Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}] 'StubPath' = '<SYSTEM32>\shell.bat'
Creates the following files on removable media
- <Drive name for removable media>:\autorun.inf
Modifies file system
Creates the following files
- %WINDIR%\syswow64\kurdistan.ini
- %WINDIR%\syswow64\kurd.bat
- %WINDIR%\syswow64\kurd2.bat
- %WINDIR%\syswow64\winkurd.bmp
- <Current directory>\virus.bat
- %WINDIR%\syswow64\shell.bat
- %WINDIR%\syswow64\sulaemane.dll
- %WINDIR%\syswow64\k.vbe
- C:\autorun.inf
- D:\autorun.inf
Sets the 'hidden' attribute to the following files
- <Current directory>\virus.bat
- %WINDIR%\syswow64\k.vbe
- %WINDIR%\syswow64\kurd2.bat
- %WINDIR%\syswow64\shell.bat
- C:\autorun.inf
- D:\autorun.inf
- <Drive name for removable media>:\autorun.inf
- %WINDIR%\syswow64\kurd.bat
Deletes the following files
- C:\autorun.inf
- D:\autorun.inf
- <Drive name for removable media>:\autorun.inf
Substitutes the following files
- C:\autorun.inf
- D:\autorun.inf
- <Drive name for removable media>:\autorun.inf
Network activity
TCP
HTTP GET requests
- http://ka####.webng.com/winkurd.bmp
- http://fr###sphost.net/winkurd.bmp
UDP
- DNS ASK ka####.webng.com
- DNS ASK fr###sphost.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\kurdistan.ini'
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\SysWOW64\kurd2.BAT' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c VIRUS.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\SysWOW64\kurd.BAT' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\SysWOW64\kurd2.BAT
- '%WINDIR%\syswow64\attrib.exe' <SYSTEM32>\winlogons.exe +s +h
- '%WINDIR%\syswow64\attrib.exe' h:\AutoRun.inf +s +h
- '%WINDIR%\syswow64\attrib.exe' k:\AutoRun.inf +s +h
- '%WINDIR%\syswow64\attrib.exe' j:\AutoRun.inf +s +h
- '%WINDIR%\syswow64\attrib.exe' i:\AutoRun.inf +s +h
- '%WINDIR%\syswow64\attrib.exe' g:\AutoRun.inf +s +h
- '%WINDIR%\syswow64\attrib.exe' <Drive name for removable media>:\AutoRun.inf +s +h
- '%WINDIR%\syswow64\attrib.exe' e:\AutoRun.inf +s +h
- '%WINDIR%\syswow64\attrib.exe' d:\AutoRun.inf +s +h
- '%WINDIR%\syswow64\attrib.exe' c:\AutoRun.inf +s +h
- '%WINDIR%\syswow64\attrib.exe' h:\kurd.exe +s +h
- '%WINDIR%\syswow64\attrib.exe' k:\kurd.exe +s +h
- '%WINDIR%\syswow64\attrib.exe' <SYSTEM32>\KURD.BAT +s +h
- '%WINDIR%\syswow64\attrib.exe' j:\kurd.exe +s +h
- '%WINDIR%\syswow64\attrib.exe' g:\kurd.exe +s +h
- '%WINDIR%\syswow64\attrib.exe' <Drive name for removable media>:\kurd.exe +s +h
- '%WINDIR%\syswow64\attrib.exe' e:\kurd.exe +s +h
- '%WINDIR%\syswow64\attrib.exe' kurd.exe +s +h
- '%WINDIR%\syswow64\attrib.exe' d:\kurd.exe +s +h
- '%WINDIR%\syswow64\attrib.exe' c:\kurd.exe +s +h
- '%WINDIR%\syswow64\attrib.exe' <SYSTEM32>\shell.BAT +s +h
- '%WINDIR%\syswow64\attrib.exe' <SYSTEM32>\kurd2.BAT +s +h
- '%WINDIR%\syswow64\attrib.exe' <SYSTEM32>\k.vbe +s +h
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\SysWOW64\kurd.BAT
- '%WINDIR%\syswow64\attrib.exe' kurd.exe -s -h
- '%WINDIR%\syswow64\cmd.exe' /c VIRUS.bat
- '%WINDIR%\syswow64\attrib.exe' i:\kurd.exe +s +h
- '%WINDIR%\syswow64\wscript.exe' "<SYSTEM32>\k.vbe"
