Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'internet explorer' = '%APPDATA%\internet explorer.exe'
Creates or modifies the following files
- %HOMEPATH%\start menu\programs\startup\internet explorer
- %HOMEPATH%\start menu\programs\startup\internet explorer.vbs
- %HOMEPATH%\start menu\programs\startup\internet explorer.lnk
- %HOMEPATH%\start menu\programs\startup\internet explorer.exe
Modifies file system
Creates the following files
- %APPDATA%\internet explorer.exe
- %TEMP%\res16.tmp
- %TEMP%\vbc15.tmp
- %TEMP%\kl1_v-q8.out
- %TEMP%\kl1_v-q8.cmdline
- %TEMP%\kl1_v-q8.0.vb
- %APPDATA%\random\optional\telegram.exe
- %TEMP%\res14.tmp
- %TEMP%\vbc13.tmp
- %TEMP%\u1cbn1ot.out
- %TEMP%\u1cbn1ot.cmdline
- %TEMP%\u1cbn1ot.0.vb
- %APPDATA%\random\optional\qip 2012.exe
- %TEMP%\res12.tmp
- %TEMP%\vbc11.tmp
- %TEMP%\tjiwwjg8.out
- %TEMP%\tjiwwjg8.cmdline
- %TEMP%\tjiwwjg8.0.vb
- %APPDATA%\random\optional\opera.exe
- %TEMP%\res10.tmp
- %APPDATA%\random\optional\windows media player.exe
- %TEMP%\6cnowlr9.cmdline
- %TEMP%\res1e.tmp
- %TEMP%\6cnowlr9.out
- %TEMP%\vbc1d.tmp
- %TEMP%\mviexwig.out
- %TEMP%\mviexwig.cmdline
- %TEMP%\mviexwig.0.vb
- %APPDATA%\random\default\qip 2012.exe
- %TEMP%\res1c.tmp
- %TEMP%\vbc1b.tmp
- %TEMP%\iqv8mdq6.out
- %TEMP%\iqv8mdq6.cmdline
- %TEMP%\iqv8mdq6.0.vb
- %APPDATA%\random\default\pidgin.exe
- %TEMP%\res1a.tmp
- %TEMP%\vbc19.tmp
- %TEMP%\cp-lwvyd.out
- %TEMP%\cp-lwvyd.cmdline
- %TEMP%\cp-lwvyd.0.vb
- %APPDATA%\random\default\icq.exe
- %TEMP%\res18.tmp
- %TEMP%\vbc17.tmp
- %TEMP%\vbcf.tmp
- %TEMP%\6cnowlr9.0.vb
- %TEMP%\lbtmg2kv.out
- %TEMP%\hdfjmpyr.out
- %TEMP%\hdfjmpyr.0.vb
- %APPDATA%\random\optional\icq.exe
- %TEMP%\res6.tmp
- %TEMP%\vbc5.tmp
- %TEMP%\s28dhm-l.out
- %TEMP%\s28dhm-l.cmdline
- %TEMP%\s28dhm-l.0.vb
- %APPDATA%\random\optional\google chrome.exe
- %TEMP%\res4.tmp
- %TEMP%\vbc3.tmp
- %TEMP%\wzsglrqx.out
- %TEMP%\wzsglrqx.cmdline
- %TEMP%\wzsglrqx.0.vb
- %APPDATA%\internet explorer
- %TEMP%\res2.tmp
- %TEMP%\vbc1.tmp
- %TEMP%\jcgubjxa.out
- %TEMP%\jcgubjxa.cmdline
- %TEMP%\jcgubjxa.0.vb
- %TEMP%\hdfjmpyr.cmdline
- %TEMP%\vbc7.tmp
- %TEMP%\lbtmg2kv.0.vb
- %TEMP%\res8.tmp
- %APPDATA%\random\optional\mozilla thunderbird.exe
- %TEMP%\rese.tmp
- %TEMP%\vbcd.tmp
- %TEMP%\zru73ta5.out
- %TEMP%\zru73ta5.cmdline
- %TEMP%\zru73ta5.0.vb
- %APPDATA%\random\optional\mozilla firefox.exe
- %TEMP%\resc.tmp
- %TEMP%\vbcb.tmp
- %TEMP%\9jlspjry.out
- %TEMP%\9jlspjry.cmdline
- %TEMP%\9jlspjry.0.vb
- %APPDATA%\random\optional\microsoft office outlook.exe
- %TEMP%\resa.tmp
- %TEMP%\vbc9.tmp
- %TEMP%\zulgkako.out
- %TEMP%\zulgkako.cmdline
- %TEMP%\zulgkako.0.vb
- %APPDATA%\random\optional\launch internet explorer browser.exe
- %TEMP%\lbtmg2kv.cmdline
- %APPDATA%\random\default\telegram.exe
Deletes the following files
- %TEMP%\res2.tmp
- %TEMP%\kl1_v-q8.out
- %TEMP%\kl1_v-q8.0.vb
- %TEMP%\vbc15.tmp
- %TEMP%\res16.tmp
- %TEMP%\u1cbn1ot.0.vb
- %TEMP%\u1cbn1ot.out
- %TEMP%\u1cbn1ot.cmdline
- %TEMP%\vbc13.tmp
- %TEMP%\res14.tmp
- %TEMP%\tjiwwjg8.cmdline
- %TEMP%\tjiwwjg8.out
- %TEMP%\tjiwwjg8.0.vb
- %TEMP%\vbc11.tmp
- %TEMP%\res12.tmp
- %TEMP%\lbtmg2kv.cmdline
- %TEMP%\kl1_v-q8.cmdline
- %TEMP%\vbc17.tmp
- %TEMP%\mviexwig.0.vb
- %TEMP%\6cnowlr9.out
- %TEMP%\mviexwig.out
- %TEMP%\vbc1d.tmp
- %TEMP%\res1e.tmp
- %TEMP%\iqv8mdq6.0.vb
- %TEMP%\iqv8mdq6.cmdline
- %TEMP%\iqv8mdq6.out
- %TEMP%\vbc1b.tmp
- %TEMP%\res1c.tmp
- %TEMP%\cp-lwvyd.cmdline
- %TEMP%\cp-lwvyd.out
- %TEMP%\cp-lwvyd.0.vb
- %TEMP%\vbc19.tmp
- %TEMP%\res1a.tmp
- %TEMP%\6cnowlr9.cmdline
- %TEMP%\6cnowlr9.0.vb
