Win32.HLLW.Autoruner.56611

Technical Information

To ensure autorun and distribution:

Creates the following files on removable media:

<Drive name for removable media>:\AutoRun.inf
<Drive name for removable media>:\USBWorm.exe

Malicious functions:

Creates and executes the following:

<SYSTEM32>\USBWorm.exe

Executes the following:

<SYSTEM32>\cmd.exe /c c:\KILLER.BAT
<SYSTEM32>\format.com D: /q /x /y
<SYSTEM32>\format.com Z: /q /x /y
<SYSTEM32>\cmd.exe /c bat.bat
%WINDIR%\explorer.exe C:\
<SYSTEM32>\reg.exe import key.reg

Modifies file system :

Creates the following files:

<Current directory>\YXVDTJ.GWE
<Current directory>\ZALDNX.RBL
<Current directory>\NOQAKU.OHR
<Current directory>\VXYISL.FPZ
<Current directory>\WXZJTL.FPZ
<Current directory>\FECKAQ.WDT
<Current directory>\NLKAHX.DLB
<Current directory>\ZXWMTJ.PXN
<Current directory>\KMNXHR.LVO
<Current directory>\UWXHRK.EOG
<Current directory>\PRKUEO.ISC
<Current directory>\OQRBLV.YIS
<Current directory>\QONUKA.GOE
<Current directory>\GISLVF.ZJT
<Current directory>\UVXHRB.DNX
<Current directory>\JLEOYI.CMW
<Current directory>\EDBJZP.VCS
<Current directory>\ZBCMWG.ATD
<Current directory>\HJKUEO.ISL
<Current directory>\KMNXHR.LVF
<Current directory>\LNGQAK.NXH
<Current directory>\ECBRYO.UCS
<Current directory>\UVXHRB.VNX
<Current directory>\LNOYIB.VFP
<Current directory>\ACMWPZ.TDN
<Current directory>\UVXHRJ.DNX
<Current directory>\JCMWGQ.TDN
<Current directory>\MTJZGW.CKA
<Current directory>\DFGQJT.NXH
<Current directory>\HFEUBR.XFV
<Current directory>\RTMWGY.SCV
<Current directory>\WUKAQY.EUK
<Current directory>\YAKUNX.RBL
<Current directory>\RTUEOY.SCM
<Current directory>\UNOHRB.VFP
<Current directory>\QONUKA.YOE
<Current directory>\AYXEUK.IYO
<Current directory>\KJHPFV.SIY
<Current directory>\XEUKAH.NDL
<Current directory>\IHFVDT.ZGW
<Current directory>\MTJZPW.CSA
<Current directory>\EFHRBL.FPH
<Current directory>\OPISCM.GQA
<Current directory>\GHJTLV.PZJ
<Current directory>\RKMEOY.SCM
<Current directory>\VXYISC.WGQ
<Current directory>\JLMWGQ.TDN
<Current directory>\DFGQAL.NXH
C:\KILLER.BAT
C:\USBWorm.exe
<Current directory>\ZXWDTB.HXN
<Current directory>\SUVFPZ.TMW
<Current directory>\RXNVLB.YGW
<Current directory>\KLEOYI.CMW
<Current directory>\DCAIYO.LBR
<Current directory>\XWUCSI.OVL
<Current directory>\VWYISC.EOY
<Current directory>\key.reg
<Current directory>\bat.bat
<SYSTEM32>\USBWorm.exe
<Current directory>\ACVFPZ.CMW
<Current directory>\WYRBLV.PZR
<Current directory>\RYOEUB.HXF
<Current directory>\DKAQXN.TBR
C:\AutoRun.inf
<Current directory>\IYWMUK.HXF
<Current directory>\OMLSIY.WMC
<Current directory>\TVWGQA.DNX
<Auxiliary element>
<Current directory>\ZBLVOY.SCM
<Current directory>\VTSIPF.LTJ
<Current directory>\LKIQGW.TJZ
<Current directory>\MSIQGW.CJZ
<Current directory>\JIGOEU.AHX
<Current directory>\NUKRHX.VLB
<Current directory>\GEUKAI.OEU
<Current directory>\QSTDNX.RBU
<Current directory>\CEFPZJ.MWG
<Current directory>\XQSKUE.YIS
<Current directory>\HIKUEO.QAL
<Current directory>\NPZJCM.GQA
<Current directory>\QPFVLB.YOE
<Current directory>\DJZPXN.TAQ
<Current directory>\GNDTAQ.WEU
<Current directory>\EGHRBL.OYI
<Current directory>\HNDLBR.OEU

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\USBWorm.exe
<Drive name for removable media>:\AutoRun.inf
C:\AutoRun.inf
<SYSTEM32>\USBWorm.exe
C:\USBWorm.exe

Deletes the following files:

<Current directory>\key.reg

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: ''

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information