Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] 'vbvsms.exe' = 'C:\Documents and Settings\LocalService\Application Data\vbvsms.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vbvsms.exe' = 'C:\Documents and Settings\LocalService\Application Data\vbvsms.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vbvsms.exe' = '%APPDATA%\vbvsms.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\vbvsms.exe'
Injects code into
the following system processes:
- <SYSTEM32>\cscript.exe
a large number of user processes.
Modifies file system :
Creates the following files:
- %APPDATA%\vbvsms.exe
Deletes the following files:
- %TEMP%\cc9b_appcompat.txt
- %TEMP%\b7a2_appcompat.txt
Network activity:
Connects to:
- '14#.#05.66.222':80
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
