Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\conhost.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\conhost.vbs
- %APPDATA%\microsoft\windows\start menu\programs\startup\conhost.js
Creates the following files on removable media
- <Drive name for removable media>:\conhost\conhost.exe
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\correct.avi.exe
- <Drive name for removable media>:\dialmap.bmp
Modifies file system
Creates the following files
- C:\conhost\conhost.exe
- %TEMP%\ugwtoawm.out
- %TEMP%\ugwtoawm.cmdline
- %TEMP%\ugwtoawm.0.vb
- %ALLUSERSPROFILE%\conhost\install.ico
- D:\conhost\conhost.exe
- %APPDATA%\conhost.exe
- C:\program files.exe
- %TEMP%\ewgmgjy4.out
- %TEMP%\ewgmgjy4.0.vb
- C:\recovery.exe
- %TEMP%\resf660.tmp
- %TEMP%\vbcf65f.tmp
- %TEMP%\pnpxxa70.out
- %TEMP%\pnpxxa70.cmdline
- %TEMP%\ewgmgjy4.cmdline
- %TEMP%\pnpxxa70.0.vb
- %TEMP%\vbc7a4d.tmp
- %ALLUSERSPROFILE%\conhost\correct.ico
- %TEMP%\ykmqphne.0.vb
- %ALLUSERSPROFILE%\conhost\dialmap.ico
- %TEMP%\res869d.tmp
- %TEMP%\vbc868d.tmp
- %TEMP%\hzmqpbdj.out
- %TEMP%\hzmqpbdj.cmdline
- D:\install.log.exe
- %TEMP%\res7a5e.tmp
- D:\$recycle.bin.exe
- %TEMP%\res7fda.tmp
- %TEMP%\vbc7fc9.tmp
- %TEMP%\zkitb8i7.out
- %TEMP%\zkitb8i7.cmdline
- %TEMP%\zkitb8i7.0.vb
- %TEMP%\hzmqpbdj.0.vb
- %TEMP%\resf1be.tmp
- %TEMP%\vbcf1ae.tmp
- %TEMP%\opwway2h.out
- C:\documents and settings.exe
- %TEMP%\resdf86.tmp
- %TEMP%\vbcdf75.tmp
- %TEMP%\lpzuiguh.out
- %TEMP%\lpzuiguh.cmdline
- %TEMP%\xbghar1f.cmdline
- %TEMP%\lpzuiguh.0.vb
- %TEMP%\resdaf4.tmp
- %TEMP%\vbcdae3.tmp
- %TEMP%\wfch2n5w.out
- %TEMP%\wfch2n5w.cmdline
- %TEMP%\wfch2n5w.0.vb
- %ALLUSERSPROFILE%\conhost\etvfcunutx.ico
- C:\$recycle.bin.exe
- %TEMP%\xbghar1f.out
- %TEMP%\xbghar1f.0.vb
- %TEMP%\vbce3d9.tmp
- %TEMP%\opwway2h.cmdline
- %TEMP%\-oyuuv34.0.vb
- %TEMP%\opwway2h.0.vb
- C:\perflogs.exe
- %TEMP%\resed4c.tmp
- %TEMP%\vbced3b.tmp
- %TEMP%\-oyuuv34.out
- %TEMP%\-oyuuv34.cmdline
- C:\msocache.exe
- %TEMP%\rese3da.tmp
- %TEMP%\rese8aa.tmp
- %TEMP%\vbce8a9.tmp
- %TEMP%\5og6ibsa.out
- %TEMP%\5og6ibsa.cmdline
- %TEMP%\5og6ibsa.0.vb
- C:\far2.exe
- %TEMP%\ykmqphne.cmdline
- %TEMP%\ykmqphne.out
Sets the 'hidden' attribute to the following files
- C:\conhost\conhost.exe
- D:\conhost\conhost.exe
- <Drive name for removable media>:\conhost\conhost.exe
Deletes the following files
- %TEMP%\resdaf4.tmp
- %TEMP%\opwway2h.0.vb
- %TEMP%\resf660.tmp
- %TEMP%\vbcf65f.tmp
- %TEMP%\pnpxxa70.out
- %TEMP%\pnpxxa70.cmdline
- %TEMP%\pnpxxa70.0.vb
- %TEMP%\ewgmgjy4.cmdline
- %TEMP%\ewgmgjy4.0.vb
- %TEMP%\res7a5e.tmp
- %TEMP%\opwway2h.out
- %TEMP%\opwway2h.cmdline
- %TEMP%\vbc7a4d.tmp
- %TEMP%\ugwtoawm.0.vb
- %TEMP%\res7fda.tmp
- %TEMP%\vbc7fc9.tmp
- %TEMP%\zkitb8i7.out
- %TEMP%\zkitb8i7.0.vb
- %TEMP%\zkitb8i7.cmdline
- %TEMP%\res869d.tmp
- %TEMP%\vbc868d.tmp
- %TEMP%\hzmqpbdj.cmdline
- %TEMP%\ugwtoawm.cmdline
- %TEMP%\ugwtoawm.out
- %TEMP%\vbcf1ae.tmp
- %TEMP%\resf1be.tmp
- %TEMP%\-oyuuv34.cmdline
- %TEMP%\wfch2n5w.out
- %TEMP%\wfch2n5w.cmdline
- %TEMP%\wfch2n5w.0.vb
- %TEMP%\resdf86.tmp
- %TEMP%\vbcdf75.tmp
- %TEMP%\lpzuiguh.0.vb
- %TEMP%\lpzuiguh.out
- %TEMP%\lpzuiguh.cmdline
- %TEMP%\rese3da.tmp
- %TEMP%\vbce3d9.tmp
- %TEMP%\vbcdae3.tmp
- %TEMP%\xbghar1f.0.vb
- %TEMP%\xbghar1f.out
- %TEMP%\rese8aa.tmp
- %TEMP%\vbce8a9.tmp
- %TEMP%\5og6ibsa.0.vb
- %TEMP%\5og6ibsa.cmdline
- %TEMP%\5og6ibsa.out
- %TEMP%\resed4c.tmp
- %TEMP%\vbced3b.tmp
- %TEMP%\-oyuuv34.out
