Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
- <Drive name for removable media>:\ФЪПЯAЖ¬.exe
Malicious functions:
Executes the following:
- <SYSTEM32>\wscript.exe "%TEMP%\go111.vbs"
Modifies file system :
Creates the following files:
- %HOMEPATH%\Favorites\іЙИЛР¦»°.url
- %HOMEPATH%\Favorites\РФјјЗЙ.url
- %HOMEPATH%\Favorites\ФЪПЯВЧАн.url
- %HOMEPATH%\Favorites\ДРРФЅЎїµНш.url
- %HOMEPATH%\Favorites\РФЦЄК¶КУЖµ.url
- %HOMEPATH%\Favorites\Й«Й«РЎУОП·.url
- %HOMEPATH%\Favorites\іЙИЛРЎУОП·.url
- %HOMEPATH%\Favorites\НшТіУОП·\ХЅЅ«ґ«Жж.url
- %HOMEPATH%\Favorites\ГАЕ®НјЖ¬.url
- %HOMEPATH%\Favorites\№ЙЖ±єЪВнРРЗй.url
- %HOMEPATH%\Favorites\МФ±¦МШВф.url
- %HOMEPATH%\Favorites\ГО»ГРЮПЙ.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\dydy[1].exe
- %HOMEPATH%\Favorites\НкГАЕ©іЎ.url
- C:\»ЖЙ«µзУ°.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\dy2[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\9158chat_371184[1].exe
- %HOMEPATH%\Favorites\УсЦ®»к.url
- %HOMEPATH%\Favorites\°БКУМмµШ.url
- %HOMEPATH%\Favorites\ХЅЅ«ґ«Жж.url
- %HOMEPATH%\Favorites\·ІИЛРЮХж.url
- %HOMEPATH%\Favorites\µЇµЇМГ.url
- %HOMEPATH%\Favorites\ГчіЇК±ґъ.url
- %HOMEPATH%\Favorites\НшТіУОП·\УсЦ®»к.url
- %HOMEPATH%\Desktop\НшТіУОП·\Desktop.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\t58chat_374931[1].exe
- %HOMEPATH%\Desktop\НшТіУОП·\ГО»ГРЮПЙ.url
- %HOMEPATH%\Desktop\НшТіУОП·\°БКУМмµШ.url
- %HOMEPATH%\Desktop\НшТіУОП·\ХЅЅ«ґ«Жж.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\index[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\qwxyx[1]
- %TEMP%\go111.vbs
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\download[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\index[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\coopen4397[1].exe
- %HOMEPATH%\Desktop\НшТіУОП·\·ІИЛРЮХж.url
- %HOMEPATH%\Favorites\НшТіУОП·\·ІИЛРЮХж.url
- %HOMEPATH%\Favorites\НшТіУОП·\µЇµЇМГ.url
- %HOMEPATH%\Favorites\НшТіУОП·\ГО»ГРЮПЙ.url
- %HOMEPATH%\Favorites\НшТіУОП·\НкГАЕ©іЎ.url
- %HOMEPATH%\Favorites\НшТіУОП·\ГчіЇК±ґъ.url
- %HOMEPATH%\Favorites\НшТіУОП·\°БКУМмµШ.url
- %HOMEPATH%\Desktop\НшТіУОП·\µЇµЇМГ.url
- %HOMEPATH%\Desktop\НшТіУОП·\ГчіЇК±ґъ.url
- %HOMEPATH%\Desktop\НшТіУОП·\УсЦ®»к.url
- %HOMEPATH%\Favorites\НшТіУОП·\Desktop.ini
- %HOMEPATH%\Desktop\НшТіУОП·\НкГАЕ©іЎ.url
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Desktop\НшТіУОП·\Desktop.ini
Network activity:
Connects to:
- 'g3.##831.info':80
- 'do####ad13.subo.me':80
- 'www.xj##.info':80
- 'www.mm##5.info':80
- 'd.##55.cn':88
- 'localhost':1048
- 'www.vo##y.info':80
- 'localhost':1039
- 'www.qw##x.com':80
- 'localhost':1037
- '22#.#17.240.30':80
- 'localhost':1041
- 'ne#####.funshion.com':80
TCP:
HTTP GET requests:
- g3.##831.info/dy/dydy.exe
- do####ad13.subo.me/t58/t58chat_374931.exe
- www.mm##5.info/dy2.html?y
- do####ad13.subo.me/9158/9158chat_371184.exe
- www.xj##.info/index.htm
- ne#####.funshion.com/software/download.php?id############################
- www.qw##x.com/?i
- www.vo##y.info/index.htm
- 22#.#17.240.30/soft/coopen4397.exe
UDP:
- DNS ASK g3.##831.info
- DNS ASK do####ad13.subo.me
- DNS ASK www.mm##5.info
- DNS ASK d.##55.cn
- DNS ASK ne#####.funshion.com
- DNS ASK www.qw##x.com
- DNS ASK www.xj##.info
- DNS ASK www.vo##y.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
