Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\spotify.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\intel.vbs
- %APPDATA%\microsoft\windows\start menu\programs\startup\chrome.lnk
Creates the following files on removable media
- <Drive name for removable media>:\%%system\system.exe
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\correct.avi.exe
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dashborder_192.bmp
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Modifies file system
Creates the following files
- %TEMP%\honfueoci.txt
- %TEMP%\vbc2e04ac60326c4abeb2ce8958fcecaf.tmp
- %TEMP%\vbc6ad6630e2640475c801e92eb3124a489.tmp
- %TEMP%\kux353a1.out
- %TEMP%\kux353a1.cmdline
- %TEMP%\kux353a1.0.vb
- %PROGRAMDATA%\%%system\install.ico
- D:\%%system\system.exe
- C:\totalcmd.exe
- %TEMP%\resa054.tmp
- %TEMP%\resb36e.tmp
- %TEMP%\vbc2ff041474f6b40f7988efdf9f3da7a89.tmp
- %TEMP%\avot243g.out
- %TEMP%\avot243g.cmdline
- %TEMP%\avot243g.0.vb
- %TEMP%\ukmpvxdr.out
- %TEMP%\ukmpvxdr.cmdline
- %TEMP%\ukmpvxdr.0.vb
- %APPDATA%\microsoft\windows\templates\svhost.exe
- %TEMP%\bmltq50q.out
- %TEMP%\bmltq50q.cmdline
- %TEMP%\vbc95682f035c53433a8d12f51720247c4.tmp
- %TEMP%\vbc656e91d0d58b42ab86c7799471799a6f.tmp
- %TEMP%\vbc6e457c302b704a4db5c5c087ff38f029.tmp
- %TEMP%\mamym4m2.cmdline
- %TEMP%\vbc49e43e29c2f04cfba674ae74b9cbef4.tmp
- %TEMP%\riyegac0.out
- %TEMP%\riyegac0.cmdline
- %TEMP%\riyegac0.0.vb
- %TEMP%\pm3mwbwl.out
- %TEMP%\pm3mwbwl.cmdline
- %TEMP%\pm3mwbwl.0.vb
- %PROGRAMDATA%\%%system\dial.ico
- %TEMP%\resbc58.tmp
- %TEMP%\bmltq50q.0.vb
- %TEMP%\vbc9104b3677594f529871c4a4ba8630.tmp
- %TEMP%\4lsqwpyw.out
- %TEMP%\4lsqwpyw.cmdline
- %TEMP%\4lsqwpyw.0.vb
- %PROGRAMDATA%\%%system\correct.ico
- D:\$recycle.bin.exe
- %TEMP%\resb7f3.tmp
- %TEMP%\vbc544e1d3ab8084c28a1e3e2ba9b5167ee.tmp
- %TEMP%\vbc85f85d183db84247aa52b49e82f5111d.tmp
- %TEMP%\mamym4m2.out
- D:\install.log.exe
- %TEMP%\mamym4m2.0.vb
- %TEMP%\ahzty45e.out
- C:\far2.exe
- %TEMP%\vbc4c820f1d9c745bf9d95eb98ae72195.tmp
- %TEMP%\b3tqzelf.out
- %TEMP%\b3tqzelf.cmdline
- %TEMP%\b3tqzelf.0.vb
- C:\documents and settings.exe
- %TEMP%\res11b0.tmp
- %TEMP%\vbc2e51a3bd1bd24da884d54e6d5dfbdc95.tmp
- %TEMP%\vbc6f555af4cf64b4b906bf585a491192.tmp
- %TEMP%\fwrsjfyt.out
- %TEMP%\vbc1c477abd367a41a78e1b1774b56b611e.tmp
- %TEMP%\fwrsjfyt.cmdline
- C:\$recycle.bin.exe
- %TEMP%\resd2c.tmp
- %TEMP%\vbc2d06fab9554e499988e6f934b5f28b2.tmp
- %TEMP%\vbc7ac73c62fb7647c3bb759dca7bed19b5.tmp
- %TEMP%\ujtt1kl4.out
- %TEMP%\ujtt1kl4.cmdline
- %TEMP%\ujtt1kl4.0.vb
- %PROGRAMDATA%\%%system\xkiwwiejya.ico
- C:\%%system\system.exe
- %TEMP%\fwrsjfyt.0.vb
- %TEMP%\vbc9f65695e564b4eca8ba6d7b1e3631334.tmp
- %TEMP%\ahzty45e.0.vb
- %TEMP%\aoa45vrl.0.vb
- %ProgramFiles%.exe
- %TEMP%\res22f6.tmp
- %TEMP%\vbc21138e6d40ac4fa3b7787212b3622761.tmp
- %TEMP%\vbc942e6c3cf38647528027587492264be4.tmp
- %TEMP%\m5iprxp3.out
- %TEMP%\m5iprxp3.cmdline
- %TEMP%\m5iprxp3.0.vb
- C:\perflogs.exe
- %TEMP%\res1e24.tmp
- %TEMP%\ahzty45e.cmdline
- %TEMP%\vbca5b1575ef2e9429793b2f9de2363351.tmp
- %TEMP%\ayjoqbuv.out
- %TEMP%\ayjoqbuv.cmdline
- %TEMP%\ayjoqbuv.0.vb
- C:\msocache.exe
- %TEMP%\res1a0d.tmp
- %TEMP%\vbc40e32076383843e981e44b469d6fa6b7.tmp
- %TEMP%\vbcf8581a18ba6a4dea9de854588327dc60.tmp
- %TEMP%\aoa45vrl.out
- %TEMP%\aoa45vrl.cmdline
- %TEMP%\res15e6.tmp
- %TEMP%\resd2fd.tmp
Sets the 'hidden' attribute to the following files
- C:\%%system\system.exe
- D:\%%system\system.exe
- <Drive name for removable media>:\%%system\system.exe
Deletes the following files
- %TEMP%\resd2c.tmp
