Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Alcohol120FilmAcc' = '%TEMP%\RarSFX0\Alcohol120FilmAcc.exe'
Malicious functions:
Creates and executes the following:
- %TEMP%\RarSFX0\Alcohol120_trial_2.0.2.4713.exe /_ShowProgress
- %TEMP%\RarSFX0\Alcohol120_trial_2.0.2.4713.exe
- %TEMP%\RarSFX0\Alcohol120FilmAcc.exe
Executes the following:
- <SYSTEM32>\notepad.exe %TEMP%\RarSFX0\read.txt
- <SYSTEM32>\wscript.exe -e:vbs "%TEMP%\RarSFX0\Alcohol120FilmAcc.bat"
- <SYSTEM32>\cmd.exe /c ""%TEMP%\RarSFX0\Alcohol120FilmAcc.bat" "
Modifies file system :
Creates the following files:
- %TEMP%\ish226140\images\ProgressBar.gif
- %TEMP%\ish226140\images\loader.gif
- %TEMP%\ish226140\locale\EN.locale
- %TEMP%\ish226140\images\ProgressBar_element.gif
- %TEMP%\ish226140\images\Close_Hover.png
- %TEMP%\ish226140\images\Button.png
- %TEMP%\ish226140\images\BG02.jpg
- %TEMP%\ish226140\images\Close.png
- %TEMP%\ish226140\images\Button_Hover.png
- %TEMP%\ish226140\bootstrap_38866.html
- %HOMEPATH%\Desktop\Continue Alcohol 120 Installation.lnk
- %TEMP%\ICReinstall_Alcohol120_trial_2.0.2.4713.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\newtime[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\in[1].htm
- %TEMP%\0003B47C.log
- %TEMP%\0003B392.log
- %TEMP%\0003B372.log
- %TEMP%\is1988980107\820337024.cfg
- %TEMP%\is1988980107\340613230.cfg
- %TEMP%\ish226140\css\main.css
- %TEMP%\ish226140\css\ie6_main.css
- %TEMP%\ish226140\css\sdk-ui\button.css
- %TEMP%\ish226140\css\sdk-ui\browse.css
- %TEMP%\0003732D.log
- %TEMP%\RarSFX0\Alcohol120FilmAcc.bat
- %TEMP%\RarSFX0\Alcohol120_trial_2.0.2.4713.exe
- %TEMP%\RarSFX0\read.txt
- %TEMP%\RarSFX0\Alcohol120FilmAcc.exe
- %TEMP%\ish226140\css\sdk-ui\checkbox.css
- %TEMP%\ish226140\defaultOffer\images\toolbar.png
- %TEMP%\ish226140\csshover3.htc
- %TEMP%\ish226140\images\BG01.jpg
- %TEMP%\ish226140\form.bmp.Mask
- %TEMP%\ish226140\css\sdk-ui\progress-bar.css
- %TEMP%\ish226140\css\sdk-ui\images\progress-bg-corner.png
- %TEMP%\ish226140\css\sdk-ui\images\button-bg.png
- %TEMP%\ish226140\css\sdk-ui\images\progress-bg2.png
- %TEMP%\ish226140\css\sdk-ui\images\progress-bg.png
Deletes the following files:
- %TEMP%\ish226140\bootstrap_38866.html
- %TEMP%\0003B47C.log
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\newtime[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\in[1].htm
- %TEMP%\0003B392.log
- %TEMP%\RarSFX0\Alcohol120FilmAcc.bat
- %TEMP%\0003732D.log
- %TEMP%\0003B372.log
- %TEMP%\RarSFX0\Alcohol120FilmAcc.exe
Network activity:
Connects to:
- 'www.ku##er.com':80
- 'cd###.##coholsoftcdn.com':80
- 'os#.###oholsoftcdn.com':80
TCP:
HTTP GET requests:
- www.ku##er.com/advnew/newtime.txt?0
- www.ku##er.com/advnew/in.htm?0
- cd###.##coholsoftcdn.com/app/AlcoholSoft/AlcoholSoft120V4.cis
HTTP POST requests:
- os#.###oholsoftcdn.com/AlcoholSoft/?v=###############
UDP:
- DNS ASK www.ku##er.com
- DNS ASK cd###.##coholsoftcdn.com
- DNS ASK os#.###oholsoftcdn.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
