Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Executes the following:
- '<SYSTEM32>\net.exe' stop wuauserv
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN1.0" dir=in action=block program="%ProgramFiles%\AhnLab\V3Lite30\MUpdate2\MUpdate2.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN1.0" dir=out action=block program="%ProgramFiles%\AhnLab\V3Lite30\MUpdate2\MUpdate2.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN2.0" dir=in action=block program="%ProgramFiles%\ESTsoft\ALYac\AYUpdSrv.aye"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN2.0" dir=out action=block program="%ProgramFiles%\ESTsoft\ALYac\AYUpdSrv.aye"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Torrentservice" dir=in action=block program="%ProgramFiles%\Naver\NaverVaccine\NvcAgent.npc"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Torrentservice" dir=out action=block program="%ProgramFiles%\Naver\NaverVaccine\NvcAgent.npc"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Msn Messenger" dir=in action=block program="%ProgramFiles%\AVAST Software\Avast\setup\instup.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Msn Messenger" dir=out action=block program="%ProgramFiles%\AVAST Software\Avast\setup\instup.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Skype updater" dir=in action=block program="%ProgramFiles%\AhnLab\Safe Transaction\MUpdate2\MUpdate2.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Skype updater" dir=out action=block program="%ProgramFiles%\AhnLab\Safe Transaction\MUpdate2\MUpdate2.exe"
Modifies file system:
Creates the following files:
- %TEMP%\Installer.msi
- %WINDIR%\Installer\MSI5.tmp
- C:\Config.Msi\2890f.rbs
- %WINDIR%\Installer\MSI3.tmp
- %APPDATA%\Notepad\is-DHKO8.tmp
- %APPDATA%\Notepad\is-I6A87.tmp
- %APPDATA%\Notepad\is-7EDLR.tmp
- %APPDATA%\Notepad\is-6UUGE.tmp
- %APPDATA%\Notepad\is-7HP8J.tmp
- %APPDATA%\Notepad\is-009C3.tmp
- %APPDATA%\Notepad\is-G6JHK.tmp
- %APPDATA%\Notepad\is-T6G86.tmp
- %APPDATA%\Notepad\is-6SR0B.tmp
- %APPDATA%\Notepad\is-O4TR1.tmp
- %APPDATA%\Notepad\is-U5QCD.tmp
- %TEMP%\is-9JVQN.tmp\Installer.tmp
- %TEMP%\MW-0ff6f471-e41a-4945-b884-c10ff0b16262\files\Installer.exe
- %TEMP%\MW-0ff6f471-e41a-4945-b884-c10ff0b16262\files.cab
- %TEMP%\MW-0ff6f471-e41a-4945-b884-c10ff0b16262\msiwrapper.ini
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\2890e.ipi
- %WINDIR%\Installer\2890c.msi
- %TEMP%\start.exe
- %TEMP%\Install.cmd
- %WINDIR%\Installer\28910.msi
- %WINDIR%\Installer\MSI7.tmp
Deletes the following files:
- %TEMP%\is-9JVQN.tmp\Installer.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI3.tmp
- C:\Config.Msi\2890f.rbs
- %TEMP%\MW-0ff6f471-e41a-4945-b884-c10ff0b16262\files\Installer.exe
- %TEMP%\MW-0ff6f471-e41a-4945-b884-c10ff0b16262\msiwrapper.ini
- %TEMP%\MW-0ff6f471-e41a-4945-b884-c10ff0b16262\files.cab
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\2890c.msi
- %WINDIR%\Installer\2890e.ipi
- %TEMP%\Installer.msi
- %TEMP%\Install.cmd
Moves the following files:
- from %APPDATA%\Notepad\is-U5QCD.tmp to %APPDATA%\Notepad\config.json
- from %APPDATA%\Notepad\is-O4TR1.tmp to %APPDATA%\Notepad\vI814L1Bmvx4hh4TcDFMh69Em87SHx.7z
- from %APPDATA%\Notepad\is-6SR0B.tmp to %APPDATA%\Notepad\7z.dll
- from %APPDATA%\Notepad\is-T6G86.tmp to %APPDATA%\Notepad\7z.exe
- from %APPDATA%\Notepad\is-G6JHK.tmp to %APPDATA%\Notepad\7z.sfx
- from %APPDATA%\Notepad\is-009C3.tmp to %APPDATA%\Notepad\7zCon.sfx
- from %APPDATA%\Notepad\is-7HP8J.tmp to %APPDATA%\Notepad\7-zip.dll
- from %APPDATA%\Notepad\is-6UUGE.tmp to %APPDATA%\Notepad\7-zip32.dll
- from %APPDATA%\Notepad\is-7EDLR.tmp to %APPDATA%\Notepad\vT90M5x57aE4xY95xUSwIC1cnGnW4c.bat
- from %APPDATA%\Notepad\is-I6A87.tmp to %APPDATA%\Notepad\vT90M5x57aE4xY95xUSwIC1cnGnW4c.vbs
- from %APPDATA%\Notepad\is-DHKO8.tmp to %APPDATA%\Notepad\6BpT7I2P6wjMiRw7O86hWR3pi8E2rt.bat
Miscellaneous:
Creates and executes the following:
- '%TEMP%\start.exe'
- '%TEMP%\MW-0ff6f471-e41a-4945-b884-c10ff0b16262\files\Installer.exe' /VERYSILENT
- '%TEMP%\is-9JVQN.tmp\Installer.tmp' /SL5="$400E8,2043468,57856,%TEMP%\MW-0ff6f471-e41a-4945-b884-c10ff0b16262\files\Installer.exe" /VERYSILENT
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Notepad\vT90M5x57aE4xY95xUSwIC1cnGnW4c.vbs"
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Install.cmd""
- '<SYSTEM32>\msiexec.exe' /i %TEMP%\Installer.msi /quiet
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding A8F100B6ADDB0F039F9663F55C56E98E
- '<SYSTEM32>\expand.exe' -R files.cab -F:* files
- '<SYSTEM32>\cmd.exe' /C ""%APPDATA%\Notepad\6BpT7I2P6wjMiRw7O86hWR3pi8E2rt.bat""
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\Notepad\vT90M5x57aE4xY95xUSwIC1cnGnW4c.bat"
- '<SYSTEM32>\net1.exe' stop wuauserv
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%TEMP%\MW-0ff6f471-e41a-4945-b884-c10ff0b16262\files"
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\netsh.exe' Advfirewall set allprofiles state on
- '<SYSTEM32>\schtasks.exe' /create /xml "%APPDATA%\Notepad\J6Vq9kDw4KfLS6igUMj802oPAiz881.xml" /tn "Windows Local Network Service"
- '<SYSTEM32>\xcopy.exe' /s /y /k /f "%APPDATA%\Notepad\Windows Local Network Service.bat" "%HOMEPATH%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
