Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\sdukvkoz.exe'
- '<SYSTEM32>\llskuken.exe'
- '<SYSTEM32>\gfeiczja.exe'
- '<SYSTEM32>\xfbufvgh.exe'
- '<SYSTEM32>\rlkuldnl.exe'
- '<SYSTEM32>\vpyuntnc.exe'
- '<SYSTEM32>\jtongdjb.exe'
- '<SYSTEM32>\mnkqtbfl.exe'
- '<SYSTEM32>\erfuyxld.exe'
- '<SYSTEM32>\fhxsfebp.exe'
- '<SYSTEM32>\valhaojq.exe'
- '<SYSTEM32>\tbyrgcjh.exe'
- '<SYSTEM32>\yhkqnspz.exe'
- '<SYSTEM32>\ujwhrqmh.exe'
- '<SYSTEM32>\jtasvqgo.exe'
- '<SYSTEM32>\wsvsxugr.exe'
- '<SYSTEM32>\yzklcmei.exe'
- '<SYSTEM32>\vvyabijp.exe'
- '<SYSTEM32>\pzoxzjbz.exe'
- '<SYSTEM32>\fxbyxfpr.exe'
- '<SYSTEM32>\arkdpcyr.exe'
- '<SYSTEM32>\jksvwnod.exe'
- '<SYSTEM32>\nkgyvbqk.exe'
- '<SYSTEM32>\uoczunjk.exe'
- '<SYSTEM32>\jjhpgavb.exe'
- '<SYSTEM32>\qiyfqipc.exe'
- '<SYSTEM32>\zksblzir.exe'
- '<SYSTEM32>\zaxuljyz.exe'
- '<SYSTEM32>\tyrxagur.exe'
- '<SYSTEM32>\lbtdbacu.exe'
- '<SYSTEM32>\dvppkctu.exe'
- '<SYSTEM32>\cchsukuy.exe'
- '<SYSTEM32>\bcqxrric.exe'
- '<SYSTEM32>\zmasbgxe.exe'
- '<SYSTEM32>\qpxlmwpy.exe'
- '<SYSTEM32>\qmwfhxir.exe'
- '<SYSTEM32>\mzlfnbar.exe'
Modifies file system :
Creates the following files:
- <SYSTEM32>\llskuken.exe
- <SYSTEM32>\rlkuldnl.exe
- <SYSTEM32>\xfbufvgh.exe
- <SYSTEM32>\sdukvkoz.exe
- <SYSTEM32>\mnkqtbfl.exe
- <SYSTEM32>\jtongdjb.exe
- <SYSTEM32>\pzoxzjbz.exe
- <SYSTEM32>\erfuyxld.exe
- <SYSTEM32>\vpyuntnc.exe
- <SYSTEM32>\gfeiczja.exe
- <SYSTEM32>\fhxsfebp.exe
- <SYSTEM32>\valhaojq.exe
- <SYSTEM32>\tbyrgcjh.exe
- <SYSTEM32>\yhkqnspz.exe
- <SYSTEM32>\ujwhrqmh.exe
- <SYSTEM32>\jtasvqgo.exe
- <SYSTEM32>\wsvsxugr.exe
- <SYSTEM32>\yzklcmei.exe
- <SYSTEM32>\vvyabijp.exe
- <SYSTEM32>\arkdpcyr.exe
- <SYSTEM32>\uoczunjk.exe
- <SYSTEM32>\nkgyvbqk.exe
- <SYSTEM32>\fxbyxfpr.exe
- <SYSTEM32>\zksblzir.exe
- <SYSTEM32>\qiyfqipc.exe
- <SYSTEM32>\zaxuljyz.exe
- <SYSTEM32>\jjhpgavb.exe
- <SYSTEM32>\jksvwnod.exe
- <SYSTEM32>\tyrxagur.exe
- <SYSTEM32>\lbtdbacu.exe
- <SYSTEM32>\dvppkctu.exe
- <SYSTEM32>\cchsukuy.exe
- <SYSTEM32>\bcqxrric.exe
- <SYSTEM32>\zmasbgxe.exe
- <SYSTEM32>\qpxlmwpy.exe
- <SYSTEM32>\qmwfhxir.exe
- <SYSTEM32>\mzlfnbar.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\sdukvkoz.exe
- <SYSTEM32>\llskuken.exe
- <SYSTEM32>\gfeiczja.exe
- <SYSTEM32>\xfbufvgh.exe
- <SYSTEM32>\rlkuldnl.exe
- <SYSTEM32>\vpyuntnc.exe
- <SYSTEM32>\jtongdjb.exe
- <SYSTEM32>\mnkqtbfl.exe
- <SYSTEM32>\erfuyxld.exe
- <SYSTEM32>\fhxsfebp.exe
- <SYSTEM32>\valhaojq.exe
- <SYSTEM32>\tbyrgcjh.exe
- <SYSTEM32>\yhkqnspz.exe
- <SYSTEM32>\ujwhrqmh.exe
