Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\WindowsVNT_R1] 'ImagePath' = '%ProgramFiles%\Windows Network Accelerater\v1\winvxm.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\WindowsVNT_R1] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Windows VNET" dir=in program="%ProgramFiles%\Windows Network Accelerater\v1\winvxm.exe" security=authnoencap action=allow
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="Windows VNET Client"
- '%ProgramFiles%\Windows Network Accelerater\v1\winvxm.exe'
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Windows VNET Client" dir=in program="%ProgramFiles%\Windows Network Accelerater\v1\vxmclient.exe" security=authnoencap action=allow
- '%TEMP%\is-M5SM5.tmp\<File name>.tmp' /SL5="$50036,1875327,54272,<Full path to file>" /VERYSILENT /SP-
- '%TEMP%\is-5HL98.tmp\<File name>.tmp' /SL5="$30092,1875327,54272,<Full path to file>"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="Windows VNET"
- '%ProgramFiles%\Windows Network Accelerater\v1\vxmclient.exe' "reg" "firstclient" "dvd"
Modifies file system:
Creates the following files:
- %ProgramFiles%\Windows Network Accelerater\v1\is-71NP4.tmp
- %ProgramFiles%\Windows Network Accelerater\v1\is-P66B8.tmp
- %ProgramFiles%\Windows Network Accelerater\v1\is-5FJBG.tmp
- %ALLUSERSPROFILE%\Documents\Windows VXM\systeinfo.vpx
- %ALLUSERSPROFILE%\Application Data\Windows VXM\Images\is-PLR08.tmp
- %ProgramFiles%\Windows Network Accelerater\v1\config\is-QNJAO.tmp
- %TEMP%\is-4I8HA.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-4I8HA.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-5HL98.tmp\<File name>.tmp
- %TEMP%\is-8PL37.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-8PL37.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-M5SM5.tmp\<File name>.tmp
Deletes the following files:
- %TEMP%\is-8PL37.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-8PL37.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-M5SM5.tmp\<File name>.tmp
- %TEMP%\is-4I8HA.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-4I8HA.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-5HL98.tmp\<File name>.tmp
Moves the following files:
- from %ProgramFiles%\Windows Network Accelerater\v1\config\is-QNJAO.tmp to %ProgramFiles%\Windows Network Accelerater\v1\config\systeinfo.vpx
- from %ALLUSERSPROFILE%\Application Data\Windows VXM\Images\is-PLR08.tmp to %ALLUSERSPROFILE%\Application Data\Windows VXM\Images\default.png
- from %ProgramFiles%\Windows Network Accelerater\v1\is-71NP4.tmp to %ProgramFiles%\Windows Network Accelerater\v1\systeinfo.vpx
- from %ProgramFiles%\Windows Network Accelerater\v1\is-5FJBG.tmp to %ProgramFiles%\Windows Network Accelerater\v1\winvxm.exe
- from %ProgramFiles%\Windows Network Accelerater\v1\is-P66B8.tmp to %ProgramFiles%\Windows Network Accelerater\v1\vxmclient.exe
Network activity:
Connects to:
- 'www.so#####e-upgrade.org':80
UDP:
- DNS ASK www.so#####e-upgrade.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
