Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '0\6_52\ronagjt.exe 0\6_52\dfaecaqw.bem'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '0\7_102\ljhqvm.exe 0\7_102\qdrgduavht.vdo'
Malicious functions
Injects code into
the following user processes:
- regsvcs.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\RimArts\B2\Settings]
- [<HKCU>\SOFTWARE\FTPWare\COREFTP\Sites]
- [<HKLM>\Software\Wow6432Node\ORL\WinVNC3]
- [<HKCU>\Software\ORL\WinVNC3]
- [<HKCU>\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\thunderbird\profiles.ini
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Modifies file system
Creates the following files
- %TEMP%\7_102\gtwmquijl.foe
- %TEMP%\6_52\tqhrff.dll
- %TEMP%\6_52\qjgnctpqe.txt
- %TEMP%\6_52\bkasbnkt.ppt
- %TEMP%\6_52\dcfu.icm
- %TEMP%\6_52\bkbsujvq.cpl
- %TEMP%\6_52\nferexup.txt
- %TEMP%\6_52\jiuqjmiqel.bmp
- %TEMP%\6_52\xhqrj.icm
- %TEMP%\6_52\niafsvmk.log
- %TEMP%\6_52\doxrbn.xml
- %TEMP%\6_52\jeashbg.pdf
- %TEMP%\6_52\jswaplvd.xls
- %TEMP%\6_52\alvbumerif.jpg
- %TEMP%\6_52\suwewnv.xls
- %TEMP%\6_52\fwjscpppc.dat
- %TEMP%\6_52\xwpnh.xml
- %TEMP%\6_52\dtjkvxvlxd.jpg
- %HOMEPATH%\temp\xemjkdmxvi.log
- %APPDATA%\2kh1rdrn.32x\firefox\profiles\gn7ryp3k.default\cookies.sqlite
- %TEMP%\6_52\gtte.cpl
- %APPDATA%\2kh1rdrn.32x\chrome\default\cookies
- %APPDATA%\2kh1rdrn.32x\opera\cookies
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\storage.dat
- %TEMP%\6_52\fulggngkwp.bmp
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\catalog.dat
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\run.dat
- %TEMP%\regsvcs.exe
- %HOMEPATH%\temp\hhvdevjbln.bin
- %TEMP%\6_52\ajkee.xls
- %TEMP%\6_52\lpebcheghf.ini
- %TEMP%\6_52\leax.dat
- %TEMP%\6_52\rakcmggww.txt
- %TEMP%\6_52\vblgi.cpl
- %TEMP%\6_52\pragx.msc
- %TEMP%\6_52\vwlee.ini
- %TEMP%\7_102\ntjqnuoxg.ppt
- %TEMP%\7_102\twwdcxvf.msc
- %TEMP%\7_102\mlau.dll
- %TEMP%\7_102\ovgaeduoq.ppt
- %TEMP%\7_102\cxbxce.mp3
- %TEMP%\7_102\ahjux.msc
- %TEMP%\7_102\crriu.xl
- %TEMP%\7_102\vtdsjdkfwf.cpl
- %TEMP%\7_102\jtaeqmwm.xls
- %TEMP%\7_102\biqidm.xls
- %TEMP%\7_102\xdpjmueu.exe
- %TEMP%\7_102\tprljwgwj.cpl
- %TEMP%\7_102\acdbjx.xl
- %TEMP%\7_102\ljhqvm.exe
- %TEMP%\7_102\bebs.vbe
- %TEMP%\7_102\qdrgduavht.vdo
- %TEMP%\7_102\xemjkdmxvi.log
- %TEMP%\7_102\fptbpuro.ppt
- %TEMP%\7_102\sggbkpc.dll
- %TEMP%\6_52\ronagjt.exe
- %TEMP%\7_102\lqitpbu.xml
- %TEMP%\6_52\dxqohfcd.vbe
- %TEMP%\6_52\dfaecaqw.bem
- %TEMP%\6_52\hhvdevjbln.bin
- %TEMP%\6_52\uxbr.wfu
- %TEMP%\7_102\tin.exe
- %TEMP%\7_102\kdxw.icm
- %TEMP%\7_102\vtupslw.ico
- %TEMP%\6_52\jxuwapo.xls
- %TEMP%\7_102\blgogjt.ini
- %TEMP%\7_102\uhhuu.mp3
- %TEMP%\7_102\dtdbhigu.msc
- %TEMP%\7_102\qvikfwm.log
- %TEMP%\7_102\fmhktm.docx
- %TEMP%\7_102\bccopnpus.bin
- %TEMP%\7_102\gusip.icm
- %TEMP%\7_102\ooup.xml
- %TEMP%\7_102\uqttj.xls
- %APPDATA%\2kh1rdrn.32x\thunderbird\profiles\wjj9aet2.default\cookies.sqlite
Sets the 'hidden' attribute to the following files
- %TEMP%\7_102\ljhqvm.exe
- %TEMP%\6_52\ronagjt.exe
Deletes the following files
- %TEMP%\regsvcs.exe
- %APPDATA%\2kh1rdrn.32x\chrome\default\cookies
- %APPDATA%\2kh1rdrn.32x\firefox\profiles\gn7ryp3k.default\cookies.sqlite
- %APPDATA%\2kh1rdrn.32x\opera\cookies
- %APPDATA%\2kh1rdrn.32x\thunderbird\profiles\wjj9aet2.default\cookies.sqlite
Network activity
Connects to
- 'rz##.sytes.net':8000
- '19#.#78.120.72':80
TCP
HTTP POST requests
- http://19#.#78.120.72/3ip/inc/523ecb38582a9c.php
Other
- 'rz##.sytes.net':8000
UDP
- DNS ASK rz##.sytes.net
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\7_102\tin.exe' Paul E. Patton (born May 26, 1937) is an American politician who served as the 59th governor of Kentucky from 1995 to 2003.
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\7_102\bebs.vbe"
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\6_52\dxqohfcd.vbe"
- '%TEMP%\7_102\ljhqvm.exe' qdrgduavht.vdo
- '%TEMP%\6_52\ronagjt.exe' dfaecaqw.bem
- '%TEMP%\regsvcs.exe'
