Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%LOCALAPPDATA%\Browser\reg32.exe�'
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- '%APPDATA%\vbc.exe'
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %APPDATA%\vbc.exe
- %TEMP%\inetpub\subject\backups\36.opends60.dll
- %TEMP%\inetpub\subject\backups\csspkgui.dll
- %TEMP%\inetpub\subject\backups\x-ole-storage.xml
- %TEMP%\analog\podcast\json-api\43.opends60.dll
- %TEMP%\analog\podcast\json-api\parent.xml
- %TEMP%\capeoocyte
- %TEMP%\petiolelaryngology.dll
- %TEMP%\newattachment\webadmin\x-atari-lynx-rom.xml
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\aw39nmls\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\o3ef56sb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\i59sz40k\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7atq93mh\desktop.ini
- %TEMP%\inetpub\subject\backups\projwizui.dll
- %TEMP%\inetpub\subject\backups\atltracetoolui.dll
- %TEMP%\inetpub\subject\backups\handlers.xml
- %TEMP%\inetpub\subject\backups\62.opends60.dll
- %TEMP%\inetpub\subject\backups\com.ubuntu.softwareproperties.gschema.xml
- %TEMP%\nsw118e.tmp\userinfo.dll
- %TEMP%\newattachment\webadmin\org.gnome.seahorse.gschema.xml
- %TEMP%\newattachment\webadmin\microsoftvisualbasicvsa.dll
- %TEMP%\newattachment\webadmin\vslogp.dll
- %TEMP%\newattachment\webadmin\45.opends60.dll
- %TEMP%\newattachment\webadmin\gpx+xml.xml
- %TEMP%\newattachment\webadmin\x-gedcom.xml
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %TEMP%\newattachment\webadmin\81.opends60.dll
- %TEMP%\newattachment\webadmin\org.gnome.settings-daemon.plugins.housekeeping.gschema.xml
- %TEMP%\newattachment\webadmin\wsdl.exe
- %TEMP%\newattachment\webadmin\vsasvrp.dll
- %TEMP%\newattachment\webadmin\vbu.exe
- %TEMP%\inetpub\subject\backups\57.opends60.dll
- %TEMP%\inetpub\subject\backups\x-kspread-crypt.xml
- %TEMP%\inetpub\subject\backups\34.opends60.dll
- %TEMP%\nsh117e.tmp
- %TEMP%\newattachment\webadmin\x-matroska.xml
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\aw39nmls\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\o3ef56sb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\i59sz40k\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7atq93mh\desktop.ini
Deletes the following files
- %TEMP%\nsw118e.tmp\userinfo.dll
Network activity
TCP
HTTP GET requests
- http://ec##hore.ga/~zadmin/safe/ap.exe
- http://ap#.#pify.org/
UDP
- DNS ASK ec##hore.ga
- DNS ASK my####rnalip.com
- DNS ASK ap#.#pify.org
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\rundll32.exe' PetioleLaryngology,Michelle
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
