Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'webHancer Agent' = '"%PROGRAM_FILES%\webHancer\Programs\whAgent.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'bg' = '%TEMP%\bullguard.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RVP' = '"%PROGRAM_FILES%\RVP\bpc.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RunDLL' = 'rundll32.exe "<SYSTEM32>\bridge.dll",Load'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\WS2IFSL] 'Start' = '00000001'
Malicious functions:
Creates and executes the following:
- %TEMP%\flashtlk.exe
- %PROGRAM_FILES%\webHancer\Programs\whAgent.exe %PROGRAM_FILES%\webHancer\
- %WINDIR%\biprep.exe
- %TEMP%\counter.exe "&broadcastpc&flingstone&webhancer&bullguard&betterinet"
- %PROGRAM_FILES%\RVP\bpc.exe
- %TEMP%\bpc_gu.exe
- %TEMP%\WZS4.tmp\whInstaller.exe /silent
- %TEMP%\9174.exe
Executes the following:
- %WINDIR%\explorer.exe http://do#######.abetterinternet.com/download/cabs/FON19113/downloading.php
- %WINDIR%\explorer.exe c:\
Searches for windows to
detect programs and games:
- ClassName: 'AOL Frame25' WindowName: ''
Modifies file system :
Creates the following files:
- %WINDIR%\SET10.tmp
- %WINDIR%\SETF.tmp
- %WINDIR%\SET11.tmp
- %TEMP%\~GLH0003.TMP
- %WINDIR%\whInstaller.ini
- %PROGRAM_FILES%\webHancer\Programs\SETE.tmp
- %PROGRAM_FILES%\webHancer\Programs\SETA.tmp
- %PROGRAM_FILES%\webHancer\Programs\SET9.tmp
- %PROGRAM_FILES%\webHancer\Programs\SETB.tmp
- %PROGRAM_FILES%\webHancer\Programs\SETD.tmp
- %PROGRAM_FILES%\webHancer\Programs\SETC.tmp
- %TEMP%\~GLH0004.TMP
- %TEMP%\GLM14.tmp
- %TEMP%\GLK13.tmp
- %WINDIR%\SET16.tmp
- %WINDIR%\inf\SET1A.tmp
- %WINDIR%\SET17.tmp
- %TEMP%\biprep.exe
- %TEMP%\flashtlk.cab
- %TEMP%\~GLH0005.TMP
- %TEMP%\GLC12.tmp
- %TEMP%\bi.dll
- %TEMP%\flashtlk.inf
- <SYSTEM32>\a.exe
- %TEMP%\~GLH0002.TMP
- <SYSTEM32>\bridge.dll
- %TEMP%\WZS4.tmp\readme.txt
- %TEMP%\WZS4.tmp\license.txt
- %TEMP%\~GLH0001.TMP
- %TEMP%\GLK2.tmp
- %TEMP%\GLC1.tmp
- %TEMP%\~GLH0000.TMP
- %PROGRAM_FILES%\RVP\uninst.exe
- %PROGRAM_FILES%\RVP\bpc.exe
- %TEMP%\WZS4.tmp\Sporder.dll
- %TEMP%\WZS4.tmp\whInstaller.exe
- %TEMP%\WZS4.tmp\whieshm.dll
- %TEMP%\WZS4.tmp\whInstaller.ini
- %PROGRAM_FILES%\webHancer\Programs\SET8.tmp
- %PROGRAM_FILES%\webHancer\Programs\SET7.tmp
- %TEMP%\WZS4.tmp\whiehlpr.dll
- %TEMP%\WZS4.tmp\Webhdll.dll
- %TEMP%\WZS4.tmp\wbhshare.dll
- %TEMP%\WZS4.tmp\WhAgent.exe
- %TEMP%\WZS4.tmp\whAgent.ini
- %TEMP%\WZS4.tmp\whAgent.inf
Deletes the following files:
- %TEMP%\WZS4.tmp\whiehlpr.dll
- %TEMP%\WZS4.tmp\whAgent.ini
- %TEMP%\WZS4.tmp\whAgent.inf
- %TEMP%\WZS4.tmp\whInstaller.ini
- %TEMP%\WZS4.tmp\whInstaller.exe
- %TEMP%\WZS4.tmp\whieshm.dll
- %TEMP%\WZS4.tmp\Sporder.dll
- %TEMP%\WZS4.tmp\readme.txt
- %TEMP%\WZS4.tmp\license.txt
- %TEMP%\WZS4.tmp\WhAgent.exe