- %TEMP%\-oyuuv34.0.vb
- %TEMP%\xbghar1f.cmdline
- %TEMP%\hzmqpbdj.0.vb
- %TEMP%\hzmqpbdj.out
Network activity
TCP
- 'wi#####n.publicvm.com':333
UDP
- DNS ASK wi#####n.publicvm.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\conhost.exe'
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wfch2n5w.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES869D.tmp" "%TEMP%\vbc868D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hzmqpbdj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7FDA.tmp" "%TEMP%\vbc7FC9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zkitb8i7.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7A5E.tmp" "%TEMP%\vbc7A4D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ugwtoawm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ewgmgjy4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF660.tmp" "%TEMP%\vbcF65F.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pnpxxa70.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF1BE.tmp" "%TEMP%\vbcF1AE.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\opwway2h.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESED4C.tmp" "%TEMP%\vbcED3B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-oyuuv34.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE8AA.tmp" "%TEMP%\vbcE8A9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5og6ibsa.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE3DA.tmp" "%TEMP%\vbcE3D9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xbghar1f.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDF86.tmp" "%TEMP%\vbcDF75.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lpzuiguh.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDAF4.tmp" "%TEMP%\vbcDAE3.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ykmqphne.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\s9h_aeiq.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wfch2n5w.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES869D.tmp" "%TEMP%\vbc868D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hzmqpbdj.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7FDA.tmp" "%TEMP%\vbc7FC9.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\zkitb8i7.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7A5E.tmp" "%TEMP%\vbc7A4D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ugwtoawm.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ewgmgjy4.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF660.tmp" "%TEMP%\vbcF65F.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pnpxxa70.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ykmqphne.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF1BE.tmp" "%TEMP%\vbcF1AE.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESED4C.tmp" "%TEMP%\vbcED3B.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-oyuuv34.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE8AA.tmp" "%TEMP%\vbcE8A9.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5og6ibsa.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE3DA.tmp" "%TEMP%\vbcE3D9.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xbghar1f.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDF86.tmp" "%TEMP%\vbcDF75.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lpzuiguh.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDAF4.tmp" "%TEMP%\vbcDAE3.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\opwway2h.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\s9h_aeiq.cmdline"
