Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\min config 347ti.lnk
Malicious functions
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://te######y16.blogspot.com/
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- <Current directory>\unhzb.exe
- <Current directory>\tik_skqxq.txt
- %TEMP%\order_vsد.vbs
- <Current directory>\tik_cuwpkf.txt
- %TEMP%\order_bةسв.vbs
- <Current directory>\tik_lvxqs.txt
- %TEMP%\order_ooyy.vbs
- <Current directory>\tik_glymj.txt
- %TEMP%\order_seنهwه.vbs
- <Current directory>\tik_wttpxmp.txt
- %TEMP%\order_gsx.vbs
- <Current directory>\tik_ruirqbyi.txt
- <Current directory>\tik_ngzvjmowk.txt
- <Current directory>\tik_rxcylrhmf.txt
- %TEMP%\order_щlخшв.vbs
- <Current directory>\tik_yowhl.txt
- %TEMP%\order_طqхدy.vbs
- <Current directory>\tik_jqeeubl.txt
- %TEMP%\order_lتظxgض.vbs
- <Current directory>\tik_uppgd.txt
- %TEMP%\order_غzкнم.vbs
- <Current directory>\tik_xqmaecj.txt
- %TEMP%\order_iur.vbs
- <Current directory>\tik_xidzkidk.txt
- %TEMP%\order_جлъмvى.vbs
- %TEMP%\order_ыyщw.vbs
- %TEMP%\order_зلضcр.vbs
- <Current directory>\tik_vcvxgkxcz.txt
- <Current directory>\acc.txt
- %TEMP%\3m7ubjod.0.vb
- %TEMP%\3m7ubjod.cmdline
- %TEMP%\3m7ubjod.out
- %TEMP%\vbc5716.tmp
- %TEMP%\res5717.tmp
- <Current directory>\qjxg.exe
- <Current directory>\rcx6212.tmp
- <Current directory>\mine.txt
- %TEMP%\order_oة.vbs
- <Current directory>\tik_krfgpc.txt
- %TEMP%\order_ишمйшх.vbs
- <Current directory>\tik_hcayfg.txt
- <Current directory>\tik_vkywgbxxf.txt
- %TEMP%\order_qدzذ.vbs
- <Current directory>\tik_nhzuais.txt
- %TEMP%\order_ضkы.vbs
- <Current directory>\tik_pupeeq.txt
- %TEMP%\order_bvكhax.vbs
- <Current directory>\tik_ihaucd.txt
- %TEMP%\order_sسيqث.vbs
- <Current directory>\tik_bqenwsriy.txt
- %TEMP%\order_ءnlظ.vbs
- <Current directory>\tik_blwvn.txt
- %TEMP%\order_xهشfدь.vbs
- %TEMP%\order_уىj.vbs
- %TEMP%\order_دjصtdn.vbs
Deletes the following files
- %TEMP%\res5717.tmp
- <Current directory>\tik_cuwpkf.txt
- %TEMP%\order_bةسв.vbs
- <Current directory>\tik_lvxqs.txt
- %TEMP%\order_ooyy.vbs
- <Current directory>\tik_glymj.txt
- %TEMP%\order_seنهwه.vbs
- <Current directory>\tik_wttpxmp.txt
- %TEMP%\order_gsx.vbs
- <Current directory>\tik_ruirqbyi.txt
- %TEMP%\order_зلضcр.vbs
- %TEMP%\order_щlخшв.vbs
- <Current directory>\tik_rxcylrhmf.txt
- <Current directory>\tik_yowhl.txt
- %TEMP%\order_طqхدy.vbs
- <Current directory>\tik_jqeeubl.txt
- %TEMP%\order_lتظxgض.vbs
- <Current directory>\tik_uppgd.txt
- %TEMP%\order_غzкнم.vbs
- <Current directory>\tik_xqmaecj.txt
- %TEMP%\order_iur.vbs
- <Current directory>\tik_xidzkidk.txt
- %TEMP%\order_جлъмvى.vbs
- %TEMP%\order_vsد.vbs
- <Current directory>\tik_ngzvjmowk.txt
- <Current directory>\tik_skqxq.txt
- <Current directory>\tik_nhzuais.txt
- %TEMP%\vbc5716.tmp
- %TEMP%\3m7ubjod.cmdline
- %TEMP%\3m7ubjod.0.vb
- %TEMP%\3m7ubjod.out
- <Current directory>\qjxg.exe
- %TEMP%\order_oة.vbs
- <Current directory>\tik_krfgpc.txt
- %TEMP%\order_ишمйшх.vbs
- <Current directory>\tik_hcayfg.txt
- %TEMP%\order_qدzذ.vbs
- %TEMP%\order_ضkы.vbs
- <Current directory>\tik_vcvxgkxcz.txt
- <Current directory>\tik_pupeeq.txt
- %TEMP%\order_bvكhax.vbs
- <Current directory>\tik_ihaucd.txt
- %TEMP%\order_sسيqث.vbs
- <Current directory>\tik_bqenwsriy.txt
- %TEMP%\order_ءnlظ.vbs
- <Current directory>\tik_blwvn.txt
- %TEMP%\order_xهشfدь.vbs
- <Current directory>\tik_vkywgbxxf.txt
- %TEMP%\order_уىj.vbs
- %TEMP%\order_ыyщw.vbs
- %TEMP%\order_دjصtdn.vbs
Moves the following files
- from <Current directory>\rcx6212.tmp to <Current directory>\unhzb.exe
Moves itself
- from <Full path to file> to <Current directory>\mnxwqvz.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://te######y16.blogspot.com/
- http://fo###.#oogleapis.com/css?fa###########
- http://fo###.#oogleapis.com/css?fa############
- http://fo###.#oogleapis.com/css?fa####################
- http://fo###.#oogleapis.com/css?fa################
- http://fo###.#oogleapis.com/css?fa#######################
- http://fo###.#oogleapis.com/css?fa#####################
- http://fo###.#oogleapis.com/css?fa#########
- http://pa###bin.com/download.php?i=########
- http://pa###bin.com/download/GURNbU1n
UDP
- DNS ASK google.com
- DNS ASK te######y16.blogspot.com
- DNS ASK bl##ger.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK pa###bin.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_уىJ.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_Vsد.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_Iur.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_غZкнم.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_lتظxgض.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_طqхدY.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_щlخшв.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_зلضCр.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_GSX.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_SEنهwه.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_OoyY.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_دjصTdn.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_bةسв.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_xهشFدь.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_ءnlظ.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_Sسيqث.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_BvكhaX.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_ضKы.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_qدZذ.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_ишمйшх.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_oة.vbs"
- '<Current directory>\unhzb.exe'
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_جлъмVى.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_ыYщw.vbs"
- '<SYSTEM32>\ping.exe' -n 1 www.google.com' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5717.tmp" "%TEMP%\vbc5716.tmp"' (with hidden window)
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://te######y16.blogspot.com/' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3m7ubjod.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3m7ubjod.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5717.tmp" "%TEMP%\vbc5716.tmp"
- '<SYSTEM32>\ping.exe' -n 1 www.google.com
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_sةcqRE.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_zEث.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_црeнذн.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_جсмؤ.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\order_ьقظدW.vbs"
