Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\qtbonpgt.exe'
- '<SYSTEM32>\hccyotsk.exe'
- '<SYSTEM32>\ryfscykc.exe'
- '<SYSTEM32>\zbqybmdw.exe'
- '<SYSTEM32>\wuogwlge.exe'
- '<SYSTEM32>\eftbifvr.exe'
- '<SYSTEM32>\wayfrjtm.exe'
- '<SYSTEM32>\rutqagsw.exe'
- '<SYSTEM32>\ibqazrnb.exe' /pid=2916
- '<SYSTEM32>\pycnocgq.exe'
- '<SYSTEM32>\zpijmlsn.exe'
- '<SYSTEM32>\nlprorka.exe'
- '<SYSTEM32>\snglnboh.exe'
- '<SYSTEM32>\qriklwjp.exe'
- '<SYSTEM32>\pfhuasmb.exe'
- '<SYSTEM32>\ygcjrvwz.exe'
- '<SYSTEM32>\ibqazrnb.exe'
- '<SYSTEM32>\mqikfnra.exe'
- '<SYSTEM32>\gfxnumry.exe'
- '<SYSTEM32>\hnrycupu.exe'
- '<SYSTEM32>\asjjfrzw.exe'
- '<SYSTEM32>\thrjfhtt.exe'
- '<SYSTEM32>\pfkkniqn.exe'
- '<SYSTEM32>\olqmtrmv.exe'
- '<SYSTEM32>\muzxhasd.exe'
- '<SYSTEM32>\ltnhahic.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\eftbifvr.exe
- <SYSTEM32>\qtbonpgt.exe
- <SYSTEM32>\hccyotsk.exe
- <SYSTEM32>\wuogwlge.exe
- <SYSTEM32>\thrjfhtt.exe
- <SYSTEM32>\pfkkniqn.exe
- <SYSTEM32>\zbqybmdw.exe
- <SYSTEM32>\snglnboh.exe
- <SYSTEM32>\rutqagsw.exe
- <SYSTEM32>\pycnocgq.exe
- <SYSTEM32>\nlprorka.exe
- <SYSTEM32>\ryfscykc.exe
- <SYSTEM32>\wayfrjtm.exe
- <SYSTEM32>\zpijmlsn.exe
- <SYSTEM32>\asjjfrzw.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mswinsck[1].ocx
- <SYSTEM32>\mqikfnra.exe
- <SYSTEM32>\gfxnumry.exe
- <SYSTEM32>\ibqazrnb.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mswinsck[1].ocx
- <SYSTEM32>\MSWINSCK.ocx
- <SYSTEM32>\olqmtrmv.exe
- <SYSTEM32>\muzxhasd.exe
- <SYSTEM32>\ltnhahic.exe
- <SYSTEM32>\hnrycupu.exe
- <SYSTEM32>\qriklwjp.exe
- <SYSTEM32>\pfhuasmb.exe
- <SYSTEM32>\ygcjrvwz.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\qtbonpgt.exe
- <SYSTEM32>\hccyotsk.exe
- <SYSTEM32>\ryfscykc.exe
- <SYSTEM32>\zbqybmdw.exe
- <SYSTEM32>\wuogwlge.exe
- <SYSTEM32>\eftbifvr.exe
- <SYSTEM32>\snglnboh.exe
- <SYSTEM32>\rutqagsw.exe
- <SYSTEM32>\pycnocgq.exe
- <SYSTEM32>\wayfrjtm.exe
- <SYSTEM32>\zpijmlsn.exe
- <SYSTEM32>\nlprorka.exe
- <SYSTEM32>\pfkkniqn.exe
- <SYSTEM32>\qriklwjp.exe
- <SYSTEM32>\pfhuasmb.exe
- <SYSTEM32>\ygcjrvwz.exe
- <SYSTEM32>\ibqazrnb.exe
- <SYSTEM32>\mqikfnra.exe
- <SYSTEM32>\gfxnumry.exe
- <SYSTEM32>\ltnhahic.exe
- <SYSTEM32>\asjjfrzw.exe
- <SYSTEM32>\thrjfhtt.exe
- <SYSTEM32>\hnrycupu.exe
- <SYSTEM32>\olqmtrmv.exe
- <SYSTEM32>\muzxhasd.exe
Deletes the following files:
- %TEMP%\~DF16B4.tmp
- %TEMP%\~DFE369.tmp
- %TEMP%\~DF62E7.tmp
- %TEMP%\~DF6A6C.tmp
- %TEMP%\~DFCA2B.tmp
- %TEMP%\~DFB76C.tmp
- %TEMP%\~DF309A.tmp
- %TEMP%\~DFC7AF.tmp
- %TEMP%\~DF8AE2.tmp
- %TEMP%\~DF1461.tmp
- %TEMP%\~DFAFA7.tmp
- %TEMP%\~DF7B47.tmp
- %TEMP%\~DFFC2A.tmp
- %TEMP%\~DF6BA4.tmp
- %TEMP%\~DF2D91.tmp
- %TEMP%\~DFB804.tmp
- %TEMP%\~DF52F9.tmp
- %TEMP%\~DFDD83.tmp
- %TEMP%\~DF9F30.tmp
- %TEMP%\~DF7A19.tmp
- %TEMP%\~DF5164.tmp
- %TEMP%\~DF1DCB.tmp
- %TEMP%\~DF9E7E.tmp
- %TEMP%\~DF46DF.tmp
- %TEMP%\~DF4E4.tmp
- %TEMP%\~DF92AE.tmp
- %TEMP%\~DF1B26.tmp
- %TEMP%\~DF108B.tmp
- %TEMP%\~DF6733.tmp
- %TEMP%\~DF4921.tmp
- %TEMP%\~DFE309.tmp
- %TEMP%\~DFD94A.tmp
- %TEMP%\~DF33E0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mswinsck[1].ocx
- %TEMP%\~DF335C.tmp
- %TEMP%\~DFFD34.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mswinsck[1].ocx
- %TEMP%\~DFE4B5.tmp
- %TEMP%\~DF804D.tmp
- %TEMP%\~DFEFE1.tmp
- %TEMP%\~DF4771.tmp
- %TEMP%\~DF1BE1.tmp
- %TEMP%\~DFCF3A.tmp
- %TEMP%\~DFA385.tmp
- %TEMP%\~DF34E.tmp
- %TEMP%\~DF5221.tmp
- %TEMP%\~DF307A.tmp
- %TEMP%\~DFFAE0.tmp
- %TEMP%\~DFC0C8.tmp
- %TEMP%\~DF68A4.tmp
- %TEMP%\~DFE285.tmp
- %TEMP%\~DF6AD0.tmp
Network activity:
Connects to:
- 'localhost':1068
- 'localhost':1070
- 'localhost':1072
- 'localhost':1062
- 'localhost':1064
- 'localhost':1066
- 'localhost':1074
- 'localhost':1082
- 'localhost':1084
- 'localhost':1086
- 'localhost':1076
- 'localhost':1078
- 'localhost':1080
- 'localhost':1060
- 'localhost':1040
- 'localhost':1042
- 'localhost':1044
- 'localhost':1035
- 'pd###.egloos.com':80
- 'localhost':1038
- 'localhost':1046
- 'localhost':1054
- 'localhost':1056
- 'localhost':1058
- 'localhost':1048
- 'localhost':1050
- 'localhost':1052
TCP:
HTTP GET requests:
- pd###.egloos.com/pds/201304/27/64/mswinsck.ocx
UDP:
- DNS ASK pd###.egloos.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
