Technical Information
Malicious functions:
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1803' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'currentlevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
Modifies file system :
Creates the following files:
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GD28DYPI\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\G10RQXAT\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B1BY4FWX\desktop.ini
- %TEMP%\1.tmp
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B6T0CO33\desktop.ini
Sets the 'hidden' attribute to the following files:
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\G10RQXAT\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B1BY4FWX\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B6T0CO33\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GD28DYPI\desktop.ini
Deletes the following files:
- %TEMP%\1.tmp
Moves itself:
- from <Full path to virus> to %TEMP%\2.tmp
Network activity:
Connects to:
- 'va###-bravo.biz':80
- 're###t-cent.net':80
TCP:
HTTP GET requests:
- re###t-cent.net/f/25
- va###-bravo.biz/d/UJTaXGbQMslDtT9xwHeeWGJK%2boHnfn9rJVfVYiU%2fsAtiXbO0ikgFKrPml9DGwgO5dxM%3d/
- re###t-cent.net/c/W9OJVCjbMchGsWglwWufWTFH5ICyLS0iJlbRMDkztlg2WrCyxEpVNLOpndWNplLgIU9EMgAGMD8frCESaDVpKdhD9%2birab%2bSYa6ruQeiQasg%2bKjIKP9USBpOyAMhvI4UlBIzsxnUfVoej%2fAio9kIY%2fS4CMHKWOr34MGHevtD6eNC%2fRaIPTDl/
- va###-bravo.biz/k/25
UDP:
- DNS ASK va###-bravo.biz
- DNS ASK re###t-cent.net
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: 'cteFkxI cnvF '
- ClassName: '(null)' WindowName: 'zil'
- ClassName: '(null)' WindowName: 'nZaz'
- ClassName: '(null)' WindowName: 'wxIo d aR'
- ClassName: '(null)' WindowName: ' p'
- ClassName: '(null)' WindowName: 'zwJyKZbdnt'
- ClassName: '(null)' WindowName: 'kqodaoE'
- ClassName: '(null)' WindowName: 'fBa JjjEDEwEZa'
- ClassName: '(null)' WindowName: 'EwqlPAf '
- ClassName: '(null)' WindowName: 'mgtweE fsp'
- ClassName: '(null)' WindowName: 'kxw KvLs ugyu'
- ClassName: '(null)' WindowName: 'gi vvE'
- ClassName: '(null)' WindowName: 'gouGkifkSKGynyglxygta'
- ClassName: '(null)' WindowName: 'rv '
- ClassName: '(null)' WindowName: 'irzNisoeq'
- ClassName: '(null)' WindowName: 'Qhudvh ph '
- ClassName: '(null)' WindowName: 's jeHm'
- ClassName: '(null)' WindowName: 'sdb Uc yv y '
- ClassName: '(null)' WindowName: 'eiouO'
- ClassName: '(null)' WindowName: 'Nh A o'
- ClassName: '(null)' WindowName: 'cLsMXrjHxoeg b a'
- ClassName: '(null)' WindowName: ' mrg B'
- ClassName: '(null)' WindowName: ' tZyTo'
- ClassName: '(null)' WindowName: 'Bmukjl'
- ClassName: '(null)' WindowName: 'aVaaq'
- ClassName: '(null)' WindowName: 'kHchDvupnhluQLl'
- ClassName: '(null)' WindowName: 'ZUwZqfhRot '
- ClassName: '(null)' WindowName: 'dykn '
- ClassName: '(null)' WindowName: 'dcjkp '
- ClassName: '(null)' WindowName: 'alUIjzkl'
- ClassName: '(null)' WindowName: 'gA'
- ClassName: '(null)' WindowName: 'gTim Z'
- ClassName: '(null)' WindowName: 'ky raXzNLlwyK '
- ClassName: '(null)' WindowName: ' njvfRLvQx'
- ClassName: '(null)' WindowName: 'BFIkr cpKHlbk tVs'
- ClassName: '(null)' WindowName: 'ij'
- ClassName: '(null)' WindowName: ' FdtN bfhYp'
- ClassName: '(null)' WindowName: 'wnLpcfn'
- ClassName: '(null)' WindowName: 'fgdmEyyet'
- ClassName: '(null)' WindowName: 'XrwhY LI'
- ClassName: '(null)' WindowName: 'Iy L'
- ClassName: '(null)' WindowName: 'bE zFyzPTn'
- ClassName: '(null)' WindowName: 'qAeus HnfkeaM'
- ClassName: '(null)' WindowName: 'annzsjG'
- ClassName: '(null)' WindowName: ' Ts uvq j'
- ClassName: '(null)' WindowName: ' AjzgIdr'
- ClassName: '(null)' WindowName: 'Yglr EDNwp'
- ClassName: '(null)' WindowName: 'akhlq'
- ClassName: '(null)' WindowName: 'Q lNatsKwqk'
- ClassName: '(null)' WindowName: 'tdwebmuqy '
- ClassName: '(null)' WindowName: 'U vehcypjWdRxkMy'
- ClassName: '(null)' WindowName: ' vw cbfsTmk'
- ClassName: '(null)' WindowName: 'hK xeq drawQ s lk '
- ClassName: '(null)' WindowName: 'O vyldkxSYMLz'
- ClassName: '(null)' WindowName: ' xJrF Dnjxt'
- ClassName: '(null)' WindowName: 'fxjtlc n'
- ClassName: '(null)' WindowName: 'FssfdANicdQ'
- ClassName: '(null)' WindowName: 'zOfdCb kGN'
- ClassName: '(null)' WindowName: 'rcB Qj'
- ClassName: '(null)' WindowName: 'yzwrzcLOvx'
- ClassName: '(null)' WindowName: 'iipvZG '
- ClassName: '(null)' WindowName: 'rxLucp o'
- ClassName: '(null)' WindowName: 'wyduxsuw'
- ClassName: '(null)' WindowName: 'rfzZlAUVvOp'
- ClassName: '(null)' WindowName: 'i U a '
- ClassName: '(null)' WindowName: 'SumnspazPbKy'
- ClassName: '(null)' WindowName: 'tktc huwpHZyifmz'
- ClassName: '(null)' WindowName: 'cXkldfZ'
- ClassName: '(null)' WindowName: 'okgLQyayZyKd'
- ClassName: '(null)' WindowName: 'oqq lyrr'
- ClassName: '(null)' WindowName: 'nxq RUrcmrwr'
- ClassName: '(null)' WindowName: 'FINaeapftzE'
- ClassName: '(null)' WindowName: ' cqq'
- ClassName: '(null)' WindowName: 'yPoehvHaqjl ynzL'
- ClassName: '(null)' WindowName: 'jrwsyOkihjCp'
- ClassName: '(null)' WindowName: 'lR g ctj '
- ClassName: '(null)' WindowName: 'SkuiUjSsyNj'
- ClassName: '(null)' WindowName: 'Xu'
- ClassName: '(null)' WindowName: ' bfgfvFnA'
