Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\photos\picture.exe
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\archer.avi
Modifies file system
Creates the following files
- C:\photos\picture.exe
- %TEMP%\resaaa.tmp
- %TEMP%\vbce77384d1804f4087a2bd48c5c92023b7.tmp
- %TEMP%\vbce03efaf0dcaf4b5a81a14e22a267f8e.tmp
- %TEMP%\1lvzohjt\1lvzohjt.out
- %TEMP%\1lvzohjt\1lvzohjt.cmdline
- %TEMP%\1lvzohjt\1lvzohjt.0.vb
- C:\recovery.exe
- C:\program files.exe
- %TEMP%\vbc680238d19f144959927b33d845831c6.tmp
- %TEMP%\vbc54aea4f022724fae88b3c1df7b4abead.tmp
- %TEMP%\c5wqllzz\c5wqllzz.out
- %TEMP%\c5wqllzz\c5wqllzz.cmdline
- %TEMP%\c5wqllzz\c5wqllzz.0.vb
- C:\perflogs.exe
- %TEMP%\res3a8.tmp
- %TEMP%\ofd2xe3q\ofd2xe3q.cmdline
- %TEMP%\xp1aqvcm\xp1aqvcm.cmdline
- %TEMP%\0hnyc2b1\0hnyc2b1.out
- %TEMP%\xp1aqvcm\xp1aqvcm.0.vb
- %ALLUSERSPROFILE%\photos\join.ico
- D:\$recycle.bin.exe
- %TEMP%\res8c76.tmp
- %TEMP%\vbc984a7ae2d3f24652b1918d4edbccb8b.tmp
- %TEMP%\vbc410c56a1f00e40cfad59c4fa65323cec.tmp
- %APPDATA%\svchost.exe
- %TEMP%\ofd2xe3q\ofd2xe3q.out
- %TEMP%\ofd2xe3q\ofd2xe3q.0.vb
- D:\photos\picture.exe
- C:\totalcmd.exe
- %TEMP%\res114e.tmp
- %TEMP%\vbcc6e32b9e521b498bbc44b6c048aac7b.tmp
- %TEMP%\vbc6c3da931a66e444abf2fca44d61ad250.tmp
- %TEMP%\0hnyc2b1\0hnyc2b1.0.vb
- %TEMP%\0hnyc2b1\0hnyc2b1.cmdline
- %TEMP%\resfab3.tmp
- %TEMP%\asoilnyt\asoilnyt.cmdline
- %TEMP%\rese4b3.tmp
- %TEMP%\vbcadf0a751493449119e3bf61d82f3c49.tmp
- %TEMP%\vbc671ac66155cf4d81a8e171bb7053fc86.tmp
- %TEMP%\tdpirybw\tdpirybw.out
- %TEMP%\tdpirybw\tdpirybw.cmdline
- %TEMP%\tdpirybw\tdpirybw.0.vb
- C:\documents and settings.exe
- C:\$recycle.bin.exe
- %TEMP%\vbc90da5ffef215496e8ef5bb1dd22fd7a0.tmp
- %TEMP%\vbc173575af44346f7909b9e658510ed57.tmp
- %TEMP%\h3yowonv\h3yowonv.out
- %TEMP%\h3yowonv\h3yowonv.cmdline
- %TEMP%\h3yowonv\h3yowonv.0.vb
- %ALLUSERSPROFILE%\photos\dvzwfrtn.ico
- %TEMP%\resdd63.tmp
- %TEMP%\0vcratll\0vcratll.out
- %TEMP%\vbcefce64e495f245dd85cfde0eca9331.tmp
- %TEMP%\asoilnyt\asoilnyt.out
- %TEMP%\oirbou0u\oirbou0u.out
- %TEMP%\oirbou0u\oirbou0u.cmdline
- %TEMP%\oirbou0u\oirbou0u.0.vb
- C:\msocache.exe
- %TEMP%\resf324.tmp
- %TEMP%\vbc153a6934e9e142729b328689ab5b996.tmp
- %TEMP%\vbcf7ac1ddcac984efc9e29afb8bd71926e.tmp
- %TEMP%\vbc978ae7b8114641bf87d1d3a2e117e988.tmp
- %TEMP%\0vcratll\0vcratll.cmdline
- %TEMP%\0vcratll\0vcratll.0.vb
- C:\far2.exe
- %TEMP%\resebe4.tmp
- %TEMP%\vbcfb0e4836f9a54c15a3f86da2c27cbc87.tmp
- %TEMP%\vbcc54bce1edf64c399ce6abc641d6531.tmp
- %TEMP%\asoilnyt\asoilnyt.0.vb
- %TEMP%\xp1aqvcm\xp1aqvcm.out
Sets the 'hidden' attribute to the following files
- C:\photos\picture.exe
- D:\photos\picture.exe
- <Drive name for removable media>:\photos\picture.exe
Deletes the following files
- %TEMP%\resdd63.tmp
- %TEMP%\res3a8.tmp
- %TEMP%\vbc680238d19f144959927b33d845831c6.tmp
- %TEMP%\vbc54aea4f022724fae88b3c1df7b4abead.tmp
- %TEMP%\c5wqllzz\c5wqllzz.cmdline
