Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System' = '%APPDATA%\System.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.vbs
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.js
Creates the following files on removable media
- <Drive name for removable media>:\system\system.exe
- <Drive name for removable media>:\archer.avi
Modifies file system
Creates the following files
- C:\system\system.exe
- %TEMP%\res20fd.tmp
- %TEMP%\vbc861c474a7d2f4cb0bfc9e2162198189a.tmp
- %TEMP%\vbc5329f1726a2c4b3fb55ba7dd15efe0c4.tmp
- %TEMP%\szh4z255.out
- %TEMP%\szh4z255.cmdline
- %TEMP%\szh4z255.0.vb
- C:\recovery.exe
- %TEMP%\res19f8.tmp
- %TEMP%\vbc615a6038f6c844dd90ca1e1e7b4cc86d.tmp
- %TEMP%\vbc8de2688d6b64c9199e857fc3d9f37b.tmp
- %TEMP%\njtab1ur.out
- %TEMP%\njtab1ur.cmdline
- %TEMP%\njtab1ur.0.vb
- %ProgramFiles%.exe
- %TEMP%\res1267.tmp
- C:\totalcmd.exe
- %PROGRAMDATA%\system\install.ico
- %TEMP%\al3miox3.cmdline
- %TEMP%\bioiqvfk.0.vb
- %TEMP%\al3miox3.0.vb
- %PROGRAMDATA%\system\archer.ico
- D:\$recycle.bin.exe
- %TEMP%\res435a.tmp
- %TEMP%\vbcabc62f45f1834001afe6ac7dfc33a92b.tmp
- %TEMP%\vbc45fed95cb46a490da25b9c106e9d8e34.tmp
- %TEMP%\lxbx0bss.out
- %TEMP%\lxbx0bss.cmdline
- %TEMP%\lxbx0bss.0.vb
- D:\install.log.exe
- %TEMP%\res3466.tmp
- %TEMP%\vbc3b6fe5701ddf4fa6971aa62cf6cdda.tmp
- %TEMP%\vbc5da7d321af424bb18111c060d24315df.tmp
- %TEMP%\bioiqvfk.out
- %TEMP%\bioiqvfk.cmdline
- %TEMP%\vbcfbaaa9ec6ef341118edcf379f2aa7acf.tmp
- D:\system\system.exe
- %TEMP%\vbc4ab9fac8ffa34cc1a51610374656bb28.tmp
- %TEMP%\yyzmzpoo.cmdline
- C:\documents and settings.exe
- %TEMP%\res7eb2.tmp
- %TEMP%\vbcf3bbbd863f49451c95b8477de7b69741.tmp
- %TEMP%\vbc1377e0aac3c04956be93424fdfbbc6db.tmp
- %TEMP%\ttzhgph2.out
- %TEMP%\ttzhgph2.cmdline
- %TEMP%\ttzhgph2.0.vb
- C:\$recycle.bin.exe
- %TEMP%\res784a.tmp
- %TEMP%\vbcecb2d208f524412b81dbd7c2984785.tmp
- %TEMP%\vbceb1b9067715a4ab5b4af6d168ec48b7d.tmp
- %TEMP%\bxoauu3f.out
- %TEMP%\bxoauu3f.cmdline
- %TEMP%\bxoauu3f.0.vb
- %PROGRAMDATA%\system\rfrtnhui.ico
- %TEMP%\yyzmzpoo.0.vb
- %TEMP%\yyzmzpoo.out
- %TEMP%\5sm3s34x.cmdline
- %TEMP%\vbc705bfd9bfdfa4771bebb1def732b6b5e.tmp
- %TEMP%\5sm3s34x.0.vb
- %APPDATA%\system.exe
- %TEMP%\a1abh443.out
- %TEMP%\a1abh443.cmdline
- %TEMP%\a1abh443.0.vb
- C:\msocache.exe
- %TEMP%\res8c6e.tmp
- %TEMP%\vbca82003cff6034322aa97b2523b339a5.tmp
- %TEMP%\vbc7a57072614c54e769d14f26bd92e3ce4.tmp
- %TEMP%\u3zr02nx.out
- %TEMP%\u3zr02nx.cmdline
- %TEMP%\u3zr02nx.0.vb
- C:\far2.exe
- %TEMP%\res849e.tmp
- %TEMP%\vbc9ff6f2fba26f45748ad87aacaf165343.tmp
- %TEMP%\5sm3s34x.out
- %TEMP%\al3miox3.out
Sets the 'hidden' attribute to the following files
- C:\system\system.exe
- D:\system\system.exe
- <Drive name for removable media>:\system\system.exe
Deletes the following files
- %TEMP%\res784a.tmp
- %TEMP%\5sm3s34x.out
- %TEMP%\res19f8.tmp
- %TEMP%\vbc615a6038f6c844dd90ca1e1e7b4cc86d.tmp
- %TEMP%\vbc8de2688d6b64c9199e857fc3d9f37b.tmp
- %TEMP%\njtab1ur.cmdline
- %TEMP%\njtab1ur.out
- %TEMP%\njtab1ur.0.vb
- %TEMP%\res20fd.tmp
- %TEMP%\vbc861c474a7d2f4cb0bfc9e2162198189a.tmp
- %TEMP%\vbc5329f1726a2c4b3fb55ba7dd15efe0c4.tmp
- %TEMP%\5sm3s34x.0.vb
- %TEMP%\5sm3s34x.cmdline
- %TEMP%\szh4z255.0.vb
- %TEMP%\res3466.tmp
- %TEMP%\vbc3b6fe5701ddf4fa6971aa62cf6cdda.tmp
- %TEMP%\vbc5da7d321af424bb18111c060d24315df.tmp
- %TEMP%\bioiqvfk.out
- %TEMP%\bioiqvfk.cmdline
- %TEMP%\bioiqvfk.0.vb
- %TEMP%\res435a.tmp
- %TEMP%\vbcabc62f45f1834001afe6ac7dfc33a92b.tmp
- %TEMP%\vbc45fed95cb46a490da25b9c106e9d8e34.tmp
- %TEMP%\lxbx0bss.cmdline
- %TEMP%\szh4z255.out
- %TEMP%\szh4z255.cmdline
- %TEMP%\vbc4ab9fac8ffa34cc1a51610374656bb28.tmp
- %TEMP%\vbcfbaaa9ec6ef341118edcf379f2aa7acf.tmp
- %TEMP%\res1267.tmp
- %TEMP%\vbceb1b9067715a4ab5b4af6d168ec48b7d.tmp
- %TEMP%\bxoauu3f.cmdline
- %TEMP%\bxoauu3f.out
- %TEMP%\bxoauu3f.0.vb
- %TEMP%\res7eb2.tmp
- %TEMP%\vbcf3bbbd863f49451c95b8477de7b69741.tmp
- %TEMP%\vbc1377e0aac3c04956be93424fdfbbc6db.tmp
- %TEMP%\ttzhgph2.out
- %TEMP%\ttzhgph2.0.vb
- %TEMP%\ttzhgph2.cmdline
- %TEMP%\res849e.tmp
- %TEMP%\vbcecb2d208f524412b81dbd7c2984785.tmp
- %TEMP%\vbc9ff6f2fba26f45748ad87aacaf165343.tmp
