Technical Information
To ensure autorun and distribution
Modifies master boot record (MBR).
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies settings of Windows Internet Explorer
- [\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1'
Modifies file system
Creates the following files
- %WINDIR%\twain_32\hsl2rb4fo0hfzs4ddxtcvakdpgcfhhdes3gwp08rmdwbtzr3f9.exe
- %PROGRAMDATA%\pdeefzmhrbqorg2u8dspar3ktagvm0nsfptpqakxresslbyqvcdwktotv6ly
- %PROGRAMDATA%\axeamyiba5rdfzgbllhuwrasjpkqzgmucsvay3rrqgpf2hn0bnfcg4m8ecbc
- %PROGRAMDATA%\hxamdcuw5rgfkdihnltfy5f9uayc0fvidxdrylbe4rerppubzst8uayhvzso
- %PROGRAMDATA%\deeauxbhxbagtqg4guyhuavgecvorcmjfmhbcjrzecjvikgzvtnz1hmkx0fi
- %PROGRAMDATA%\ckwwugukkmtbzdheo9hiybnifaadi90endanslt7rzpqchcydthhjl1nxchd
- %PROGRAMDATA%\2tgkrwsocmj2xbelozjyfur1fe3wbu3wxlzxuvgv4xcrmibb0zcflxx5rtlr
- %PROGRAMDATA%\gaw5c0uuexadiru2urcrmxk4h01getbq48aovdbqmldcus20zidvpoarotfk
- %PROGRAMDATA%\cv8krrief74ble25w5ynf6rsim5yjiap0te4cch93v5mror0jf1docwqbih4
- %PROGRAMDATA%\guqwuh0vvilvsaifs6zddgzyliofqfqedfosgdzjamunnckroprunl88jhu4
- %PROGRAMDATA%\uiir5wgyrklix6iibgq0fpdztxd50umqw7ojhogeqqyrtiafmuk4cidlgmgw
- %PROGRAMDATA%\so9qnytzfhommrxyelbzuouisxwlzqhoapmskuwkpu8m3cpndigpouxxsa7r
- %PROGRAMDATA%\irdydzlvpiqctwqkxlkmdjrcmwwewh7rgyqev1hpkdmggb9tubpjknb3npci
- %PROGRAMDATA%\xhwwt6xz2u49cpdwauikj9p4veu4doeum4xafjuhhvcu5t4nqh1xmu6h6xqw
- %PROGRAMDATA%\nnxfbxklg3bbj0wflcrgpiefgfu5ch60ealiwxu3dvgegmgsbvkohgiqzp8u
- %PROGRAMDATA%\sy1lbumu3euv0l3ercifalxrkdvhwflegabsbwibk3hntrivae1sbf0jrkeb
- %PROGRAMDATA%\6pftfayxb4pvton6pd4n00ukofl9a6ac5fwxp5uhmajrgj7dilof5azsaxvk
- %PROGRAMDATA%\oknl4ynwpyi1cyu22jhuwixuvqtnjqjgewkvwkacjgzakwy2dm4gpbymngbm
- nul
- %WINDIR%\twain_32\jjlyrg3nbhbp5lvowbjub3jwfchh7vehwqdlhcpnzdvpeit8qbasdasdasdasda.bat
- C:\gdipfontcachev1.dat
- %WINDIR%\twain_32\jjlyrg3nbhbp5lvowbjub3jwfchh7vehwqdlhcpnzdvpeit8qbaswasdwasdaw.bat
- %PROGRAMDATA%\pz9ikk0j3aoeyoa9erwnnxwu41cywhrxh3mowlsryfts3v6c8hpxbvwctosg
Deletes the following files
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\index.dat
- %WINDIR%\fonts\maian.ttf
- %WINDIR%\fonts\palab.ttf
- %WINDIR%\fonts\pala.ttf
- %WINDIR%\fonts\outlook.ttf