- %TEMP%\WZS4.tmp\Webhdll.dll
- %TEMP%\WZS4.tmp\wbhshare.dll
Moves the following files:
- from %TEMP%\~GLH0003.TMP to %TEMP%\bullguard.exe
- from %TEMP%\~GLH0004.TMP to %TEMP%\flashtlk.exe
- from %WINDIR%\SET11.tmp to %WINDIR%\whAgent.inf
- from %WINDIR%\SETF.tmp to %WINDIR%\webhdll.dll
- from %WINDIR%\SET10.tmp to %WINDIR%\whInstaller.exe
- from %WINDIR%\inf\SET1A.tmp to %WINDIR%\inf\flashtlk.inf
- from %TEMP%\~GLH0000.TMP to %TEMP%\1
- from %WINDIR%\SET17.tmp to %WINDIR%\biprep.exe
- from %TEMP%\~GLH0005.TMP to %TEMP%\counter.exe
- from %WINDIR%\SET16.tmp to %WINDIR%\bi.dll
- from %PROGRAM_FILES%\webHancer\Programs\SETE.tmp to %PROGRAM_FILES%\webHancer\Programs\whAgent.ini
- from %PROGRAM_FILES%\webHancer\Programs\SET7.tmp to %PROGRAM_FILES%\webHancer\Programs\license.txt
- from %PROGRAM_FILES%\webHancer\Programs\SET8.tmp to %PROGRAM_FILES%\webHancer\Programs\readme.txt
- from %TEMP%\~GLH0002.TMP to %TEMP%\whCC-GROKSTER.exe
- from %TEMP%\~GLH0000.TMP to %TEMP%\bpc_gu.exe
- from %TEMP%\~GLH0001.TMP to %TEMP%\9174.exe
- from %PROGRAM_FILES%\webHancer\Programs\SETC.tmp to %PROGRAM_FILES%\webHancer\Programs\whiehlpr.dll
- from %PROGRAM_FILES%\webHancer\Programs\SETD.tmp to %PROGRAM_FILES%\webHancer\Programs\whieshm.dll
- from %PROGRAM_FILES%\webHancer\Programs\SETB.tmp to %PROGRAM_FILES%\webHancer\Programs\whAgent.exe
- from %PROGRAM_FILES%\webHancer\Programs\SET9.tmp to %PROGRAM_FILES%\webHancer\Programs\sporder.dll
- from %PROGRAM_FILES%\webHancer\Programs\SETA.tmp to %PROGRAM_FILES%\webHancer\Programs\wbhshare.dll
Network activity:
Connects to:
- 'pr###.webhancer.com':80
- 'localhost':1041
- 's.#####erinternet.com':80
- 'co####.broadcastpc.tv':80
- 'ww##.#lingstone.com':80
- 'www.gr###ter.com':80
TCP:
HTTP GET requests:
- www.gr###ter.com/count/count.php?"&######################################################
- s.#####erinternet.com/bi/servlet/BIMaster?ad###########################################################################################################################################################
- co####.broadcastpc.tv/configs/default/config.php?id########################################################################
- ww##.#lingstone.com/welcome.php?h_###################################################################################################################################################################################
HTTP POST requests:
- pr###.webhancer.com/
UDP:
- DNS ASK s.#####erinternet.com
- DNS ASK do#######.abetterinternet.com
- DNS ASK c.#####erinternet.com
- DNS ASK pr###.webhancer.com
- DNS ASK co####.broadcastpc.tv
- DNS ASK ww##.#lingstone.com
- DNS ASK www.gr###ter.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RVP' WindowName: ''
- ClassName: 'RVP' WindowName: 'RVP'