- %TEMP%\lbtmg2kv.0.vb
- %TEMP%\res18.tmp
- %TEMP%\lbtmg2kv.out
- %TEMP%\hdfjmpyr.out
- %TEMP%\res8.tmp
- %TEMP%\s28dhm-l.0.vb
- %TEMP%\s28dhm-l.cmdline
- %TEMP%\s28dhm-l.out
- %TEMP%\vbc5.tmp
- %TEMP%\res6.tmp
- %TEMP%\wzsglrqx.cmdline
- %TEMP%\wzsglrqx.0.vb
- %TEMP%\wzsglrqx.out
- %TEMP%\vbc3.tmp
- %TEMP%\res4.tmp
- %TEMP%\jcgubjxa.out
- %TEMP%\jcgubjxa.0.vb
- %TEMP%\jcgubjxa.cmdline
- %TEMP%\vbc1.tmp
- %TEMP%\vbc7.tmp
- %TEMP%\hdfjmpyr.0.vb
- %TEMP%\res10.tmp
- %TEMP%\hdfjmpyr.cmdline
- %TEMP%\zru73ta5.0.vb
- %TEMP%\zru73ta5.out
- %TEMP%\zru73ta5.cmdline
- %TEMP%\vbcd.tmp
- %TEMP%\rese.tmp
- %TEMP%\9jlspjry.out
- %TEMP%\9jlspjry.0.vb
- %TEMP%\9jlspjry.cmdline
- %TEMP%\vbcb.tmp
- %TEMP%\resc.tmp
- %TEMP%\zulgkako.out
- %TEMP%\zulgkako.cmdline
- %TEMP%\zulgkako.0.vb
- %TEMP%\vbc9.tmp
- %TEMP%\resa.tmp
- %TEMP%\vbcf.tmp
- %TEMP%\mviexwig.cmdline
Moves the following files
- from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\random\optional\google chrome.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk to %APPDATA%\random\optional\icq.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\random\optional\launch internet explorer browser.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\microsoft office outlook.lnk to %APPDATA%\random\optional\microsoft office outlook.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\mozilla firefox.lnk to %APPDATA%\random\optional\mozilla firefox.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk to %APPDATA%\random\optional\mozilla thunderbird.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\opera.lnk to %APPDATA%\random\optional\opera.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk to %APPDATA%\random\optional\qip 2012.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\telegram.lnk to %APPDATA%\random\optional\telegram.lnk
- from %APPDATA%\microsoft\internet explorer\quick launch\windows media player.lnk to %APPDATA%\random\optional\windows media player.lnk
- from %HOMEPATH%\desktop\icq.lnk to %APPDATA%\random\default\icq.lnk
- from %HOMEPATH%\desktop\pidgin.lnk to %APPDATA%\random\default\pidgin.lnk
- from %HOMEPATH%\desktop\qip 2012.lnk to %APPDATA%\random\default\qip 2012.lnk
- from %HOMEPATH%\desktop\telegram.lnk to %APPDATA%\random\default\telegram.lnk
Substitutes the following files
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ICQ.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\QIP 2012.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Telegram.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
- %HOMEPATH%\Desktop\ICQ.lnk
- %HOMEPATH%\Desktop\Pidgin.lnk
- %HOMEPATH%\Desktop\QIP 2012.lnk
- %HOMEPATH%\Desktop\Telegram.lnk
Network activity
UDP
- DNS ASK mr#####t1335.ddns.net
Miscellaneous
Creates and executes the following
- '%APPDATA%\internet explorer.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1C.tmp" "%TEMP%\vbc1B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iqv8mdq6.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1A.tmp" "%TEMP%\vbc19.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cp-lwvyd.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES18.tmp" "%TEMP%\vbc17.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6cnowlr9.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES16.tmp" "%TEMP%\vbc15.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kl1_v-q8.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES14.tmp" "%TEMP%\vbc13.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\u1cbn1ot.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES12.tmp" "%TEMP%\vbc11.