Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\lgteam\ddos-tools-by-lg.exe
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\correct.avi.exe
- <Drive name for removable media>:\delete.avi
Modifies file system
Creates the following files
- C:\lgteam\ddos-tools-by-lg.exe
- D:\lgteam\ddos-tools-by-lg.exe
- C:\totalcmd.exe
- %TEMP%\resefc8.tmp
- %TEMP%\vbcefc7.tmp
- %TEMP%\feqtpf3j.out
- %TEMP%\feqtpf3j.cmdline
- %PROGRAMDATA%\lgteam\install.ico
- %TEMP%\feqtpf3j.0.vb
- %TEMP%\rese7c9.tmp
- %TEMP%\vbce7c8.tmp
- %TEMP%\j_jg0vok.out
- %TEMP%\j_jg0vok.cmdline
- %TEMP%\j_jg0vok.0.vb
- C:\program files.exe
- C:\recovery.exe
- %TEMP%\vbc2d2.tmp
- %TEMP%\resac2.tmp
- %TEMP%\6tmo2blq.out
- %TEMP%\vbcac1.tmp
- %TEMP%\bu_lfnzw.out
- %TEMP%\bu_lfnzw.cmdline
- %TEMP%\bu_lfnzw.0.vb
- %PROGRAMDATA%\lgteam\correct.ico
- D:\$recycle.bin.exe
- %TEMP%\resdfe9.tmp
- %TEMP%\res2d3.tmp
- %TEMP%\jndnlpfc.out
- %TEMP%\jndnlpfc.cmdline
- %TEMP%\jndnlpfc.0.vb
- D:\install.log.exe
- %TEMP%\resfbbe.tmp
- %TEMP%\vbcfbae.tmp
- %TEMP%\6tmo2blq.0.vb
- %TEMP%\6tmo2blq.cmdline
- %TEMP%\vbcdfe8.tmp
- %TEMP%\vbcc358.tmp
- %TEMP%\f3c1wdlz.0.vb
- C:\documents and settings.exe
- %TEMP%\resbb1b.tmp
- %TEMP%\vbcbb0b.tmp
- %TEMP%\upt3k9hj.out
- %TEMP%\upt3k9hj.cmdline
- %TEMP%\f3c1wdlz.cmdline
- %TEMP%\upt3k9hj.0.vb
- %TEMP%\resb3c8.tmp
- %TEMP%\vbcb3b8.tmp
- %TEMP%\8sj1wmpx.out
- %TEMP%\8sj1wmpx.cmdline
- %TEMP%\8sj1wmpx.0.vb
- %PROGRAMDATA%\lgteam\svoqqnl.ico
- C:\$recycle.bin.exe
- C:\msocache.exe
- %TEMP%\usoebnfc.cmdline
- %TEMP%\resc359.tmp
- %TEMP%\usoebnfc.0.vb
- C:\perflogs.exe
- %TEMP%\resd589.tmp
- %TEMP%\vbcd588.tmp
- %TEMP%\ml4dlhnt.out
- %TEMP%\ml4dlhnt.cmdline
- %TEMP%\usoebnfc.out
- %TEMP%\ml4dlhnt.0.vb
- %TEMP%\rescb96.tmp
- %TEMP%\vbccb95.tmp
- %TEMP%\6go2ntc7.out
- %TEMP%\6go2ntc7.cmdline
- %TEMP%\6go2ntc7.0.vb
- C:\far2.exe
- %TEMP%\f3c1wdlz.out
- %PROGRAMDATA%\lgteam\delete.ico
Sets the 'hidden' attribute to the following files
- C:\lgteam\ddos-tools-by-lg.exe
- D:\lgteam\ddos-tools-by-lg.exe
- <Drive name for removable media>:\lgteam\ddos-tools-by-lg.exe
Deletes the following files
- %TEMP%\resb3c8.tmp
- %TEMP%\usoebnfc.0.vb
- %TEMP%\rese7c9.tmp
- %TEMP%\vbce7c8.tmp
- %TEMP%\j_jg0vok.cmdline
- %TEMP%\j_jg0vok.0.vb
- %TEMP%\j_jg0vok.out
- %TEMP%\resefc8.tmp
- %TEMP%\vbcefc7.tmp
- %TEMP%\feqtpf3j.0.vb
- %TEMP%\feqtpf3j.out
- %TEMP%\feqtpf3j.cmdline
- %TEMP%\vbcfbae.tmp
- %TEMP%\bu_lfnzw.0.vb
- %TEMP%\6tmo2blq.cmdline
- %TEMP%\6tmo2blq.0.vb
- %TEMP%\6tmo2blq.out
- %TEMP%\res2d3.tmp
- %TEMP%\vbc2d2.tmp
- %TEMP%\jndnlpfc.0.vb
- %TEMP%\jndnlpfc.out
- %TEMP%\jndnlpfc.cmdline
- %TEMP%\resac2.tmp
- %TEMP%\vbcac1.tmp
- %TEMP%\bu_lfnzw.cmdline
- %TEMP%\usoebnfc.cmdline
- %TEMP%\resfbbe.tmp
- %TEMP%\usoebnfc.out
- %TEMP%\f3c1wdlz.cmdline
- %TEMP%\vbcb3b8.tmp
- %TEMP%\8sj1wmpx.out
- %TEMP%\8sj1wmpx.0.vb
- %TEMP%\8sj1wmpx.cmdline
- %TEMP%\resbb1b.tmp
- %TEMP%\vbcbb0b.tmp
- %TEMP%\upt3k9hj.cmdline
- %TEMP%\upt3k9hj.out
- %TEMP%\upt3k9hj.0.vb
- %TEMP%\resc359.tmp
- %TEMP%\vbcc358.tmp
- %TEMP%\f3c1wdlz.out
- %TEMP%\resdfe9.tmp
- %TEMP%\f3c1wdlz.0.vb
- %TEMP%\rescb96.tmp
- %TEMP%\vbccb95.tmp
- %TEMP%\6go2ntc7.cmdline
- %TEMP%\6go2ntc7.out
- %TEMP%\6go2ntc7.0.vb
- %TEMP%\resd589.tmp
- %TEMP%\vbcd588.tmp
- %TEMP%\ml4dlhnt.0.vb
- %TEMP%\ml4dlhnt.cmdline
- %TEMP%\ml4dlhnt.out
- %TEMP%\vbcdfe8.tmp
- %TEMP%\bu_lfnzw.out
Network activity
Connects to
- '77.##6.98.136':8989
