Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
Modifies file system
Creates the following files
- %TEMP%\1_16\fpovhwqah.slo
- %TEMP%\1_16\nwgrthucj.xls
- %TEMP%\1_16\tfkujisk.pdf
- %TEMP%\1_16\wcpuxhqe.dll
- %TEMP%\1_16\bcuxrfffsn.ini
- %TEMP%\1_16\bxvdujq.mp3
- %TEMP%\1_16\autmf.xl
- %TEMP%\1_16\prrthahwo.icm
- %TEMP%\1_16\atbrmej.xl
- %TEMP%\1_16\uiuxlnbaqb.jpg
- %TEMP%\1_16\vijaprpm.dll
- %TEMP%\1_16\vcdhj.xml
- %TEMP%\1_16\xqwiai.xml
- %TEMP%\1_16\kemdgwu.bin
- %TEMP%\1_16\olvjsaco.xl
- %TEMP%\1_16\kgpj.msc
- %TEMP%\1_16\ilfbruxt.pdf
- %TEMP%\1_16\kquiuvisv.txt
- %TEMP%\1_16\hxrqx.ini
- %TEMP%\1_16\hfbvcdeme.xml
- %TEMP%\1_16\xuuppqxco.txt
- %TEMP%\1_16\xmmnxhsd.bmp
- %TEMP%\1_16\jcmxpm.dat
- %TEMP%\1_16\grikuf.exe
- %TEMP%\1_16\wumdphim.vbe
- %TEMP%\1_16\cghhnxk.txt
- %TEMP%\1_16\fpho.dll
- %TEMP%\1_16\qdkkiqf.msc
- %HOMEPATH%\temp\fpho.dll
Sets the 'hidden' attribute to the following files
- %TEMP%\1_16\grikuf.exe
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\1_16\wumdphim.vbe"
- '%TEMP%\1_16\grikuf.exe' cghhnxk.txt
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe'