- %WINDIR%\fonts\onyx.ttf
- %WINDIR%\fonts\oldengl.ttf
- %WINDIR%\fonts\ocraext.ttf
- %WINDIR%\fonts\nrkis.ttf
- %WINDIR%\fonts\palabi.ttf
- %WINDIR%\fonts\niagsol.ttf
- %WINDIR%\fonts\mtcorsva.ttf
- %WINDIR%\fonts\msuighur.ttf
- %WINDIR%\fonts\mriamc.ttf
- %WINDIR%\fonts\mriam.ttf
- %WINDIR%\fonts\moolbor.ttf
- %WINDIR%\fonts\mod20.ttf
- %WINDIR%\fonts\mistral.ttf
- %WINDIR%\fonts\maturasc.ttf
- %WINDIR%\fonts\niageng.ttf
- %WINDIR%\fonts\majallab.ttf
- %WINDIR%\fonts\palscri.ttf
- %WINDIR%\fonts\papyrus.ttf
- %WINDIR%\fonts\rockb.ttf
- %WINDIR%\fonts\rock.ttf
- %WINDIR%\fonts\rocc____.ttf
- %WINDIR%\fonts\roccb___.ttf
- %WINDIR%\fonts\refspcl.ttf
- %WINDIR%\fonts\refsan.ttf
- %WINDIR%\fonts\ravie.ttf
- %WINDIR%\fonts\rage.ttf
- %WINDIR%\fonts\playbill.ttf
- %WINDIR%\fonts\pristina.ttf
- %WINDIR%\fonts\poorich.ttf
- %WINDIR%\fonts\per_____.ttf
- %WINDIR%\fonts\pertili.ttf
- %WINDIR%\fonts\pertibd.ttf
- %WINDIR%\fonts\peri____.ttf
- %WINDIR%\fonts\perb____.ttf
- %WINDIR%\fonts\perbi___.ttf
- %WINDIR%\fonts\parchm.ttf
- %WINDIR%\fonts\palai.ttf
- %WINDIR%\fonts\majalla.ttf
- %WINDIR%\fonts\magnetob.ttf
- %WINDIR%\fonts\l_10646.ttf
- %WINDIR%\fonts\itcedscr.ttf
- %WINDIR%\fonts\kokilabi.ttf
- %WINDIR%\fonts\kokilab.ttf
- %WINDIR%\fonts\kokila.ttf
- %WINDIR%\fonts\kaiu.ttf
- %WINDIR%\fonts\juice___.ttf
- %WINDIR%\fonts\jokerman.ttf
- %WINDIR%\fonts\itckrist.ttf
- %WINDIR%\fonts\kokilai.ttf
- %WINDIR%\fonts\kunstler.ttf
- %WINDIR%\fonts\latinwd.ttf
- %WINDIR%\fonts\imprisha.ttf
- %WINDIR%\fonts\impact.ttf
- %WINDIR%\fonts\htowerti.ttf
- %WINDIR%\fonts\htowert.ttf
- %WINDIR%\fonts\hatten.ttf
- %WINDIR%\fonts\harngton.ttf
- %WINDIR%\fonts\harlowsi.ttf
- %WINDIR%\fonts\infroman.ttf
- %WINDIR%\fonts\lbrite.ttf
- %WINDIR%\fonts\lvnm.ttf
- %WINDIR%\fonts\lbritedi.ttf
- %WINDIR%\fonts\lvnmbd.ttf
- %WINDIR%\fonts\lhandw.ttf
- %WINDIR%\fonts\ltypeo.ttf
- %WINDIR%\fonts\ltypebo.ttf
- %WINDIR%\fonts\ltypeb.ttf
- %WINDIR%\fonts\ltype.ttf
- %WINDIR%\fonts\lsansi.ttf
- %WINDIR%\fonts\lsansdi.ttf
- %WINDIR%\fonts\lsansd.ttf
- %WINDIR%\fonts\lsans.ttf
- %WINDIR%\fonts\lfaxi.ttf
- %WINDIR%\fonts\lbrited.ttf
- %WINDIR%\fonts\lfaxdi.ttf
- %WINDIR%\fonts\lfaxd.ttf