- %TEMP%\kux353a1.cmdline
- %TEMP%\kux353a1.out
- %TEMP%\vbc6ad6630e2640475c801e92eb3124a489.tmp
- %TEMP%\vbc2e04ac60326c4abeb2ce8958fcecaf.tmp
- %TEMP%\resb36e.tmp
- %TEMP%\avot243g.0.vb
- %TEMP%\avot243g.out
- %TEMP%\avot243g.cmdline
- %TEMP%\vbc95682f035c53433a8d12f51720247c4.tmp
- %TEMP%\vbc2ff041474f6b40f7988efdf9f3da7a89.tmp
- %TEMP%\resa054.tmp
- %TEMP%\ukmpvxdr.cmdline
- %TEMP%\ukmpvxdr.out
- %TEMP%\ukmpvxdr.0.vb
- %TEMP%\bmltq50q.cmdline
- %TEMP%\kux353a1.0.vb
- %TEMP%\resb7f3.tmp
- %TEMP%\vbc544e1d3ab8084c28a1e3e2ba9b5167ee.tmp
- %TEMP%\vbc85f85d183db84247aa52b49e82f5111d.tmp
- %TEMP%\riyegac0.0.vb
- %TEMP%\pm3mwbwl.0.vb
- %TEMP%\pm3mwbwl.cmdline
- %TEMP%\pm3mwbwl.out
- %TEMP%\vbc49e43e29c2f04cfba674ae74b9cbef4.tmp
- %TEMP%\vbc6e457c302b704a4db5c5c087ff38f029.tmp
- %TEMP%\resd2fd.tmp
- %TEMP%\4lsqwpyw.0.vb
- %TEMP%\4lsqwpyw.cmdline
- %TEMP%\4lsqwpyw.out
- %TEMP%\vbc656e91d0d58b42ab86c7799471799a6f.tmp
- %TEMP%\vbc9104b3677594f529871c4a4ba8630.tmp
- %TEMP%\resbc58.tmp
- %TEMP%\mamym4m2.cmdline
- %TEMP%\mamym4m2.0.vb
- %TEMP%\mamym4m2.out
- %TEMP%\riyegac0.cmdline
- %TEMP%\bmltq50q.0.vb
- %TEMP%\ahzty45e.0.vb
- %TEMP%\ahzty45e.out
- %TEMP%\b3tqzelf.cmdline
- %TEMP%\vbc4c820f1d9c745bf9d95eb98ae72195.tmp
- %TEMP%\vbc1c477abd367a41a78e1b1774b56b611e.tmp
- %TEMP%\res15e6.tmp
- %TEMP%\fwrsjfyt.out
- %TEMP%\fwrsjfyt.0.vb
- %TEMP%\fwrsjfyt.cmdline
- %TEMP%\vbc6f555af4cf64b4b906bf585a491192.tmp
- %TEMP%\vbc2e51a3bd1bd24da884d54e6d5dfbdc95.tmp
- %TEMP%\res11b0.tmp
- %TEMP%\ujtt1kl4.0.vb
- %TEMP%\ujtt1kl4.out
- %TEMP%\ujtt1kl4.cmdline
- %TEMP%\vbc7ac73c62fb7647c3bb759dca7bed19b5.tmp
- %TEMP%\vbc2d06fab9554e499988e6f934b5f28b2.tmp
- %TEMP%\b3tqzelf.0.vb
- %TEMP%\b3tqzelf.out
- %TEMP%\res1a0d.tmp
- %TEMP%\vbc40e32076383843e981e44b469d6fa6b7.tmp
- %TEMP%\m5iprxp3.cmdline
- %TEMP%\m5iprxp3.out
- %TEMP%\m5iprxp3.0.vb
- %TEMP%\vbc942e6c3cf38647528027587492264be4.tmp
- %TEMP%\vbc21138e6d40ac4fa3b7787212b3622761.tmp
- %TEMP%\res22f6.tmp
- %TEMP%\ayjoqbuv.0.vb
- %TEMP%\ayjoqbuv.cmdline
- %TEMP%\ayjoqbuv.out
- %TEMP%\vbc9f65695e564b4eca8ba6d7b1e3631334.tmp
- %TEMP%\vbca5b1575ef2e9429793b2f9de2363351.tmp
- %TEMP%\res1e24.tmp
- %TEMP%\aoa45vrl.cmdline
- %TEMP%\aoa45vrl.0.vb
- %TEMP%\aoa45vrl.out
- %TEMP%\vbcf8581a18ba6a4dea9de854588327dc60.tmp
- %TEMP%\ahzty45e.cmdline
- %TEMP%\riyegac0.out
Moves the following files
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk to %APPDATA%\random\google chrome.lnk
Network activity
TCP
- 'ab####hman.ddns.net':2000
UDP
- DNS ASK ab####hman.ddns.net
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\templates\svhost.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD2FD.tmp" "%TEMP%\vbc6E457C302B704A4DB5C5C087FF38F029.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\riyegac0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\pm3mwbwl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBC58.tmp" "%TEMP%\vbc9104B3677594F529871C4A4BA8630.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\4lsqwpyw.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB7F3.tmp" "%TEMP%\vbc544E1D3AB8084C28A1E3E2BA9B5167EE.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\mamym4m2.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB36E.tmp" "%TEMP%\vbc2E04AC60326C4ABEB2CE8958FCECAF.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\kux353a1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA054.tmp" "%TEMP%\vbc2FF041474F6B40F7988EFDF9F3DA7A89.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\avot243g.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ukmpvxdr.