Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop qmMgr
- '%WINDIR%\syswow64\net.exe' stop qmwatchdog
Modifies file system
Creates the following files
- C:\psmeterbilling\dartweb.dll
- C:\psmeterbilling\util\lang.def
- C:\psmeterbilling\util\libeay32.dll
- C:\psmeterbilling\util\libhttrack.dll
- C:\psmeterbilling\util\mfc90.dll
- C:\psmeterbilling\util\mibferret.exe
- C:\psmeterbilling\util\microsoft.vc90.crt.manifest
- C:\psmeterbilling\util\microsoft.vc90.mfc.manifest
- C:\psmeterbilling\util\msvcr90.dll
- C:\psmeterbilling\util\snmprecorder.exe
- C:\psmeterbilling\util\ssleay32.dll
- C:\psmeterbilling\util\htsswf.dll
- C:\psmeterbilling\util\httrack.exe
- C:\psmeterbilling\util\tpk.exe
- C:\psmeterbilling\dartsnmp2.dll
- C:\psmeterbilling\dartsock.dll
- C:\psmeterbilling\sattool.exe
- C:\psmeterbilling\ipcdb.mdb
- C:\psmeterbilling\_tstool.exe
- C:\psmeterbilling\mpointer.ico
- C:\psmeterbilling\spu.exe
- C:\psmeterbilling\dbupdate.pmb
- C:\psmeterbilling\spu4.exe
- C:\psmeterbilling\preloadlog.txt
- C:\psmeterbilling\util\winhttrackiebar.dll
- C:\psmeterbilling\util\zlib1.dll
- C:\psmeterbilling\util\htsjava.dll
- C:\psmeterbilling\util\dartziplite.dll
- C:\psmeterbilling\util\dartzip.dll
- C:\psmeterbilling\dartziplite.dll
- C:\psmeterbilling\extlvctl.ocx
- C:\psmeterbilling\exttimer.ocx
- C:\psmeterbilling\lgnotok.gif
- C:\psmeterbilling\lgok.gif
- C:\psmeterbilling\mscomct2.ocx
- C:\psmeterbilling\mscomctl.ocx
- C:\psmeterbilling\mswinsck.ocx
- C:\psmeterbilling\preload.exe
- C:\psmeterbilling\printmib3.mdb
- C:\psmeterbilling\qmd_blank.mdb
- C:\psmeterbilling\dartzip.dll
- C:\psmeterbilling\qmgui.exe
- C:\psmeterbilling\qminstaller.exe
- C:\psmeterbilling\qmuninstall.exe
- C:\psmeterbilling\restart.exe
- C:\psmeterbilling\restart_services.bat
- C:\psmeterbilling\rs.exe
- C:\psmeterbilling\smnotok.gif
- C:\psmeterbilling\smok.gif
- C:\psmeterbilling\splash.gif
- C:\psmeterbilling\watchdog.exe
- C:\psmeterbilling\wshom.ocx
- C:\psmeterbilling\xyntservice.exe
- C:\psmeterbilling\qmib.exe
- C:\psmeterbilling\qmsetup.txt
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021030320210304\index.dat
Modifies the following files
Network activity
TCP
HTTP GET requests
- http://www.ps#####billing.co.uk/install/install.css
- http://www.ps#####billing.co.uk/install/images/login.gif
- http://www.ps#####billing.co.uk/install/images/inputbg.gif
UDP
- DNS ASK ps#####billing.co.uk
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'C:\psmeterbilling\preload.exe' -HOST:www.ps#####billing.co.uk -PATH:PSMeterBilling -LOG
- 'C:\psmeterbilling\qminstaller.exe' -HOST:www.ps#####billing.co.uk -PATH:PSMeterBilling -LOG
Executes the following
- '%WINDIR%\syswow64\net1.exe' stop qmMgr
- '%WINDIR%\syswow64\net1.exe' stop qmwatchdog
