Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'oleulfwwwnsq' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'AntiVirus 2010' = '"%APPDATA%\AntiVirus 2010\AntiVirus Studio 2010.exe" /STARTUP'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SecurityCenter' = '%APPDATA%\AntiVirus 2010\securitycenter.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
- Windows Update
- Windows Security Center
Modifies file system
Creates the following files
- %TEMP%\wc20.tmp
- %TEMP%\pswwg3c.exe
- %TEMP%\snowif.exe
- %TEMP%\hhbboll_2.exe
- %TEMP%\kilslmd.exex
- %TEMP%\dkfjd93.exe
- %TEMP%\fe.exe
- %TEMP%\hiphop.exe
- %TEMP%\gpupz2a.exe
- %TEMP%\ddhelp.exe
- %TEMP%\hvipws9.exe
- %TEMP%\timem.exe
- %TEMP%\cunifuc.exe
- %TEMP%\kjdh_gf_jjdhgd.exe
- %TEMP%\eephilpe.exe
- %TEMP%\wergfq.exe
- %TEMP%\56493.exe
- %TEMP%\rator.exe
- %TEMP%\jofcdks.exe
- %TEMP%\rtfme.exe
- %TEMP%\wqefqw7e.exe
- %TEMP%\ae0965a7157cd.exe
- %TEMP%\al3erfa3.exe
- %TEMP%\ddoll3342.exe
- %TEMP%\test.exe
- %TEMP%\r0life.exe
- %TEMP%\format.exe
- %TEMP%\safe.exe
- %TEMP%\qwklrvjhqlkj.exe
- %TEMP%\02c9c3c35bdx5.exe
- %TEMP%\alerfa.exe
- %TEMP%\lorsk.exe
- %TEMP%\hodeme.exe
- %APPDATA%\antivirus 2010\antivirus studio 2010.exe
- %APPDATA%\antivirus 2010\securitycenter.exe
- %APPDATA%\antivirus 2010\taskmgr.dll
- %APPDATA%\antivirus 2010\securityhelper.exe
- %APPDATA%\microsoft\windows\start menu\programs\antivirus 2010.lnk
- %APPDATA%\microsoft\windows\start menu\programs\antivirus 2010\antivirus 2010.lnk
- %APPDATA%\microsoft\windows\start menu\programs\antivirus 2010\activate antivirus 2010.lnk
- %APPDATA%\microsoft\windows\start menu\programs\antivirus 2010\how to activate antivirus 2010.lnk
- %APPDATA%\microsoft\windows\start menu\programs\antivirus 2010\help antivirus 2010.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\antivirus 2010.lnk
- %TEMP%\w6b02.tmp
- %TEMP%\wrfwe_di.exe
- %TEMP%\winlogoff.exe
- %TEMP%\_1ec7.tmpac7d.exe
- %TEMP%\wb9bd.tmp
- %TEMP%\ds7hw.exe
- %TEMP%\lols.exe
- %TEMP%\dc_3.exe
- %TEMP%\qwedvor.exe
- %TEMP%\dd10x10.exe
- %TEMP%\17dkf.exe
- %TEMP%\jdhellwo3.exe
- %TEMP%\gedx_ae09.exe
- %TEMP%\wrcud12.exe
- %TEMP%\eelnvd13.exe
- %TEMP%\ppddfcfux.exxe
- %TEMP%\sycre.exe
- %TEMP%\backd-efq.exe
- %TEMP%\472a10e2ebxd9.exe
- %TEMP%\kock.exe
- %TEMP%\hardwh.exe
Deletes the following files
- %TEMP%\wc20.tmp
- %TEMP%\_1ec7.tmpac7d.exe
- %TEMP%\w6b02.tmp
- %TEMP%\wb9bd.tmp
Network activity
UDP
- DNS ASK 17#####414.httpgo.net
- DNS ASK ht###ive.net
- DNS ASK 17#####435.httpgo.net
- DNS ASK 17#####474.httpgo.net
- DNS ASK 17#####496.httpgo.net
- 'localhost':57062
- 'localhost':50876
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'AntiVirus 2010'
Creates and executes the following
- '%TEMP%\_1ec7.tmpac7d.exe' -p"15:02" -y -o"%APPDATA%\AntiVirus 2010"
- '%APPDATA%\antivirus 2010\antivirus studio 2010.exe'
- '%APPDATA%\antivirus 2010\securitycenter.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C dir "%APPDATA%"
- '%WINDIR%\syswow64\cmd.exe' /C dir "%APPDATA%\AntiVirus 2010"
- '%TEMP%\_1ec7.tmpac7d.exe' -p"15:02" -y -o"%APPDATA%\AntiVirus 2010"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C dir "%APPDATA%"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C dir "%APPDATA%\AntiVirus 2010"' (with hidden window)
