Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\archer.avi
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe
Modifies file system
Creates the following files
- %TEMP%\nwfrtnhui.txt
- %TEMP%\3dcu0pal.0.vb
- C:\documents and settings.exe
- %WINDIR%\syswow64\win32nt.exe
- %TEMP%\res89ed.tmp
- %TEMP%\vbc453ae71f4924449b789469a9b4bfd1.tmp
- %TEMP%\vbc4a34d05dc27e490b8f3978f75d7ef329.tmp
- %TEMP%\qivlxa5i.out
- %TEMP%\qivlxa5i.cmdline
- %TEMP%\3dcu0pal.cmdline
- %TEMP%\qivlxa5i.0.vb
- %TEMP%\res8308.tmp
- %TEMP%\vbc48f92445885b4fb380fb7a31cc993bde.tmp
- %TEMP%\vbc2f647383412346cfa0396417e7fd1925.tmp
- %TEMP%\1iwb3mki.out
- %TEMP%\1iwb3mki.cmdline
- %TEMP%\1iwb3mki.0.vb
- %PROGRAMDATA%\system\dowruug.ico
- C:\system\win32nt.exe
- C:\$recycle.bin.exe
- %TEMP%\3dcu0pal.out
Sets the 'hidden' attribute to the following files
- C:\system\win32nt.exe
Deletes the following files
- %TEMP%\res8308.tmp
- %TEMP%\vbc48f92445885b4fb380fb7a31cc993bde.tmp
- %TEMP%\vbc2f647383412346cfa0396417e7fd1925.tmp
- %TEMP%\1iwb3mki.cmdline
- %TEMP%\1iwb3mki.0.vb
- %TEMP%\1iwb3mki.out
- %TEMP%\res89ed.tmp
- %TEMP%\vbc453ae71f4924449b789469a9b4bfd1.tmp
- %TEMP%\vbc4a34d05dc27e490b8f3978f75d7ef329.tmp
- %TEMP%\qivlxa5i.out
- %TEMP%\qivlxa5i.0.vb
- %TEMP%\qivlxa5i.cmdline
- %TEMP%\3dcu0pal.cmdline
- %TEMP%\3dcu0pal.0.vb
Network activity
UDP
- DNS ASK hc#.#yddns.me
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\win32nt.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\1iwb3mki.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\k5hx23tz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES402E.tmp" "%TEMP%\vbcCA084A8C4D647D88E807809BEF4D1D.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\rlbfqwx0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3A90.tmp" "%TEMP%\vbc4CD0211C27DA43FA83B05B9FE981D957.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\dmnmyx2q.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES384E.tmp" "%TEMP%\vbcB65932F5396D4744B3A6DC2D4EEABC6.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\iztm32es.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES363B.tmp" "%TEMP%\vbcD1B44E3540594172BAD25219FFC14411.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\lzrpgtwz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES337C.tmp" "%TEMP%\vbc13AA5E4C402413E99E2C87AEB84F58.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\p4uomgd2.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES30CC.tmp" "%TEMP%\vbc5C526AD1F7444106B318152122AC137F.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\hkiv1dkd.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2DEE.tmp" "%TEMP%\vbcA2C62C90D16C475F9D82629964E7C6CB.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\rmh24pz5.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\3dcu0pal.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES89ED.tmp" "%TEMP%\vbc453AE71F4924449B789469A9B4BFD1.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\qivlxa5i.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8308.tmp" "%TEMP%\vbc48F92445885B4FB380FB7A31CC993BDE.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES43E7.tmp" "%TEMP%\vbc6CCA5448D0D943C3AD16E1E1E33B32.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\5bwg44zs.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\k5hx23tz.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES402E.tmp" "%TEMP%\vbcCA084A8C4D647D88E807809BEF4D1D.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\rlbfqwx0.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3A90.tmp" "%TEMP%\vbc4CD0211C27DA43FA83B05B9FE981D957.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\dmnmyx2q.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES384E.tmp" "%TEMP%\vbcB65932F5396D4744B3A6DC2D4EEABC6.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\iztm32es.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES363B.tmp" "%TEMP%\vbcD1B44E3540594172BAD25219FFC14411.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\lzrpgtwz.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES43E7.tmp" "%TEMP%\vbc6CCA5448D0D943C3AD16E1E1E33B32.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES337C.tmp" "%TEMP%\vbc13AA5E4C402413E99E2C87AEB84F58.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES30CC.tmp" "%TEMP%\vbc5C526AD1F7444106B318152122AC137F.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\hkiv1dkd.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2DEE.tmp" "%TEMP%\vbcA2C62C90D16C475F9D82629964E7C6CB.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\rmh24pz5.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\3dcu0pal.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES89ED.tmp" "%TEMP%\vbc453AE71F4924449B789469A9B4BFD1.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\qivlxa5i.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8308.tmp" "%TEMP%\vbc48F92445885B4FB380FB7A31CC993BDE.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\1iwb3mki.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\p4uomgd2.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\5bwg44zs.cmdline"
