Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] 'Generic Host Process for WinXP Services' = 'mshelp.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Generic Host Process for WinXP Services' = 'mshelp.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<SYSTEM32>\mshelp.exe'
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\descript1[2].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\descript1[3].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\descript1[2].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\descript1[2].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\descript1[3].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\descliv[1].txt
- <SYSTEM32>\descliv2.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\descautoliv2[1].txt
- <SYSTEM32>\descautoliv2.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\descript1[2].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\_2sys[1].php
- <SYSTEM32>\mqr.dll
- <SYSTEM32>\mshelp.exe
- <SYSTEM32>\sqla.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\descript1[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\descript1[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\descript1[1].txt
- <SYSTEM32>\descript.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\descript1[1].txt
Deletes the following files:
- <SYSTEM32>\mqr.dll
Network activity:
Connects to:
- 'pr######ze.awardspace.biz':80
- 'www.po###obipo.com':80
- 'to######e.awardspace.biz':80
- 'mo######etoz.awardspace.biz':80
- 'www.re###vnashy.com':80
- 'hs######e.awardspace.biz':80
- '20#.#4.61.206':80
- 'localhost':1035
- 'hu######a.awardspace.biz':80
- 'ro######ka.awardspace.biz':80
- 'www.ho###otorbu.com':80
TCP:
HTTP GET requests:
- www.re###vnashy.com/descript1.txt
- to######e.awardspace.biz/descript1.txt
- pr######ze.awardspace.biz/descript1.txt
- 20#.#4.61.206/~geminica/descliv.txt?PA######################
- 20#.#4.61.206/~geminica/descautoliv2.txt?PA######################
- mo######etoz.awardspace.biz/descript1.txt
- www.po###obipo.com/descript1.txt
- hu######a.awardspace.biz/descript1.txt
- 20#.#4.61.206/~geminica/descript1.txt
- 20#.#4.61.206/~geminica/_2sys.php?PA################
- hs######e.awardspace.biz/descript1.txt
- ro######ka.awardspace.biz/descript1.txt
- www.ho###otorbu.com/descript1.txt
UDP:
- DNS ASK to######e.awardspace.biz
- DNS ASK pr######ze.awardspace.biz
- DNS ASK mo######etoz.awardspace.biz
- DNS ASK www.re###vnashy.com
- DNS ASK www.po###obipo.com
- DNS ASK www.ho###otorbu.com
- DNS ASK hu######a.awardspace.biz
- DNS ASK hs######e.awardspace.biz
- DNS ASK ro######ka.awardspace.biz
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