- %WINDIR%\fonts\lfax.ttf
- %WINDIR%\fonts\leelawdb.ttf
- %WINDIR%\fonts\leelawad.ttf
- %WINDIR%\fonts\lcallig.ttf
- %WINDIR%\fonts\lbritei.ttf
- %WINDIR%\fonts\goudysto.ttf
- %WINDIR%\fonts\itcblkad.ttf
- %WINDIR%\fonts\rockbi.ttf
- %WINDIR%\fonts\segoescb.ttf
- %WINDIR%\fonts\upcll.ttf
- %WINDIR%\fonts\upcli.ttf
- %WINDIR%\fonts\upclbi.ttf
- %WINDIR%\fonts\upclb.ttf
- %WINDIR%\fonts\upckl.ttf
- %WINDIR%\fonts\upcki.ttf
- %WINDIR%\fonts\upckbi.ttf
- %WINDIR%\fonts\upckb.ttf
- %WINDIR%\fonts\upcfb.ttf
- %WINDIR%\fonts\upcjl.ttf
- %WINDIR%\fonts\upcjbi.ttf
- %WINDIR%\fonts\upcjb.ttf
- %WINDIR%\fonts\upcil.ttf
- %WINDIR%\fonts\upcii.ttf
- %WINDIR%\fonts\upcibi.ttf
- %WINDIR%\fonts\upcib.ttf
- %WINDIR%\fonts\upcfl.ttf
- %WINDIR%\fonts\upcfi.ttf
- %WINDIR%\fonts\upcji.ttf
- %WINDIR%\fonts\upcfbi.ttf
- %WINDIR%\fonts\utsaah.ttf
- %WINDIR%\fonts\vijayab.ttf
- %WINDIR%\fonts\wingding.ttf
- %WINDIR%\fonts\webdings.ttf
- %WINDIR%\fonts\vladimir.ttf
- %PROGRAMDATA%\xhwwt6xz2u49cpdwauikj9p4veu4doeum4xafjuhhvcu5t4nqh1xmu6h6xqw
- %PROGRAMDATA%\sy1lbumu3euv0l3ercifalxrkdvhwflegabsbwibk3hntrivae1sbf0jrkeb
- %WINDIR%\fonts\vivaldii.ttf
- %PROGRAMDATA%\oknl4ynwpyi1cyu22jhuwixuvqtnjqjgewkvwkacjgzakwy2dm4gpbymngbm
- %PROGRAMDATA%\nnxfbxklg3bbj0wflcrgpiefgfu5ch60ealiwxu3dvgegmgsbvkohgiqzp8u
- %WINDIR%\fonts\utsaahbi.ttf
- %WINDIR%\fonts\utsaahb.ttf
- %WINDIR%\fonts\vijaya.ttf
- %WINDIR%\fonts\verdanaz.ttf
- %WINDIR%\fonts\verdanai.ttf
- %WINDIR%\fonts\verdanab.ttf
- %WINDIR%\fonts\verdana.ttf
- %WINDIR%\fonts\vanib.ttf
- %WINDIR%\fonts\vani.ttf
- %WINDIR%\fonts\utsaahi.ttf
- %WINDIR%\fonts\vineritc.ttf
- %WINDIR%\fonts\upcel.ttf
- %WINDIR%\fonts\upcebi.ttf
- %WINDIR%\fonts\fms_metadata.xml
- %WINDIR%\fonts\shonar.ttf
- %WINDIR%\fonts\simpfxo.ttf
- %WINDIR%\fonts\simpbdo.ttf
- %WINDIR%\fonts\simkai.ttf
- %WINDIR%\fonts\simhei.ttf
- %WINDIR%\fonts\simfang.ttf
- %WINDIR%\fonts\showg.ttf
- %WINDIR%\fonts\shonarb.ttf
- %WINDIR%\fonts\stencil.ttf
- %WINDIR%\fonts\snap____.ttf
- %WINDIR%\fonts\staticcache.dat
- %WINDIR%\fonts\segoeprb.ttf
- %WINDIR%\fonts\segoepr.ttf
- %WINDIR%\fonts\scriptbl.ttf
- %WINDIR%\fonts\schlbki.ttf
- %WINDIR%\fonts\schlbkbi.ttf