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tjiwwjg8.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10.tmp" "%TEMP%\vbcF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lbtmg2kv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE.tmp" "%TEMP%\vbcD.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zru73ta5.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC.tmp" "%TEMP%\vbcB.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9jlspjry.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA.tmp" "%TEMP%\vbc9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zulgkako.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8.tmp" "%TEMP%\vbc7.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hdfjmpyr.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6.tmp" "%TEMP%\vbc5.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\s28dhm-l.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4.tmp" "%TEMP%\vbc3.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wzsglrqx.cmdline"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn "internet explorer" /tr "%APPDATA%\internet explorer.exe"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\vbc1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jcgubjxa.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mviexwig.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1E.tmp" "%TEMP%\vbc1D.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jcgubjxa.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1C.tmp" "%TEMP%\vbc1B.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iqv8mdq6.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1A.tmp" "%TEMP%\vbc19.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cp-lwvyd.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES18.tmp" "%TEMP%\vbc17.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6cnowlr9.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES16.tmp" "%TEMP%\vbc15.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kl1_v-q8.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES14.tmp" "%TEMP%\vbc13.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\u1cbn1ot.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES12.tmp" "%TEMP%\vbc11.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tjiwwjg8.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10.tmp" "%TEMP%\vbcF.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mviexwig.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lbtmg2kv.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zru73ta5.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC.tmp" "%TEMP%\vbcB.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9jlspjry.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA.tmp" "%TEMP%\vbc9.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zulgkako.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8.tmp" "%TEMP%\vbc7.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hdfjmpyr.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6.tmp" "%TEMP%\vbc5.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\s28dhm-l.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4.tmp" "%TEMP%\vbc3.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wzsglrqx.cmdline"
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 1 /tn "internet explorer" /tr "%APPDATA%\internet explorer.exe"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\vbc1.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE.tmp" "%TEMP%\vbcD.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1E.tmp" "%TEMP%\vbc1D.tmp"
