Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\mdmm
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\servicess
- <SYSTEM32>\tasks\winlogonw
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\cmd
- <SYSTEM32>\tasks\cmdc
- <SYSTEM32>\tasks\spoolsvs
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\explorere
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\taskhostt
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Modifies file system
Creates the following files
- %TEMP%\nvidiaprofileinspector.exe
- C:\bridgeruntimehostcrt\iexplore.exe
- C:\bridgeruntimehostcrt\9db6e019d4f04e
- C:\totalcmd\language\taskhost.exe
- C:\totalcmd\language\b75386f1303e64
- %ProgramFiles(x86)%\winamp\components\csrss.exe
- %ALLUSERSPROFILE%\sun\java\java update\services.exe
- %ALLUSERSPROFILE%\sun\java\java update\c5b4cb5e9653cc
- %ProgramFiles(x86)%\winamp\components\886983d96e3d3e
- %ProgramFiles%\wltuser\taskhost.exe
- %ProgramFiles%\wltuser\b75386f1303e64
- C:\far2\pluginsdk\headers.c\iexplore.exe
- C:\far2\pluginsdk\headers.c\9db6e019d4f04e
- %TEMP%\19mjrlscsd
- C:\users\default\start menu\taskhost.exe
- C:\users\default\start menu\b75386f1303e64
- C:\users\default user\27d1bcfc3c54e0
- C:\users\default user\system.exe
- C:\far2\pluginsdk\cc11b995f2a76d
- C:\bridgeruntimehostcrt\ubir4qndf9.bat
- C:\bridgeruntimehostcrt\hyperwinhost.exe
- C:\bridgeruntimehostcrt\43wmsea7nrf9nkcvc91.vbe
- <Current directory>\mdm.exe
- <Current directory>\559fba5f8e4410
- C:\bridgeruntimehostcrt\explorer.exe
- %TEMP%\dcratbuild.exe
- C:\bridgeruntimehostcrt\7a0fd90576e088
- C:\users\public\libraries\ebf1f9fa8afd6d
- <Current directory>\spoolsv.exe
- <Current directory>\f3b6ecef712a24
- <Current directory>\csrss.exe
- <Current directory>\886983d96e3d3e
- C:\far2\pluginsdk\winlogon.exe
- C:\users\public\libraries\cmd.exe
- %TEMP%\86ufmky2pq.bat
- nul
Deletes the following files
- %TEMP%\19mjrlscsd
Network activity
Connects to
- '92.##5.107.243':80
TCP
HTTP GET requests
- http://92.##5.107.243/Update80universal/CpuDefault/ImageProtect/5secure/_Gamecentral3/ProtectTemp/update/trackvideophp/ImagejsLowuniversaltemporary.php?b5#######################################...
- http://92.##5.107.243/Update80universal/CpuDefault/ImageProtect/5secure/_Gamecentral3/ProtectTemp/update/trackvideophp/ImagejsLowuniversaltemporary.php?R8#######################################...
UDP
- 'localhost':123
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\nvidiaprofileinspector.exe'
- '%TEMP%\dcratbuild.exe'
- '%WINDIR%\syswow64\wscript.exe' "C:\bridgeruntimehostcrt\43wMsea7Nrf9nkCVC91.vbe"
- 'C:\bridgeruntimehostcrt\hyperwinhost.exe'
- 'C:\bridgeruntimehostcrt\iexplore.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\bridgeruntimehostcrt\uBir4QNdf9.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\86UfMkY2Pq.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\bridgeruntimehostcrt\uBir4QNdf9.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\bridgeruntimehostcrt\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 7 /tr "'C:\bridgeruntimehostcrt\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Winamp\Components\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Winamp\Components\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Winamp\Components\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'<Current directory>\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Start Menu\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Start Menu\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\wltuser\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'%ProgramFiles%\wltuser\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\wltuser\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 9 /tr "'C:\Far2\PluginSDK\Headers.c\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Far2\PluginSDK\Headers.c\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 9 /tr "'C:\Far2\PluginSDK\Headers.c\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\86UfMkY2Pq.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 14 /tr "'%ALLUSERSPROFILE%\Sun\Java\Java Update\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 10 /tr "'C:\bridgeruntimehostcrt\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Sun\Java\Java Update\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 6 /tr "'%ALLUSERSPROFILE%\Sun\Java\Java Update\services.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'<Current directory>\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 9 /tr "'<Current directory>\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\bridgeruntimehostcrt\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\bridgeruntimehostcrt\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\bridgeruntimehostcrt\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Libraries\cmd.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Public\Libraries\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Libraries\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'<Current directory>\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'<Current directory>\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Far2\PluginSDK\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'C:\Far2\PluginSDK\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Far2\PluginSDK\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 6 /tr "'<Current directory>\mdm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'<Current directory>\spoolsv.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