- %WINDIR%\fonts\schlbkb.ttf
- %WINDIR%\fonts\rod.ttf
- %WINDIR%\fonts\segoesc.ttf
- %WINDIR%\fonts\symbol.ttf
- %WINDIR%\fonts\upceb.ttf
- %WINDIR%\fonts\rockeb.ttf
- %WINDIR%\fonts\simpo.ttf
- %WINDIR%\fonts\upcdl.ttf
- %WINDIR%\fonts\upcdi.ttf
- %WINDIR%\fonts\upcdbi.ttf
- %WINDIR%\fonts\upcdb.ttf
- %WINDIR%\fonts\trebucit.ttf
- %WINDIR%\fonts\trebucbi.ttf
- %WINDIR%\fonts\trebucbd.ttf
- %WINDIR%\fonts\trebuc.ttf
- %WINDIR%\fonts\trado.ttf
- %WINDIR%\fonts\tradbdo.ttf
- %WINDIR%\fonts\tempsitc.ttf
- %WINDIR%\fonts\tcm_____.ttf
- %WINDIR%\fonts\tcmi____.ttf
- %WINDIR%\fonts\tccm____.ttf
- %WINDIR%\fonts\tcceb.ttf
- %WINDIR%\fonts\tccb____.ttf
- %WINDIR%\fonts\tcb_____.ttf
- %WINDIR%\fonts\tcbi____.ttf
- %WINDIR%\fonts\rocki.ttf
- %WINDIR%\fonts\goudosi.ttf
- %WINDIR%\fonts\goudosb.ttf
- %WINDIR%\fonts\goudos.ttf
- %WINDIR%\fonts\brlnsdb.ttf
- %WINDIR%\fonts\browaub.ttf
- %WINDIR%\fonts\browau.ttf
- %WINDIR%\fonts\browai.ttf
- %WINDIR%\fonts\browab.ttf
- %WINDIR%\fonts\browa.ttf
- %WINDIR%\fonts\broadw.ttf
- %WINDIR%\fonts\brlnsr.ttf
- %WINDIR%\fonts\browaz.ttf
- %WINDIR%\fonts\browauz.ttf
- %WINDIR%\fonts\bod_i.ttf
- %WINDIR%\fonts\bradhitc.ttf
- %WINDIR%\fonts\bookosi.ttf
- %WINDIR%\fonts\bookosbi.ttf
- %WINDIR%\fonts\bookosb.ttf
- %WINDIR%\fonts\bookos.ttf
- %WINDIR%\fonts\bod_r.ttf
- %WINDIR%\fonts\bod_pstc.ttf
- %WINDIR%\fonts\britanic.ttf
- %WINDIR%\fonts\brlnsb.ttf
- %WINDIR%\fonts\bssym7.ttf
- %WINDIR%\fonts\bod_cr.ttf
- %WINDIR%\fonts\candarab.ttf
- %WINDIR%\fonts\candara.ttf
- %WINDIR%\fonts\cambriaz.ttf
- %WINDIR%\fonts\cambriai.ttf
- %WINDIR%\fonts\cambriab.ttf
- %WINDIR%\fonts\cambria.ttc
- %WINDIR%\fonts\calisti.ttf
- %WINDIR%\fonts\brushsci.ttf
- %WINDIR%\fonts\candarai.ttf
- %WINDIR%\fonts\calistbi.ttf
- %WINDIR%\fonts\califr.ttf
- %WINDIR%\fonts\califi.ttf
- %WINDIR%\fonts\califb.ttf
- %WINDIR%\fonts\calibriz.ttf
- %WINDIR%\fonts\calibrii.ttf
- %WINDIR%\fonts\calibrib.ttf
- %WINDIR%\fonts\calibri.ttf
- %WINDIR%\fonts\calistb.ttf
- %WINDIR%\fonts\calist.ttf
- %WINDIR%\fonts\bod_ci.ttf
- %WINDIR%\fonts\bod_cbi.ttf
- %WINDIR%\fonts\aparaj.ttf
- %WINDIR%\fonts\antquabi.ttf
- %WINDIR%\fonts\antquab.ttf
