Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%APPDATA%\fdlh\POUW3G~1.EXE %APPDATA%\fdlh\aqmt.mp3'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\righv.shq
- %TEMP%\rarsfx0\rfal.icm
- %TEMP%\rarsfx0\aqmt.mp3
- %TEMP%\rarsfx0\fimw.vbe
- %TEMP%\rarsfx0\pouw.3gp
- %TEMP%\rarsfx0\qfjqfsworf.pdf
- %TEMP%\rarsfx0\fsjiek.jpg
- %TEMP%\rarsfx0\bgpxx.ppt
- %TEMP%\rarsfx0\tpebghshn.icm
- %TEMP%\rarsfx0\chxktpdktc.ppt
- %TEMP%\rarsfx0\unjcj.xl
- %TEMP%\rarsfx0\gfcmklffb.jpg
- %TEMP%\rarsfx0\drkvuelm.xl
- %TEMP%\rarsfx0\crdxrlj.mp2
- %TEMP%\rarsfx0\oxnhuu.mp2
- %TEMP%\rarsfx0\pogukwshni.jpg
- %TEMP%\rarsfx0\lpmuiu.mp3
- %TEMP%\rarsfx0\tmbxlrolsl.xl
- %TEMP%\rarsfx0\cltgnrh.pdf
- %TEMP%\rarsfx0\dfswawwb.mp2
- %TEMP%\rarsfx0\mnlhlmjm.jpg
- %TEMP%\rarsfx0\mnigk.pdf
- %TEMP%\rarsfx0\wmtrplpi.xls
- %TEMP%\rarsfx0\xepc.mp3
- %TEMP%\rarsfx0\gbomd.docx
- %TEMP%\rarsfx0\hhnwbor.dll
- %TEMP%\rarsfx0\vshi.msc
- %TEMP%\rarsfx0\tikesxbftc.xl
- %TEMP%\rarsfx0\hknlmrpm.xl
- %TEMP%\rarsfx0\nkdjk.docx
- %TEMP%\rarsfx0\vmxkfr.mp3
- %HOMEPATH%\temp\rfal.icm
- %TEMP%\rarsfx0\pouw.3gp.exe
- %APPDATA%\fdlh\aqmt.mp3
- %APPDATA%\fdlh\bgpxx.ppt
- %APPDATA%\fdlh\chxktpdktc.ppt
- %APPDATA%\fdlh\cltgnrh.pdf
- %APPDATA%\fdlh\crdxrlj.mp2
- %APPDATA%\fdlh\dfswawwb.mp2
- %APPDATA%\fdlh\drkvuelm.xl
- %APPDATA%\fdlh\fimw.vbe
- %APPDATA%\fdlh\fsjiek.jpg
- %APPDATA%\fdlh\gbomd.docx
- %APPDATA%\fdlh\gfcmklffb.jpg
- %APPDATA%\fdlh\hhnwbor.dll
- %APPDATA%\fdlh\hknlmrpm.xl
- %APPDATA%\fdlh\lpmuiu.mp3
- %APPDATA%\fdlh\mnigk.pdf
- %APPDATA%\fdlh\mnlhlmjm.jpg
- %APPDATA%\fdlh\nkdjk.docx
- %APPDATA%\fdlh\oxnhuu.mp2
- %APPDATA%\fdlh\pogukwshni.jpg
- %APPDATA%\fdlh\pouw.3gp
- %APPDATA%\fdlh\pouw.3gp.exe
- %APPDATA%\fdlh\qfjqfsworf.pdf
- %APPDATA%\fdlh\rfal.icm
- %APPDATA%\fdlh\righv.shq
- %APPDATA%\fdlh\tikesxbftc.xl
- %APPDATA%\fdlh\tmbxlrolsl.xl
- %APPDATA%\fdlh\tpebghshn.icm
- %APPDATA%\fdlh\unjcj.xl
- %APPDATA%\fdlh\vmxkfr.mp3
- %APPDATA%\fdlh\vshi.msc
- %APPDATA%\fdlh\wmtrplpi.xls
- %APPDATA%\fdlh\xepc.mp3
Sets the 'hidden' attribute to the following files
- %APPDATA%\fdlh\aqmt.mp3
- %APPDATA%\fdlh\bgpxx.ppt
- %APPDATA%\fdlh\chxktpdktc.ppt
- %APPDATA%\fdlh\cltgnrh.pdf
- %APPDATA%\fdlh\crdxrlj.mp2
- %APPDATA%\fdlh\dfswawwb.mp2
- %APPDATA%\fdlh\drkvuelm.xl
- %APPDATA%\fdlh\fimw.vbe
- %APPDATA%\fdlh\fsjiek.jpg
- %APPDATA%\fdlh\gbomd.docx
- %APPDATA%\fdlh\gfcmklffb.jpg
- %APPDATA%\fdlh\hhnwbor.dll
- %APPDATA%\fdlh\hknlmrpm.xl
- %APPDATA%\fdlh\lpmuiu.mp3
- %APPDATA%\fdlh\mnigk.pdf
- %APPDATA%\fdlh\mnlhlmjm.jpg
- %APPDATA%\fdlh\nkdjk.docx
- %APPDATA%\fdlh\oxnhuu.mp2
- %APPDATA%\fdlh\pogukwshni.jpg
- %APPDATA%\fdlh\pouw.3gp
- %APPDATA%\fdlh\pouw.3gp.exe
- %APPDATA%\fdlh\qfjqfsworf.pdf
- %APPDATA%\fdlh\rfal.icm
- %APPDATA%\fdlh\righv.shq
- %APPDATA%\fdlh\tikesxbftc.xl
- %APPDATA%\fdlh\tmbxlrolsl.xl
- %APPDATA%\fdlh\tpebghshn.icm
- %APPDATA%\fdlh\unjcj.xl
- %APPDATA%\fdlh\vmxkfr.mp3
- %APPDATA%\fdlh\vshi.msc
- %APPDATA%\fdlh\wmtrplpi.xls
- %APPDATA%\fdlh\xepc.mp3
Deletes following files that it created itself
- %TEMP%\rarsfx0\pouw.3gp
Network activity
UDP
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\RarSFX0\fimw.vbe"
- '%TEMP%\rarsfx0\pouw.3gp' aqmt.mp3
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /release
- '%WINDIR%\syswow64\cmd.exe' /c pouw.3gp aqmt.mp3
- '%WINDIR%\syswow64\ipconfig.exe' /release
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /renew
- '%WINDIR%\syswow64\ipconfig.exe' /renew
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /release' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c pouw.3gp aqmt.mp3' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /renew' (with hidden window)