- %TEMP%\yyzmzpoo.cmdline
- %TEMP%\yyzmzpoo.0.vb
- %TEMP%\yyzmzpoo.out
- %TEMP%\res8c6e.tmp
- %TEMP%\vbca82003cff6034322aa97b2523b339a5.tmp
- %TEMP%\vbc7a57072614c54e769d14f26bd92e3ce4.tmp
- %TEMP%\u3zr02nx.out
- %TEMP%\u3zr02nx.cmdline
- %TEMP%\u3zr02nx.0.vb
- %TEMP%\a1abh443.0.vb
- %TEMP%\a1abh443.cmdline
- %TEMP%\vbc705bfd9bfdfa4771bebb1def732b6b5e.tmp
- %TEMP%\lxbx0bss.0.vb
- %TEMP%\lxbx0bss.out
Network activity
Connects to
- 'sy#####23.linkpc.net':333
UDP
- DNS ASK sy#####23.linkpc.net
Miscellaneous
Creates and executes the following
- '%APPDATA%\system.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\bxoauu3f.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\lxbx0bss.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3466.tmp" "%TEMP%\vbc3B6FE5701DDF4FA6971AA62CF6CDDA.TMP"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 10 /tn "System" /tr "%APPDATA%\System.exe"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\bioiqvfk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES20FD.tmp" "%TEMP%\vbc861C474A7D2F4CB0BFC9E2162198189A.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\szh4z255.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES19F8.tmp" "%TEMP%\vbc615A6038F6C844DD90CA1E1E7B4CC86D.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\njtab1ur.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1267.tmp" "%TEMP%\vbcFBAAA9EC6EF341118EDCF379F2AA7ACF.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\5sm3s34x.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\a1abh443.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8C6E.tmp" "%TEMP%\vbcA82003CFF6034322AA97B2523B339A5.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\u3zr02nx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES849E.tmp" "%TEMP%\vbc9FF6F2FBA26F45748AD87AACAF165343.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\yyzmzpoo.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7EB2.tmp" "%TEMP%\vbcF3BBBD863F49451C95B8477DE7B69741.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ttzhgph2.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES784A.tmp" "%TEMP%\vbcECB2D208F524412B81DBD7C2984785.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES435A.tmp" "%TEMP%\vbcABC62F45F1834001AFE6AC7DFC33A92B.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\al3miox3.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\bxoauu3f.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\lxbx0bss.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3466.tmp" "%TEMP%\vbc3B6FE5701DDF4FA6971AA62CF6CDDA.TMP"
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 10 /tn "System" /tr "%APPDATA%\System.exe"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\bioiqvfk.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES20FD.tmp" "%TEMP%\vbc861C474A7D2F4CB0BFC9E2162198189A.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\szh4z255.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES19F8.tmp" "%TEMP%\vbc615A6038F6C844DD90CA1E1E7B4CC86D.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\njtab1ur.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES435A.tmp" "%TEMP%\vbcABC62F45F1834001AFE6AC7DFC33A92B.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1267.tmp" "%TEMP%\vbcFBAAA9EC6EF341118EDCF379F2AA7ACF.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\a1abh443.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8C6E.tmp" "%TEMP%\vbcA82003CFF6034322AA97B2523B339A5.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\u3zr02nx.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES849E.tmp" "%TEMP%\vbc9FF6F2FBA26F45748AD87AACAF165343.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\yyzmzpoo.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7EB2.tmp" "%TEMP%\vbcF3BBBD863F49451C95B8477DE7B69741.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ttzhgph2.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES784A.tmp" "%TEMP%\vbcECB2D208F524412B81DBD7C2984785.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\5sm3s34x.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\al3miox3.cmdline"