- %TEMP%\c5wqllzz\c5wqllzz.0.vb
- %TEMP%\c5wqllzz\c5wqllzz.out
- %TEMP%\resaaa.tmp
- %TEMP%\vbce77384d1804f4087a2bd48c5c92023b7.tmp
- %TEMP%\vbce03efaf0dcaf4b5a81a14e22a267f8e.tmp
- %TEMP%\1lvzohjt\1lvzohjt.cmdline
- %TEMP%\1lvzohjt\1lvzohjt.0.vb
- %TEMP%\1lvzohjt\1lvzohjt.out
- %TEMP%\res114e.tmp
- %TEMP%\vbcc6e32b9e521b498bbc44b6c048aac7b.tmp
- %TEMP%\vbc6c3da931a66e444abf2fca44d61ad250.tmp
- %TEMP%\0hnyc2b1\0hnyc2b1.cmdline
- %TEMP%\0hnyc2b1\0hnyc2b1.0.vb
- %TEMP%\0hnyc2b1\0hnyc2b1.out
- %TEMP%\res8c76.tmp
- %TEMP%\vbc984a7ae2d3f24652b1918d4edbccb8b.tmp
- %TEMP%\vbc410c56a1f00e40cfad59c4fa65323cec.tmp
- %TEMP%\ofd2xe3q\ofd2xe3q.out
- %TEMP%\ofd2xe3q\ofd2xe3q.0.vb
- %TEMP%\ofd2xe3q\ofd2xe3q.cmdline
- %TEMP%\xp1aqvcm\xp1aqvcm.0.vb
- %TEMP%\oirbou0u\oirbou0u.cmdline
- %TEMP%\xp1aqvcm\xp1aqvcm.out
- %TEMP%\oirbou0u\oirbou0u.0.vb
- %TEMP%\vbcefce64e495f245dd85cfde0eca9331.tmp
- %TEMP%\vbc90da5ffef215496e8ef5bb1dd22fd7a0.tmp
- %TEMP%\vbc173575af44346f7909b9e658510ed57.tmp
- %TEMP%\h3yowonv\h3yowonv.0.vb
- %TEMP%\h3yowonv\h3yowonv.out
- %TEMP%\h3yowonv\h3yowonv.cmdline
- %TEMP%\rese4b3.tmp
- %TEMP%\vbcadf0a751493449119e3bf61d82f3c49.tmp
- %TEMP%\vbc671ac66155cf4d81a8e171bb7053fc86.tmp
- %TEMP%\tdpirybw\tdpirybw.0.vb
- %TEMP%\tdpirybw\tdpirybw.out
- %TEMP%\tdpirybw\tdpirybw.cmdline
- %TEMP%\resebe4.tmp
- %TEMP%\vbcfb0e4836f9a54c15a3f86da2c27cbc87.tmp
- %TEMP%\vbcc54bce1edf64c399ce6abc641d6531.tmp
- %TEMP%\asoilnyt\asoilnyt.cmdline
- %TEMP%\asoilnyt\asoilnyt.out
- %TEMP%\asoilnyt\asoilnyt.0.vb
- %TEMP%\resf324.tmp
- %TEMP%\vbc153a6934e9e142729b328689ab5b996.tmp
- %TEMP%\vbc978ae7b8114641bf87d1d3a2e117e988.tmp
- %TEMP%\0vcratll\0vcratll.out
- %TEMP%\0vcratll\0vcratll.cmdline
- %TEMP%\0vcratll\0vcratll.0.vb
- %TEMP%\resfab3.tmp
- %TEMP%\vbcf7ac1ddcac984efc9e29afb8bd71926e.tmp
- %TEMP%\oirbou0u\oirbou0u.out
- %TEMP%\xp1aqvcm\xp1aqvcm.cmdline
Moves the following files
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk to %APPDATA%\lcakusatybx\google chrome.lnk
Network activity
UDP
- DNS ASK m9#.#dns.net
- DNS ASK ll#####123.zapto.org
- DNS ASK mo#.#dns.net
Miscellaneous
Creates and executes the following
- '%APPDATA%\svchost.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\h3yowonv\h3yowonv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\xp1aqvcm\xp1aqvcm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8C76.tmp" "%TEMP%\vbc984A7AE2D3F24652B1918D4EDBCCB8B.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ofd2xe3q\ofd2xe3q.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES114E.tmp" "%TEMP%\vbcC6E32B9E521B498BBC44B6C048AAC7B.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\0hnyc2b1\0hnyc2b1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAAA.tmp" "%TEMP%\vbcE77384D1804F4087A2BD48C5C92023B7.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\1lvzohjt\1lvzohjt.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3A8.tmp" "%TEMP%\vbc680238D19F144959927B33D845831C6.