Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe "%PROGRAM_FILES%\cdbpr\gybpfgy.exe"'
Malicious functions:
Creates and executes the following:
- "%TEMP%\wps01.exe" (downloaded from the Internet)
- "%TEMP%\PPTV(pplive)_2.5.2.0005_forqd202.exe" (downloaded from the Internet)
- "%PROGRAM_FILES%\cdbpr\gybpfgy.exe" (downloaded from the Internet)
- "%TEMP%\Chaosuq.exe" (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\╘┌╧▀╡ч╙░.url" /p everyone:f
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\├└┼о╩╙╞╡.url" /p everyone:f
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\░╦╪╘╔л═╝.url" /p everyone:f
- <SYSTEM32>\attrib.exe "%HOMEPATH%\Desktop\├└┼о╩╙╞╡.url" +R +S
- <SYSTEM32>\attrib.exe "%HOMEPATH%\Desktop\░╦╪╘╔л═╝.url" +R +S
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\┴ў╨╨╥Ї└╓.url" /p everyone:f
- <SYSTEM32>\cmd.exe /c "%TEMP%\\lnk.bat"
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://tc.#22.cc/
- <SYSTEM32>\svchost.exe -k netsvcs
- <SYSTEM32>\services.exe <Virus name>.exe
- <SYSTEM32>\cmd.exe /c "%TEMP%\\zs.bat"
- <SYSTEM32>\svchost.exe
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.77##h.com/?w
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\up_1[1].asp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\tc.v22[1]
- %TEMP%\PARTN
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\up_2[1].asp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\779dh[1]
- %TEMP%\wps01.exe
- %TEMP%\PPTV(pplive)_2.5.2.0005_forqd202.exe
- %PROGRAM_FILES%\cdbpr\gybpfgy.exe
- %TEMP%\Chaosuq.exe
- %TEMP%\lnk.bat
- <SYSTEM32>\tbhdz.ico
- %TEMP%\zs.bat
- <SYSTEM32>\music.ico
- %APPDATA%\skin.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\getip[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\PARTN[1]
- %APPDATA%\Mozilla\Firefox\Profiles\przhlnon.default\prefs.js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\getip[1]
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\getip[1]
Deletes itself.
Network activity:
Connects to:
- 'tc.#22.cc':80
- 'dl.#22.cc':80
- 'do####ad.youbak.com':80
- 't.##ad.com':80
- 'v.##o63.com':80
- 'www.77##h.com':80
- 'www.33##.org':80
- 'localhost':1038
- 'localhost':1037
- 'localhost':1044
- 'localhost':1043
- 'localhost':1041
TCP:
HTTP GET requests:
- v.##o63.com/a.exe
- www.77##h.com/?w
- dl.#22.cc/Chaosuq.exe
- t.##ad.com/PPTV(pplive)_2.5.2.0005_forqd202.exe
- t.##ad.com/OemWpsSetup69.exe
- do####ad.youbak.com/msn/software/partner/PARTN
- www.33##.org/dyndns/getip
- dl.#22.cc/up_2.asp?a=###########################
- tc.#22.cc/
- dl.#22.cc/up_1.asp?a=###########################
UDP:
- DNS ASK www.77##h.com
- DNS ASK v.##o63.com
- DNS ASK t.##ad.com
- DNS ASK tc.#22.cc
- DNS ASK www.33##.org
- DNS ASK do####ad.youbak.com
- DNS ASK dl.#22.cc
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
