Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\V5XMWNL8] 'ImagePath' = '%ProgramFiles%\I9RKO9YE8LWG\CEGIBQ31AC.EXE -8TZLQVG'
- [<HKLM>\SYSTEM\ControlSet001\Services\V5XMWNL8] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '<SYSTEM32>\reg.exe' delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Animations /t REG_SZ /d no /F
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\fdonszuycqs.dll"
- 'C:\I2NHSZ9.EXE' FDONSZUYCQS
- '<SYSTEM32>\regsvr32.exe' /u /s scrrun.dll
- '<SYSTEM32>\cmd.exe' /c C:\873R488AQ.BAT
Modifies file system:
Creates the following files:
- %ProgramFiles%\I9RKO9YE8LWG\CEGIBQ31AC.EXE
- %ProgramFiles%\I9RKO9YE8LWG\QKTG8.EXE
- C:\873R488AQ.BAT
- C:\I2NHSZ9.EXE
- %WINDIR%\FDONSZUYCQS.txt
- %WINDIR%\fdonszuycqs.dll
Sets the 'hidden' attribute to the following files:
- %ProgramFiles%\I9RKO9YE8LWG\QKTG8.EXE
- %ProgramFiles%\I9RKO9YE8LWG\CEGIBQ31AC.EXE
- <Full path to virus>
Deletes the following files:
- %WINDIR%\Media\Windows XP Logon Sound.wav
- %WINDIR%\Media\Windows XP Logoff Sound.wav
- %WINDIR%\Media\Windows XP Minimize.wav
- %WINDIR%\Media\Windows XP Menu Command.wav
- %WINDIR%\Media\Windows XP Information Bar.wav
- %WINDIR%\Media\Windows XP Hardware Fail.wav
- %WINDIR%\Media\Windows XP Exclamation.wav
- %WINDIR%\Media\Windows XP Hardware Remove.wav
- %WINDIR%\Media\Windows XP Hardware Insert.wav
- %WINDIR%\Media\Windows XP Notify.wav
- %WINDIR%\Media\Windows XP Shutdown.wav
- %WINDIR%\Media\Windows XP Ringout.wav
- %WINDIR%\Media\Windows XP Startup.wav
- %WINDIR%\Media\Windows XP Start.wav
- %WINDIR%\Media\Windows XP Ringin.wav
- %WINDIR%\Media\Windows XP Print complete.wav
- %WINDIR%\Media\Windows XP Pop-up Blocked.wav
- %WINDIR%\Media\Windows XP Restore.wav
- %WINDIR%\Media\Windows XP Recycle.wav
- %WINDIR%\Media\recycle.wav
- %WINDIR%\Media\onestop.mid
- %WINDIR%\Media\ringout.wav
- %WINDIR%\Media\ringin.wav
- %WINDIR%\Media\notify.wav
- %WINDIR%\Media\chord.wav
- %WINDIR%\Media\chimes.wav
- %WINDIR%\Media\flourish.mid
- %WINDIR%\Media\ding.wav
- %WINDIR%\Media\start.wav
- %WINDIR%\Media\Windows XP Default.wav
- %WINDIR%\Media\Windows XP Critical Stop.wav
- %WINDIR%\Media\Windows XP Error.wav
- %WINDIR%\Media\Windows XP Ding.wav
- %WINDIR%\Media\Windows XP Battery Low.wav
- %WINDIR%\Media\town.mid
- %WINDIR%\Media\tada.wav
- %WINDIR%\Media\Windows XP Battery Critical.wav
- %WINDIR%\Media\Windows XP Balloon.wav
Network activity:
Connects to:
- 'us###.nofeehost.com':80
- '<L###LNET>.0.2':443
- '61.##3.53.125':443
- '19#####.fateback.com':80
TCP:
HTTP GET requests:
- http://us###.nofeehost.com/jokercvs/index.htm
- http://19#####.fateback.com/index.htm
UDP:
- DNS ASK us###.nofeehost.com
- DNS ASK 19#####.fateback.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'FDONSZUYCQS' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'FDONSZUYCQS' WindowName: 'jkgvdsxu'
