Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '<Full path to virus>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'userinit' = '<Full path to virus>'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '<Full path to virus>'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'userinit' = '<SYSTEM32>\userinit.exe,<Full path to virus>,'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'System' = '<Full path to virus>'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\cscript.exe
a large number of user processes.
Modifies file system :
Creates the following files:
- %TEMP%\2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[1].php
- %TEMP%\3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[1].php
- %TEMP%\1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[1].php
Sets the 'hidden' attribute to the following files:
- <Full path to virus>
Deletes the following files:
- %TEMP%\3.tmp
- %TEMP%\2.tmp
- %TEMP%\1.tmp
Network activity:
Connects to:
- 'vo###im.info':80
- 'ly###ij.info':80
- 'www.bing.com':80
- 'xu###ed.info':80
TCP:
HTTP GET requests:
- ly###ij.info/search.php
- vo###im.info/search.php
- xu###ed.info/search.php
UDP:
- DNS ASK vi###uf.info
- DNS ASK ga###aw.info
- DNS ASK je###ij.info
- DNS ASK zu###aj.info
- DNS ASK ma###of.info
- DNS ASK ly###ed.info
- DNS ASK na###at.info
- DNS ASK je###ux.info
- DNS ASK di###us.info
- DNS ASK fo###ez.info
- DNS ASK ry###eq.info
- DNS ASK qe###ul.info
- DNS ASK ha###os.info
- DNS ASK pu###iv.info
- DNS ASK tu###ag.info
- DNS ASK ry###yp.info
- DNS ASK we###uq.info
- DNS ASK qe###iv.info
- DNS ASK tu###el.info
- DNS ASK pu###av.info
- DNS ASK ci###it.info
- DNS ASK no###em.info
- DNS ASK ry###yg.info
- DNS ASK ly###yr.info
- DNS ASK xu###ax.info
- DNS ASK ke###un.info
- DNS ASK bo###yc.info
- DNS ASK vo###uk.info
- DNS ASK qe###ol.info
- DNS ASK xu###on.info
- DNS ASK go###az.info
- DNS ASK do###es.info
- DNS ASK di###yw.info
- DNS ASK vi###yt.info
- DNS ASK bo###ek.info
- DNS ASK je###ud.info
- DNS ASK zu###od.info
- DNS ASK ly###en.info
- DNS ASK xu###ix.info
- DNS ASK pu###ul.info
- DNS ASK si###ub.info
- DNS ASK fo###ah.info
- DNS ASK ha###iw.info
- DNS ASK ga###ob.info
- DNS ASK je###uj.info
- DNS ASK qe###ig.info
- DNS ASK ry###ep.info
- DNS ASK ma###ot.info
- DNS ASK si###iw.info
- DNS ASK na###om.info
- DNS ASK no###ac.info
- DNS ASK do###yh.info
- DNS ASK go###eb.info
- DNS ASK vo###yf.info
- DNS ASK ke###yx.info
- DNS ASK ly###ar.info
- DNS ASK ci###um.info
- DNS ASK pu###ol.info
- DNS ASK we###yv.info
- DNS ASK xu###oj.info
- DNS ASK je###ox.info
- DNS ASK pu###yp.info
- DNS ASK ci###ak.info
- DNS ASK je###an.info
- DNS ASK xu###er.info
- DNS ASK ly###ux.info
- DNS ASK ke###od.info
- DNS ASK qe###eq.info
- DNS ASK ha###ez.info
- DNS ASK go###ys.info
- DNS ASK qe###av.info
- DNS ASK do###ib.info
- DNS ASK ry###ul.info
- DNS ASK pu###eq.info
- DNS ASK we###ip.info
- DNS ASK na###ef.info
- DNS ASK na###yk.info
- DNS ASK zu###yn.info
- DNS ASK qe###ap.info
- DNS ASK ly###ij.info
- DNS ASK www.bing.com
- DNS ASK xu###ed.info
- DNS ASK vo###im.info
- DNS ASK ry###il.info
- DNS ASK bo###it.info
- DNS ASK vi###oc.info
- DNS ASK no###uf.info
- DNS ASK ma###ec.info
- DNS ASK ry###uv.info
- DNS ASK we###og.info
- DNS ASK tu###uq.info
- DNS ASK zu###ex.info
- DNS ASK go###ew.info
- DNS ASK bo###um.info
- DNS ASK ly###ud.info
- DNS ASK ci###of.info
- DNS ASK do###uz.info
- DNS ASK xu###ar.info
- DNS ASK ly###yj.info
- DNS ASK pu###oq.info
- DNS ASK xu###en.info
- DNS ASK fo###yb.info
- DNS ASK ga###es.info
- DNS ASK ke###ir.info
- DNS ASK vo###uc.info
- DNS ASK di###ih.info
- DNS ASK je###or.info
- DNS ASK pu###ap.info
- DNS ASK tu###yv.info
- DNS ASK di###oz.info
- DNS ASK si###oh.info
- DNS ASK ry###ug.info
- DNS ASK no###yt.info
- DNS ASK ma###ak.info
- DNS ASK je###in.info
- DNS ASK ha###ah.info
- DNS ASK si###os.info
- DNS ASK vi###ik.info
- DNS ASK qe###oq.info
- DNS ASK ga###yh.info
- DNS ASK fo###uw.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