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\pu0ptlld.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ujtt1kl4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ahzty45e.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES22F6.tmp" "%TEMP%\vbc21138E6D40AC4FA3B7787212B3622761.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\m5iprxp3.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1E24.tmp" "%TEMP%\vbcA5B1575EF2E9429793B2F9DE2363351.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ayjoqbuv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1A0D.tmp" "%TEMP%\vbc40E32076383843E981E44B469D6FA6B7.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\aoa45vrl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES15E6.tmp" "%TEMP%\vbc1C477ABD367A41A78E1B1774B56B611E.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\b3tqzelf.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES11B0.tmp" "%TEMP%\vbc2E51A3BD1BD24DA884D54E6D5DFBDC95.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\fwrsjfyt.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD2C.tmp" "%TEMP%\vbc2D06FAB9554E499988E6F934B5F28B2.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\bmltq50q.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5AE9.tmp" "%TEMP%\vbcB46AE2682343454E8FED27F64EC5C8EB.TMP"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD2FD.tmp" "%TEMP%\vbc6E457C302B704A4DB5C5C087FF38F029.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\riyegac0.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\pm3mwbwl.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBC58.tmp" "%TEMP%\vbc9104B3677594F529871C4A4BA8630.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\4lsqwpyw.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB7F3.tmp" "%TEMP%\vbc544E1D3AB8084C28A1E3E2BA9B5167EE.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\mamym4m2.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB36E.tmp" "%TEMP%\vbc2E04AC60326C4ABEB2CE8958FCECAF.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\kux353a1.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA054.tmp" "%TEMP%\vbc2FF041474F6B40F7988EFDF9F3DA7A89.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\avot243g.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ukmpvxdr.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\pu0ptlld.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\bmltq50q.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES22F6.tmp" "%TEMP%\vbc21138E6D40AC4FA3B7787212B3622761.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\m5iprxp3.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1E24.tmp" "%TEMP%\vbcA5B1575EF2E9429793B2F9DE2363351.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ayjoqbuv.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1A0D.tmp" "%TEMP%\vbc40E32076383843E981E44B469D6FA6B7.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\aoa45vrl.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES15E6.tmp" "%TEMP%\vbc1C477ABD367A41A78E1B1774B56B611E.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\b3tqzelf.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES11B0.tmp" "%TEMP%\vbc2E51A3BD1BD24DA884D54E6D5DFBDC95.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\fwrsjfyt.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD2C.tmp" "%TEMP%\vbc2D06FAB9554E499988E6F934B5F28B2.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ujtt1kl4.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ahzty45e.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5AE9.tmp" "%TEMP%\vbcB46AE2682343454E8FED27F64EC5C8EB.TMP"