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8sj1wmpx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAC2.tmp" "%TEMP%\vbcAC1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bu_lfnzw.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2D3.tmp" "%TEMP%\vbc2D2.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jndnlpfc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFBBE.tmp" "%TEMP%\vbcFBAE.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6tmo2blq.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEFC8.tmp" "%TEMP%\vbcEFC7.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\feqtpf3j.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE7C9.tmp" "%TEMP%\vbcE7C8.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j_jg0vok.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDFE9.tmp" "%TEMP%\vbcDFE8.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\usoebnfc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD589.tmp" "%TEMP%\vbcD588.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ml4dlhnt.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCB96.tmp" "%TEMP%\vbcCB95.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6go2ntc7.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC359.tmp" "%TEMP%\vbcC358.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f3c1wdlz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB1B.tmp" "%TEMP%\vbcBB0B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\upt3k9hj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB3C8.tmp" "%TEMP%\vbcB3B8.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3by_crqf.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6680.tmp" "%TEMP%\vbc666F.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\8sj1wmpx.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAC2.tmp" "%TEMP%\vbcAC1.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bu_lfnzw.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2D3.tmp" "%TEMP%\vbc2D2.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jndnlpfc.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFBBE.tmp" "%TEMP%\vbcFBAE.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6tmo2blq.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEFC8.tmp" "%TEMP%\vbcEFC7.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\feqtpf3j.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE7C9.tmp" "%TEMP%\vbcE7C8.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\j_jg0vok.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDFE9.tmp" "%TEMP%\vbcDFE8.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\usoebnfc.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD589.tmp" "%TEMP%\vbcD588.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ml4dlhnt.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCB96.tmp" "%TEMP%\vbcCB95.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6go2ntc7.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC359.tmp" "%TEMP%\vbcC358.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f3c1wdlz.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB1B.tmp" "%TEMP%\vbcBB0B.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\upt3k9hj.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB3C8.tmp" "%TEMP%\vbcB3B8.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3by_crqf.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6680.tmp" "%TEMP%\vbc666F.tmp"
