Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\taskhostt
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\dwmd
- <SYSTEM32>\tasks\firefoxf
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\idlei
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\smsss
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\<File name>y
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\lsml
- <SYSTEM32>\tasks\mdmm
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\lsassl
Modifies file system
Creates the following files
- C:\totalcmd\language\taskhost.exe
- %ProgramFiles(x86)%\windows portable devices\69ddcba757bf72
- %WINDIR%\shellnew\firefox.exe
- %WINDIR%\shellnew\0fc223bdacedc3
- C:\users\public\desktop\mdm.exe
- C:\users\public\desktop\559fba5f8e4410
- <Current directory>\dwm.exe
- C:\msocache\all users\iexplore.exe
- %TEMP%\arneuoliya.bat
- C:\msocache\all users\9db6e019d4f04e
- C:\totalcmd\language\csrss.exe
- C:\totalcmd\language\886983d96e3d3e
- %WINDIR%\microsoft.net\assembly\gac_32\microsoft.transactions.bridge.dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\lsass.exe
- %WINDIR%\microsoft.net\assembly\gac_32\microsoft.transactions.bridge.dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\6203df4a6bafc7
- %TEMP%\ia6otl7pxs
- %ProgramFiles(x86)%\windows portable devices\smss.exe
- <Current directory>\6cb0b6c459d5d3
- <Current directory>\886983d96e3d3e
- C:\far2\encyclopedia\tap\18c4272161ddde
- C:\totalcmd\language\b75386f1303e64
- %ProgramFiles%\wsm\lsm.exe
- %ProgramFiles%\wsm\101b941d020240
- %ProgramFiles%\streetsolkshim\mdm.exe
- %ProgramFiles%\streetsolkshim\559fba5f8e4410
- C:\far2\encyclopedia\tap\<File name>.exe
- <Current directory>\smss.exe
- C:\totalcmd\language\6ccacd8608530f
- <Current directory>\69ddcba757bf72
- %HOMEPATH%\printhood\lsm.exe
- %HOMEPATH%\printhood\101b941d020240
- %ProgramFiles%\icqlite\wininit.exe
- %ProgramFiles%\icqlite\56085415360792
- C:\totalcmd\language\idle.exe
- <Current directory>\csrss.exe
- nul
Deletes the following files
- %TEMP%\ia6otl7pxs
Network activity
Connects to
- '94.##0.255.214':80
UDP
- 'localhost':123
Miscellaneous
Creates and executes the following
- 'C:\totalcmd\language\idle.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\ArNEuoLiYa.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Windows Portable Devices\smss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 9 /tr "'%ProgramFiles(x86)%\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 7 /tr "'%WINDIR%\ShellNew\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%WINDIR%\ShellNew\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'%WINDIR%\ShellNew\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\mdm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'C:\Users\Public\Desktop\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Desktop\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'<Current directory>\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'<Current directory>\dwm.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\MSOCache\All Users\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'%WINDIR%\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\lsass.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'%WINDIR%\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'%WINDIR%\Microsoft.NET\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\lsass.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\ArNEuoLiYa.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<Current directory>\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<Current directory>\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>y" /sc MINUTE /mo 5 /tr "'C:\Far2\Encyclopedia\tap\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\wsm\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%ProgramFiles%\wsm\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\wsm\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 13 /tr "'%ProgramFiles%\StreetsOlkShim\mdm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%ProgramFiles%\StreetsOlkShim\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\StreetsOlkShim\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>y" /sc MINUTE /mo 7 /tr "'C:\Far2\Encyclopedia\tap\<File name>.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\tap\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 6 /tr "'<Current directory>\smss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'<Current directory>\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 8 /tr "'<Current directory>\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 11 /tr "'%HOMEPATH%\PrintHood\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%HOMEPATH%\PrintHood\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 6 /tr "'%HOMEPATH%\PrintHood\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\ICQLite\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%ProgramFiles%\ICQLite\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\ICQLite\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'<Current directory>\csrss.exe'" /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