- <SYSTEM32>\jtasvqgo.exe
- <SYSTEM32>\wsvsxugr.exe
- <SYSTEM32>\yzklcmei.exe
- <SYSTEM32>\vvyabijp.exe
- <SYSTEM32>\pzoxzjbz.exe
- <SYSTEM32>\fxbyxfpr.exe
- <SYSTEM32>\arkdpcyr.exe
- <SYSTEM32>\jksvwnod.exe
- <SYSTEM32>\nkgyvbqk.exe
- <SYSTEM32>\uoczunjk.exe
- <SYSTEM32>\jjhpgavb.exe
- <SYSTEM32>\qiyfqipc.exe
- <SYSTEM32>\zksblzir.exe
- <SYSTEM32>\zaxuljyz.exe
- <SYSTEM32>\tyrxagur.exe
- <SYSTEM32>\lbtdbacu.exe
- <SYSTEM32>\dvppkctu.exe
- <SYSTEM32>\cchsukuy.exe
- <SYSTEM32>\bcqxrric.exe
- <SYSTEM32>\zmasbgxe.exe
- <SYSTEM32>\qpxlmwpy.exe
- <SYSTEM32>\qmwfhxir.exe
- <SYSTEM32>\mzlfnbar.exe
Deletes the following files:
- %TEMP%\~DFD044.tmp
- %TEMP%\~DFFA67.tmp
- %TEMP%\~DF832F.tmp
- %TEMP%\~DFAEDA.tmp
- %TEMP%\~DF59E2.tmp
- %TEMP%\~DFADF4.tmp
- %TEMP%\~DF49F.tmp
- %TEMP%\~DF4538.tmp
- %TEMP%\~DFBD07.tmp
- %TEMP%\~DFD96.tmp
- %TEMP%\~DF4F86.tmp
- %TEMP%\~DFC188.tmp
- %TEMP%\~DF2DE.tmp
- %TEMP%\~DF7503.tmp
- %TEMP%\~DF1C03.tmp
- %TEMP%\~DF31A1.tmp
- %TEMP%\~DFD3F0.tmp
- %TEMP%\~DFC051.tmp
- %TEMP%\~DF2177.tmp
- %TEMP%\~DF135F.tmp
- %TEMP%\~DFBD40.tmp
- %TEMP%\~DFC728.tmp
- %TEMP%\~DF6EC7.tmp
- %TEMP%\~DFC4C7.tmp
- %TEMP%\~DF1FDA.tmp
- %TEMP%\~DF5D8F.tmp
- %TEMP%\~DFD4CF.tmp
- %TEMP%\~DF60B1.tmp
- %TEMP%\~DFB870.tmp
- %TEMP%\~DFF941.tmp
- %TEMP%\~DF53DF.tmp
- %TEMP%\~DFAC26.tmp
- %TEMP%\~DF701F.tmp
- %TEMP%\~DF5FA4.tmp
- %TEMP%\~DF75C.tmp
- %TEMP%\~DF1487.tmp
- %TEMP%\~DF957F.tmp
- %TEMP%\~DFB123.tmp
- %TEMP%\~DFED1E.tmp
- %TEMP%\~DFD37A.tmp
- %TEMP%\~DF70BE.tmp
- %TEMP%\~DF4674.tmp
- %TEMP%\~DFC33D.tmp
- %TEMP%\~DFFBD9.tmp
- %TEMP%\~DF4941.tmp
- %TEMP%\~DF5C82.tmp
- %TEMP%\~DF9371.tmp
- %TEMP%\~DF56B.tmp
- %TEMP%\~DF1382.tmp
- %TEMP%\~DFE26E.tmp
- %TEMP%\~DF6AAC.tmp
- %TEMP%\~DF3EB2.tmp
- %TEMP%\~DF144B.tmp
- %TEMP%\~DF1806.tmp
- %TEMP%\~DFBCCC.tmp
- %TEMP%\~DFA7F3.tmp
- %TEMP%\~DF51D5.tmp
- %TEMP%\~DF40B9.tmp
- %TEMP%\~DF7F1.tmp
- %TEMP%\~DF3D7F.tmp
- %TEMP%\~DFB9EB.tmp
- %TEMP%\~DFF2C4.tmp
- %TEMP%\~DF5298.tmp
- %TEMP%\~DFF8DD.tmp
- %TEMP%\~DF55EA.tmp
- %TEMP%\~DFADF8.tmp
- %TEMP%\~DFD43.tmp
- %TEMP%\~DF43CF.tmp
- %TEMP%\~DFAFD.tmp
- %TEMP%\~DFF5CD.tmp
- %TEMP%\~DFC010.tmp
- %TEMP%\~DFAAFF.tmp
Network activity:
Connects to:
- 'bl##.naver.com':80
TCP:
HTTP GET requests:
- bl##.naver.com/PostView.nhn?bl################################################################################################################################################################################################
UDP:
- DNS ASK bl##.naver.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
