATA%\system32clientghj\split.ico
- %TEMP%\d-wgi523.0.vb
- %TEMP%\d-wgi523.cmdline
- %TEMP%\d-wgi523.out
- %TEMP%\vbc99a7.tmp
- %TEMP%\res99a8.tmp
- %PROGRAMDATA%\system32clientghj\archer.ico
- %TEMP%\2gmih6g8.0.vb
- %TEMP%\2gmih6g8.cmdline
- %TEMP%\2gmih6g8.out
- %TEMP%\vbc9cc3.tmp
- %TEMP%\res9cd4.tmp
- %TEMP%\program.exe
- %PROGRAMDATA%\system32clientghj\dial.ico
- %TEMP%\0nlm0a2l.cmdline
- %TEMP%\0nlm0a2l.out
- %TEMP%\vbca02e.tmp
- %TEMP%\resa02f.tmp
- %PROGRAMDATA%\system32clientghj\dashborder_192.ico
- %TEMP%\zyatwtwk.0.vb
- %TEMP%\zyatwtwk.cmdline
- %TEMP%\zyatwtwk.out
- %TEMP%\vbca3a9.tmp
- %TEMP%\resa3aa.tmp
- %PROGRAMDATA%\system32clientghj\tileimage.ico
- %TEMP%\5zdv6aoa.0.vb
- %TEMP%\5zdv6aoa.cmdline
- %TEMP%\0nlm0a2l.0.vb
- %TEMP%\vbcbd7a.tmp
- %TEMP%\resbd7b.tmp
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\system32clientghj\system32clientnt.exe
Deletes the following files
- %TEMP%\res99a8.tmp
- %TEMP%\jzhbpqkj.0.vb
- %TEMP%\jzhbpqkj.out
- %TEMP%\jzhbpqkj.cmdline
- %TEMP%\resadfb.tmp
- %TEMP%\vbcadfa.tmp
- %TEMP%\toozvah_.0.vb
- %TEMP%\toozvah_.out
- %TEMP%\toozvah_.cmdline
- %TEMP%\resaa61.tmp
- %TEMP%\vbcaa60.tmp
- %TEMP%\resb1b4.tmp
- %TEMP%\860onzd4.out
- %TEMP%\860onzd4.cmdline
- %TEMP%\resb58c.tmp
- %TEMP%\vbcb58b.tmp
- %TEMP%\xtwh_xkn.out
- %TEMP%\xtwh_xkn.cmdline
- %TEMP%\xtwh_xkn.0.vb
- %TEMP%\imqh8ubk.cmdline
- %TEMP%\vbcb1a3.tmp
- %TEMP%\860onzd4.0.vb
- %TEMP%\5zdv6aoa.out
- %TEMP%\5zdv6aoa.cmdline
- %TEMP%\5zdv6aoa.0.vb
- %TEMP%\d-wgi523.out
- %TEMP%\d-wgi523.cmdline
- %TEMP%\d-wgi523.0.vb
- %TEMP%\res9cd4.tmp
- %TEMP%\vbc9cc3.tmp
- %TEMP%\2gmih6g8.0.vb
- %TEMP%\2gmih6g8.cmdline
- %TEMP%\2gmih6g8.out
- %TEMP%\resa02f.tmp
- %TEMP%\vbc99a7.tmp
- %TEMP%\vbca02e.tmp
- %TEMP%\0nlm0a2l.out
- %TEMP%\0nlm0a2l.cmdline
- %TEMP%\resa3aa.tmp
- %TEMP%\vbca3a9.tmp
- %TEMP%\zyatwtwk.cmdline
- %TEMP%\zyatwtwk.out
- %TEMP%\zyatwtwk.0.vb
- %TEMP%\resa6f6.tmp
- %TEMP%\vbca6f5.tmp
- %TEMP%\0nlm0a2l.0.vb
- %TEMP%\resbd7b.tmp
- %TEMP%\vbcbd7a.tmp
Network activity
Connects to
- 'mz#.##blicvm.com':491
UDP
- DNS ASK mz#.##blicvm.com
Miscellaneous
Creates and executes the following
- '%TEMP%\program.exe'
- '%TEMP%\server.exe'
- '%WINDIR%\syswow64\clientcurre.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3A1E.tmp" "%TEMP%\vbc3A1D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\flj0zihw.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES37DC.tmp" "%TEMP%\vbc37DB.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oruuuav4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3636.tmp" "%TEMP%\vbc3635.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB1B4.tmp" "%TEMP%\vbcB1A3.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v9svwdlg.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3471.tmp" "%TEMP%\vbc3470.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBD7B.tmp" "%TEMP%\vbcBD7A.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\imqh8ubk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB58C.tmp" "%TEMP%\vbcB58B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xtwh_xkn.cmdline"' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windowstyle hidden (Start-Process -FilePath $env:Temp\Server.exe)' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5_vtx7wk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\860onzd4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESADFB.tmp" "%TEMP%\vbcADFA.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA02F.tmp" "%TEMP%\vbcA02E.tmp"' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windowstyle hidden (Start-Process -FilePath $env:Temp\Program.exe)' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d-wgi523.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES99A8.tmp" "%TEMP%\vbc99A7.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2gmih6g8.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9CD4.tmp" "%TEMP%\vbc9CC3.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\toozvah_.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0nlm0a2l.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zyatwtwk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA3AA.tmp" "%TEMP%\vbcA3A9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5zdv6aoa.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA6F6.tmp" "%TEMP%\vbcA6F5.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jzhbpqkj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAA61.tmp" "%TEMP%\vbcAA60.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fqnl5llm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3BE3.tmp" "%TEMP%\vbc3BE2.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windowstyle hidden (Start-Process -FilePath $env:Temp\Server.exe)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3A1E.tmp" "%TEMP%\vbc3A1D.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\flj0zihw.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES37DC.tmp" "%TEMP%\vbc37DB.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\oruuuav4.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3636.tmp" "%TEMP%\vbc3635.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5_vtx7wk.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3471.tmp" "%TEMP%\vbc3470.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\v9svwdlg.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBD7B.tmp" "%TEMP%\vbcBD7A.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\imqh8ubk.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB58C.tmp" "%TEMP%\vbcB58B.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xtwh_xkn.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB1B4.tmp" "%TEMP%\vbcB1A3.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\860onzd4.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fqnl5llm.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESADFB.tmp" "%TEMP%\vbcADFA.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAA61.tmp" "%TEMP%\vbcAA60.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jzhbpqkj.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA6F6.tmp" "%TEMP%\vbcA6F5.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5zdv6aoa.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA3AA.tmp" "%TEMP%\vbcA3A9.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zyatwtwk.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA02F.tmp" "%TEMP%\vbcA02E.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0nlm0a2l.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9CD4.tmp" "%TEMP%\vbc9CC3.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2gmih6g8.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES99A8.tmp" "%TEMP%\vbc99A7.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d-wgi523.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\aspnet_compiler.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windowstyle hidden (Start-Process -FilePath $env:Temp\Program.exe)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\toozvah_.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3BE3.tmp" "%TEMP%\vbc3BE2.tmp"
