Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '08f4dc96bbb7af09d1a37fe35c75a42f' = '"%TEMP%\explorer.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '08f4dc96bbb7af09d1a37fe35c75a42f' = '"%TEMP%\explorer.exe" ..'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\08f4dc96bbb7af09d1a37fe35c75a42f.exe
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\explorer.exe' = '%TEMP%\explorer.exe:*:Enabled:explorer.exe'
Creates and executes the following:
- '%TEMP%\explorer.exe'
- '%CommonProgramFiles%\Bitdefender\setupinformation\setupdownloader.exe'
- '%TEMP%\bitdefender-antivirus-plus_2014_fr_35804.exe'
- '%TEMP%\Clean.exe'
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\explorer.exe" "explorer.exe" ENABLE
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Premium.xml
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Panda.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\PC Tools.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\QQ PC Manager.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\ServerProtect.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Shield Deluxe.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Rav.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\RP.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\McAfee.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\MicroPoint.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Kingsoft Safeguard.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Lavasoft.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Microsoft Security Essentials.xml
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Norton.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Mobile.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Norman.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\WSUtils.dll
- %CommonProgramFiles%\Bitdefender\setupinformation\fr-FR\install_config.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\bdnc.ini
- %CommonProgramFiles%\Bitdefender\setupinformation\bdnc.client_id
- %TEMP%\explorer.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\competitive_alt[1].jpg
- %CommonProgramFiles%\Bitdefender\setupinformation\competitive_alt.jpg
- %APPDATA%\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch.new
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\competitive[1].jpg
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\SunBelt.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Trend Micro.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Sophos.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Spybot.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Virus.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\bdmetrics.dll
- %CommonProgramFiles%\Bitdefender\setupinformation\bdnc.dll
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Webroot.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\ZoneAlarm.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Kaspersky.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\ACA.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Ad-Aware.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\detection.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\UninstallLib.dll
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Ahn Lab.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\AVG.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Avira.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\AntiVir.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\avast.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\setuplauncher.exe
- %CommonProgramFiles%\Bitdefender\setupinformation\competitive.jpg
- %TEMP%\bitdefender-antivirus-plus_2014_fr_35804.exe
- %TEMP%\Clean.exe
- %CommonProgramFiles%\Bitdefender\setupinformation\install_config.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\fr-FR\setupdownloader.ui
- %CommonProgramFiles%\Bitdefender\setupinformation\locations.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\setupdownloader.exe
- %CommonProgramFiles%\Bitdefender\setupinformation\htmlayout.dll
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Eastlink.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\ESET.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\COMODO.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\DRWEB.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\eTrust.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Jiagmin.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\K7 AV.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\F-Secure.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\G Data.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Bitdefender Antivirus.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Bitdefender Bussiness Client.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\BackWeb.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Bitdefender 2011.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Bitdefender Gonzales.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\BullGuard.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\cciss.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Bitdefender Internet Security.xml
- %CommonProgramFiles%\Bitdefender\setupinformation\extern\Bitdefender Total Security.xml
Deletes the following files:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2888.296437
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2888.296406
Moves the following files:
- from %APPDATA%\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch.new to %APPDATA%\Microsoft\CLR Security Config\v2.0.50727.42\security.config.cch
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.2888.296437
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.2888.296406
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
Network activity:
Connects to:
- 'localhost':1049
- 'localhost':1047
- 'localhost':1051
- 'do######.bitdefender.com':80
- 'localhost':1054
- 'localhost':1045
- 'localhost':1037
- 'localhost':1035
- 'localhost':1039
- 'localhost':1043
- 'localhost':1041
TCP:
HTTP GET requests:
- do######.bitdefender.com/pdresources/consumer/av_plus/2014/fr-fr/competitive_alt.jpg
- do######.bitdefender.com/pdresources/consumer/av_plus/2014/fr-fr/competitive.jpg
UDP:
- DNS ASK gh####sd.no-ip.biz
- DNS ASK do######.bitdefender.com
- DNS ASK NI####.BitDeFenDer.neT
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