- %WINDIR%\fonts\angsaz.ttf
- %WINDIR%\fonts\angsauz.ttf
- %WINDIR%\fonts\angsaui.ttf
- %WINDIR%\fonts\angsaub.ttf
- %WINDIR%\fonts\aparajb.ttf
- %WINDIR%\fonts\angsau.ttf
- %WINDIR%\fonts\angsab.ttf
- %WINDIR%\fonts\angsa.ttf
- %WINDIR%\fonts\andlso.ttf
- %WINDIR%\fonts\alger.ttf
- %WINDIR%\fonts\ahronbd.ttf
- %WINDIR%\fonts\agencyr.ttf
- %WINDIR%\fonts\agencyb.ttf
- %PROGRAMDATA%\6pftfayxb4pvton6pd4n00ukofl9a6ac5fwxp5uhmajrgj7dilof5azsaxvk
- %WINDIR%\fonts\angsai.ttf
- %WINDIR%\fonts\aparajbi.ttf
- %WINDIR%\fonts\aparaji.ttf
- %WINDIR%\fonts\antquai.ttf
- %WINDIR%\fonts\arabtype.ttf
- %WINDIR%\fonts\bod_blar.ttf
- %WINDIR%\fonts\bauhs93.ttf
- %WINDIR%\fonts\bod_blai.ttf
- %WINDIR%\fonts\bod_bi.ttf
- %WINDIR%\fonts\bod_b.ttf
- %WINDIR%\fonts\bkant.ttf
- %WINDIR%\fonts\bernhc.ttf
- %WINDIR%\fonts\belli.ttf
- %WINDIR%\fonts\bellb.ttf
- %WINDIR%\fonts\bell.ttf
- %WINDIR%\fonts\baskvill.ttf
- %WINDIR%\fonts\bod_cb.ttf
- %WINDIR%\fonts\arlrdbd.ttf
- %WINDIR%\fonts\ariblk.ttf
- %WINDIR%\fonts\arialuni.ttf
- %WINDIR%\fonts\arialni.ttf
- %WINDIR%\fonts\arialnbi.ttf
- %WINDIR%\fonts\arialnb.ttf
- %WINDIR%\fonts\arialn.ttf
- %WINDIR%\fonts\candaraz.ttf
- %WINDIR%\fonts\castelar.ttf
- %WINDIR%\fonts\browaui.ttf
- %WINDIR%\fonts\censcbk.ttf
- %WINDIR%\fonts\georgia.ttf
- %WINDIR%\fonts\frank.ttf
- %WINDIR%\fonts\garait.ttf
- %WINDIR%\fonts\garabd.ttf
- %WINDIR%\fonts\gara.ttf
- %WINDIR%\fonts\gabriola.ttf
- %WINDIR%\fonts\ftltlt.ttf
- %WINDIR%\fonts\frscript.ttf
- %WINDIR%\fonts\freescpt.ttf
- %WINDIR%\fonts\georgiaz.ttf
- %WINDIR%\fonts\georgiab.ttf
- %WINDIR%\fonts\georgiai.ttf
- %WINDIR%\fonts\framd.ttf
- %WINDIR%\fonts\frahvit.ttf
- %WINDIR%\fonts\frahv.ttf
- %WINDIR%\fonts\fradmit.ttf
- %WINDIR%\fonts\fradmcn.ttf
- %WINDIR%\fonts\fradm.ttf
- %WINDIR%\fonts\frabkit.ttf
- %WINDIR%\fonts\framdcn.ttf
- %WINDIR%\fonts\gigi.ttf
- %WINDIR%\fonts\gothici.ttf
- %WINDIR%\fonts\frabk.ttf
- %WINDIR%\fonts\centaur.ttf
- %WINDIR%\fonts\gothicbi.ttf
- %WINDIR%\fonts\gothicb.ttf
- %WINDIR%\fonts\gothic.ttf
- %WINDIR%\fonts\glsnecb.ttf
- %WINDIR%\fonts\globaluserinterface.compositefont
- %WINDIR%\fonts\globalserif.compositefont
- %WINDIR%\fonts\globalsansserif.compositefont