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\c5wqllzz\c5wqllzz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFAB3.tmp" "%TEMP%\vbcF7AC1DDCAC984EFC9E29AFB8BD71926E.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\oirbou0u\oirbou0u.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF324.tmp" "%TEMP%\vbc153A6934E9E142729B328689AB5B996.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\0vcratll\0vcratll.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEBE4.tmp" "%TEMP%\vbcFB0E4836F9A54C15A3F86DA2C27CBC87.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\asoilnyt\asoilnyt.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE4B3.tmp" "%TEMP%\vbcADF0A751493449119E3BF61D82F3C49.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\tdpirybw\tdpirybw.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDD63.tmp" "%TEMP%\vbc90DA5FFEF215496E8EF5BB1DD22FD7A0.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1DCC.tmp" "%TEMP%\vbc652F6D1720844786A78FF342EF3E6CF.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\cgn3azee\cgn3azee.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\h3yowonv\h3yowonv.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\xp1aqvcm\xp1aqvcm.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8C76.tmp" "%TEMP%\vbc984A7AE2D3F24652B1918D4EDBCCB8B.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ofd2xe3q\ofd2xe3q.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES114E.tmp" "%TEMP%\vbcC6E32B9E521B498BBC44B6C048AAC7B.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\0hnyc2b1\0hnyc2b1.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAAA.tmp" "%TEMP%\vbcE77384D1804F4087A2BD48C5C92023B7.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\1lvzohjt\1lvzohjt.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3A8.tmp" "%TEMP%\vbc680238D19F144959927B33D845831C6.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1DCC.tmp" "%TEMP%\vbc652F6D1720844786A78FF342EF3E6CF.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\c5wqllzz\c5wqllzz.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\oirbou0u\oirbou0u.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF324.tmp" "%TEMP%\vbc153A6934E9E142729B328689AB5B996.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\0vcratll\0vcratll.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEBE4.tmp" "%TEMP%\vbcFB0E4836F9A54C15A3F86DA2C27CBC87.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\asoilnyt\asoilnyt.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE4B3.tmp" "%TEMP%\vbcADF0A751493449119E3BF61D82F3C49.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\tdpirybw\tdpirybw.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDD63.tmp" "%TEMP%\vbc90DA5FFEF215496E8EF5BB1DD22FD7A0.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFAB3.tmp" "%TEMP%\vbcF7AC1DDCAC984EFC9E29AFB8BD71926E.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\cgn3azee\cgn3azee.cmdline"
