Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Internet Explorer Content Server' = '%PROGRAM_FILES%\Internet Explorer\PLUGINS\cssrrh.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Internet Explorer Content Server' = '%PROGRAM_FILES%\Internet Explorer\PLUGINS\cssrrh.exe'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\Internet Explorer\PLUGINS\cssrrh.exe -rm "<Full path to virus>"
Executes the following:
- <SYSTEM32>\net1.exe stop wscsvc
- <SYSTEM32>\net1.exe stop SharedAccess
- <SYSTEM32>\net1.exe stop wuauserv
- <SYSTEM32>\net.exe stop wscsvc
- <SYSTEM32>\net.exe stop SharedAccess
- <SYSTEM32>\net.exe stop wuauserv
Searches for windows to
detect programs and games:
- ClassName: 'MSBLWindowClass' WindowName: 'Windows Live Messenger'
- ClassName: 'gdkWindowToplevel' WindowName: 'Buddy List'
- ClassName: '' WindowName: 'Yahoo! Messenger'
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mmain[1].php
- %PROGRAM_FILES%\Internet Explorer\PLUGINS\IEVML32v.dll
- %PROGRAM_FILES%\Internet Explorer\PLUGINS\cssrrh.exe
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mmain[1].php
Deletes itself.
Network activity:
Connects to:
- 'kr####yn.funpic.org':80
- 'ad#####on.funpic.org':80
- 'lo#####ken.funpic.org':80
- 'te####ng.funpic.org':80
- '<Private IP address>':80
- 'localhost':1037
- 'an#####pete.0fees.net':80
- 'sc#####head.0fees.net':80
TCP:
HTTP GET requests:
- kr####yn.funpic.org/mmain.php?&u#########
- te####ng.funpic.org/mmain.php?&u#########
- lo#####ken.funpic.org/mmain.php?&u#########
- ad#####on.funpic.org/mmain.php?&u#########
- sc#####head.0fees.net/mmain.php?&m######
- sc#####head.0fees.net/mmain.php?&u#########
- an#####pete.0fees.net/mmain.php?&u#########
UDP:
- DNS ASK kr####yn.funpic.org
- DNS ASK te####ng.funpic.org
- DNS ASK lo#####ken.funpic.org
- DNS ASK sc#####head.0fees.net
- DNS ASK an#####pete.0fees.net
- DNS ASK ad#####on.funpic.org
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'COMODO BOClean lifetime free license'
- ClassName: '' WindowName: 'Comodo BOClean 4.25 Setup'
- ClassName: '' WindowName: 'Setup - Anti Trojan Elite'
- ClassName: '' WindowName: 'Setup - TrojanHunter'
- ClassName: '' WindowName: 'Trend Micro HijackThis - v2.0.2'
- ClassName: '' WindowName: 'Trend Micro HijackThis'
- ClassName: '' WindowName: 'ESET Smart Security Setup'
- ClassName: 'SkinWnd' WindowName: ''
- ClassName: 'tSkMainForm.UnicodeClass' WindowName: ''
- ClassName: 'Miranda' WindowName: 'Miranda IM'
- ClassName: '__oxFrame.class__' WindowName: 'AIM'
- ClassName: '__oxFrame.class__' WindowName: 'ICQ'
- ClassName: '' WindowName: 'Google Talk'
- ClassName: '' WindowName: 'Faronics Anti-Executable Standard'
- ClassName: '' WindowName: 'Sunbelt Personal Firewall - InstallShield Wizard'
- ClassName: '' WindowName: 'Outpost Firewall Pro Setup'
- ClassName: '' WindowName: 'COMODO Firewall Pro Installer'
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: 'Norton AntiBot - InstallShield Wizard'
- ClassName: '' WindowName: 'Setup - DiamondCS ProcessGuard'
- ClassName: '' WindowName: 'ZoneAlarm Pro Installation'
- ClassName: '' WindowName: 'Setup - Spybot - Search & Destroy'
- ClassName: '' WindowName: 'Tiny Desktop Firewall 2005 - Setup Wizard'
- ClassName: '' WindowName: 'Norman Security Suite - InstallShield Wizard'
- ClassName: '' WindowName: 'Jetico Personal Firewall Setup - v 2.0.1.2'
- ClassName: '' WindowName: 'Setup - PC Tools Firewall Plus'
- ClassName: '' WindowName: 'Webroot Desktop Firewall - InstallShield Wizard'
