Technical Information
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system:
Creates the following files:
- %TEMP%\nsg2.tmp\KillProc.dll
- C:\Acorn\pbdir105.dll
- C:\Acorn\pbcomrt105.dll
- C:\Acorn\pbase105.dll
- C:\Acorn\pbado105.dll
- C:\Acorn\pbacc105.dll
- C:\Acorn\pbXerces105.dll
- C:\Acorn\pbNetWSRuntime105.dll
- C:\Acorn\odbcad32.exe
- C:\Acorn\msvcr71.dll
- C:\Acorn\msvcp71.dll
- C:\Acorn\libjutils.dll
- C:\Acorn\pbdwr105.dll
- C:\Acorn\pbdwe105.dll
- C:\Acorn\atl71.dll
- C:\Acorn\acxtradw.pbd
- C:\Acorn\acxtra.pbd
- C:\Acorn\acvirtual_accnt.pbd
- C:\Acorn\acvendor.pbd
- C:\Acorn\acstore.pbd
- C:\Acorn\acsms.pbd
- C:\Acorn\acsettle.pbd
- C:\Acorn\acsecurity.pbd
- C:\Acorn\acsdx.pbd
- C:\Acorn\acsds.pbd
- C:\Acorn\libjcc.dll
- C:\Acorn\acfranchise.pbd
- C:\Acorn\pbdwr105.pbd
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\svr_oak_version[1].ini
- %TEMP%\nsk4.tmp\inetc.dll
- %TEMP%\nsg2.tmp\SelfDel.dll
- C:\Acorn\uninst.exe
- %HOMEPATH%\Start Menu\Programs\Acorn\Uninstall.lnk
- %HOMEPATH%\Start Menu\Programs\Acorn\Website.lnk
- C:\Acorn\Acorn_flvsn.url
- %HOMEPATH%\Desktop\Acorn_FA3.lnk
- %HOMEPATH%\Start Menu\Programs\Acorn\Acorn_FA3.lnk
- C:\Acorn\Acorn_fa3_updtr.exe
- C:\Acorn\pbvm105.dll
- C:\Acorn\pbtrs105.dll
- C:\Acorn\pbtra105.dll
- C:\Acorn\pbsyj105.dll
- C:\Acorn\pbsyc105.dll
- C:\Acorn\pbshr105.dll
- C:\Acorn\pbrtc105.dll
- C:\Acorn\pbole105.dll
- C:\Acorn\pbodb105.dll
- C:\Acorn\pbo90105.dll
- C:\Acorn\pbo84105.dll
- C:\Acorn\pbo10105.dll
- C:\Acorn\pbjvm105.dll
- C:\Acorn\pbjdb105.dll
- C:\Acorn\pbjag105.dll
- C:\Acorn\acsdp.pbd
- C:\Acorn\gdiplus.dll
- C:\Acorn\acsdd.pbd
- C:\Acorn\acsdcdw.pbd
- C:\Acorn\acsdc.pbd
- C:\Acorn\acbuyingdw.pbd
- C:\Acorn\acdealobj.pbd
- C:\Acorn\acdealdw.pbd
- C:\Acorn\acdealanaobj.pbd
- C:\Acorn\acdealanadw.pbd
- C:\Acorn\acdeal_logis.pbd
- C:\Acorn\acdeal_collect.pbd
- C:\Acorn\accommoditydw.pbd
- C:\Acorn\accommodity.pbd
- C:\Acorn\accode.pbd
- C:\Acorn\accmdt_ctrl.pbd
- C:\Acorn\accargo.pbd
- C:\Acorn\acbuying.pbd
- C:\Acorn\acemplyeedw.pbd
- C:\Acorn\acbboard.pbd
- C:\Acorn\acbasedw.pbd
- C:\Acorn\acbase.pbd
- C:\Acorn\acassets.pbd
- C:\Acorn\acar.pbd
- C:\Acorn\acaccount.pbd
- C:\Acorn\ac_as.pbd
- C:\Acorn\$oaobjects.pbd
- C:\Acorn\$oamethod.pbd
- C:\Acorn\$oainherit.pbd
- C:\Acorn\$oadw2xls.pbd
- %TEMP%\svr_oak_version.ini
- C:\Acorn\pbin9105.dll
- C:\Acorn\acerror.pbd
- C:\Acorn\acinventory.pbd
- C:\Acorn\acemplyee.pbd
- C:\Acorn\acsdapic.pbd
- C:\Acorn\acsda.pbd
- C:\Acorn\acscb.pbd
- C:\Acorn\acsc_cancel.pbd
- C:\Acorn\acsappr.pbd
- C:\Acorn\acsalestamp.pbd
- C:\Acorn\acsalesopdw.pbd
- C:\Acorn\acsalesop.pbd
- C:\Acorn\acsales_order.pbd
- C:\Acorn\acsales01.pbd
- C:\Acorn\acsa.pbd
- C:\Acorn\acpurchasedw.pbd
- C:\Acorn\acpurchase.pbd
- C:\Acorn\acprimecost.pbd
- C:\Acorn\acpipeline.pbd
- C:\Acorn\acorn.pbd
- C:\Acorn\acorn.ini
- C:\Acorn\acorn.exe
- C:\Acorn\acmisdw.pbd
- C:\Acorn\acmis.pbd
- C:\Acorn\acmethod.pbd
- C:\Acorn\acmemberdw.pbd
- C:\Acorn\acmember.pbd
- C:\Acorn\acmem_event.pbd
- C:\Acorn\acgoods.pbd
- %TEMP%\nsk4.tmp\KillProc.dll
Deletes the following files:
- %TEMP%\nsg2.tmp\KillProc.dll
- %TEMP%\nsg2.tmp\SelfDel.dll
- %TEMP%\svr_oak_version.ini
- <Full path to file>
Network activity:
Connects to:
- 'up####.champlus.co.kr':80
- 'fa#.##nasp.co.kr':913
TCP:
HTTP GET requests:
- http://up####.champlus.co.kr/update/svr_oak_version.ini
UDP:
- DNS ASK up####.champlus.co.kr
- DNS ASK fa#.##nasp.co.kr
Miscellaneous:
Searches for the following windows:
- ClassName: '#32770' WindowName: ''
Creates and executes the following:
- 'C:\Acorn\Acorn_fa3_updtr.exe'
- 'C:\Acorn\acorn.exe'
Executes the following:
- '%WINDIR%\explorer.exe'