- %WINDIR%\fonts\globalmonospace.compositefont
- %WINDIR%\fonts\glecb.ttf
- %WINDIR%\fonts\gishabd.ttf
- %WINDIR%\fonts\gisha.ttf
- %WINDIR%\fonts\gil_____.ttf
- %WINDIR%\fonts\gilsanub.ttf
- %WINDIR%\fonts\gillubcd.ttf
- %WINDIR%\fonts\gili____.ttf
- %WINDIR%\fonts\gilc____.ttf
- %WINDIR%\fonts\gilb____.ttf
- %WINDIR%\fonts\gilbi___.ttf
- %WINDIR%\fonts\framdit.ttf
- %WINDIR%\fonts\upcei.ttf
- %WINDIR%\fonts\wingdng2.ttf
- %WINDIR%\fonts\felixti.ttf
- %WINDIR%\fonts\corbel.ttf
- %WINDIR%\fonts\coprgtl.ttf
- %WINDIR%\fonts\coprgtb.ttf
- %WINDIR%\fonts\coopbl.ttf
- %WINDIR%\fonts\constanz.ttf
- %WINDIR%\fonts\constani.ttf
- %WINDIR%\fonts\constanb.ttf
- %WINDIR%\fonts\corbeli.ttf
- %WINDIR%\fonts\constan.ttf
- %WINDIR%\fonts\consolai.ttf
- %WINDIR%\fonts\consolab.ttf
- %WINDIR%\fonts\consola.ttf
- %WINDIR%\fonts\comicbd.ttf
- %WINDIR%\fonts\comic.ttf
- %WINDIR%\fonts\colonna.ttf
- %WINDIR%\fonts\chiller.ttf
- %WINDIR%\fonts\century.ttf
- %WINDIR%\fonts\consolaz.ttf
- %WINDIR%\fonts\corbelz.ttf
- %WINDIR%\fonts\corbelb.ttf
- %WINDIR%\fonts\cordia.ttf
- %WINDIR%\fonts\erasmd.ttf
- %WINDIR%\fonts\davidbd.ttf
- %WINDIR%\fonts\eraslght.ttf
- %WINDIR%\fonts\erasdemi.ttf
- %WINDIR%\fonts\erasbd.ttf
- %WINDIR%\fonts\engr.ttf
- %WINDIR%\fonts\elephnti.ttf
- %WINDIR%\fonts\elephnt.ttf
- %WINDIR%\fonts\dokchamp.ttf
- %WINDIR%\fonts\desktop.ini
- %WINDIR%\fonts\david.ttf
- %WINDIR%\fonts\cordiab.ttf
- %WINDIR%\fonts\daunpenh.ttf
- %WINDIR%\fonts\curlz___.ttf
- %WINDIR%\fonts\cordiaz.ttf
- %WINDIR%\fonts\cordiauz.ttf
- %WINDIR%\fonts\cordiaui.ttf
- %WINDIR%\fonts\cordiaub.ttf
- %WINDIR%\fonts\cordiau.ttf
- %WINDIR%\fonts\cordiai.ttf
- %WINDIR%\fonts\forte.ttf
- %WINDIR%\fonts\wingdng3.ttf
Deletes itself.
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\werfault.exe' -u -p 2232 -s 1700' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\twain_32\jjlYrg3nBHbp5LVOwbjUb3jWfChh7veHWqdLhCpNzdvpeiT8qBasdasdasdasda.bat""
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 45
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\twain_32\jjlYrg3nBHbp5LVOwbjUb3jWfChh7veHWqdLhCpNzdvpeiT8qBaswasdwasdaw.bat""
- '%WINDIR%\bfsvc.exe'
