Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Nyeqas' = 'rundll32.exe "%LOCALAPPDATA%\UKBDRA.dll",Startup'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'ewrgetuj' = '%TEMP%\geurge.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Security Center
Executes the following
- '%WINDIR%\syswow64\net.exe' stop "Security Center"
- '%WINDIR%\syswow64\net.exe' stop "Windows Firewall/Internet Connection Sharing (ICS)
Modifies file system
Creates the following files
- %TEMP%\nsd8dee.tmp
- %TEMP%\vbz..bat
- C:\tujserrew.bat
- %TEMP%\geurge.exe
- %TEMP%\d.bat
- %TEMP%\wininstall.exe
- %TEMP%\nsxbaa8.tmp
- %LOCALAPPDATA%\ukbdra.dll
- %TEMP%\b.vbs
- %TEMP%\free.movie.license4.exe
- %TEMP%\free.movie.license3.exe
- %TEMP%\free.movie.license2.exe
- %TEMP%\free.movie.license1.exe
- %TEMP%\free movie license.exe
- %TEMP%\nsiabea.tmp\execdos.dll
- %APPDATA%\game setup.exe
- %TEMP%\a1.7z
- %TEMP%\7za.exe
- nul
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
Deletes the following files
- %TEMP%\nsiabea.tmp\execdos.dll
- %TEMP%\free.movie.license2.exe
- %TEMP%\free.movie.license3.exe
Moves the following files
- from %TEMP%\free movie license.exe to %TEMP%\d99d.tmp
Deletes itself.
Network activity
Connects to
- 'se###h.icq.com':80
- 'fl##ube.net':80
TCP
HTTP GET requests
- http://www.fl##ube.net/5649
- http://www.fl##ube.net/5649?gp###################################################################################################################################################################...
- http://ww##.#lvtube.net/?tm######################################################################################################################################################################...
UDP
- DNS ASK 00########.########.##.##########874C08BA8B473129C73822.n.empty.1146.empty.6_1._t_i.3000.dpfdqo_exe.168.rc2.a4h9uploading.com
- DNS ASK go###e.co.uk
- DNS ASK eb##.com
- DNS ASK cc##iry.com
- DNS ASK ev##u.net
- DNS ASK se###h.icq.com
- DNS ASK 68###6b6.com
- DNS ASK dc##ick.com
- DNS ASK fr###oodoo.net
- DNS ASK je###mber.net
- DNS ASK 2b.###fectexe.com
- DNS ASK fl##ube.net
- DNS ASK ww##.#lvtube.net
- DNS ASK co####.perfectexe.com
- DNS ASK 06######0401.giselin.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%APPDATA%\game setup.exe'
- '%TEMP%\geurge.exe'
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\b.vbs"
- '%TEMP%\free.movie.license4.exe'
- '%TEMP%\free.movie.license2.exe'
- '%TEMP%\free.movie.license3.exe'
- '%TEMP%\free.movie.license1.exe'
- '%TEMP%\free movie license.exe'
- '%TEMP%\7za.exe' x "%TEMP%\a1.7z" -aoa -o%LOCALAPPDATA%\Temp -p~@S23js@@vBz99432@t9 "" ""
- '%TEMP%\wininstall.exe'
- '%WINDIR%\syswow64\sc.exe' config SharedAccess start= DISABLED' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\tujserrew.bat""' (with hidden window)
- '%TEMP%\7za.exe' x "%TEMP%\a1.7z" -aoa -o%LOCALAPPDATA%\Temp -p~@S23js@@vBz99432@t9 "" ""' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /q /c "%TEMP%\Vbz..bat" > nul 2> nul' (with hidden window)
- '%TEMP%\geurge.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\d.bat" "' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "Security Center"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config wscsvc start= DISABLED' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "Windows Firewall/Internet Connection Sharing (ICS)' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\FREEMO~4.EXE > nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%LOCALAPPDATA%\UKBDRA.dll",Startup
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\d.bat" "
- '%WINDIR%\syswow64\sc.exe' config wscsvc start= DISABLED
- '%WINDIR%\syswow64\cmd.exe' /C ping -n 1 localhost
- '%WINDIR%\syswow64\sc.exe' config SharedAccess start= DISABLED
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\tujserrew.bat""
- '%WINDIR%\syswow64\net1.exe' stop "Security Center"
- '%WINDIR%\syswow64\ping.exe' -n 1 localhost
- '%WINDIR%\syswow64\cmd.exe' /q /c "%TEMP%\Vbz..bat" > nul 2> nul
- '%WINDIR%\syswow64\net1.exe' stop "Windows Firewall/Internet Connection Sharing (ICS)
- '%WINDIR%\syswow64\rundll32.exe' "%LOCALAPPDATA%\UKBDRA.dll",iep
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\FREEMO~4.EXE > nul
