Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Executes the following:
- '<SYSTEM32>\net.exe' stop wuauserv
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN1.0" dir=in action=block program="%ProgramFiles%\AhnLab\V3Lite30\MUpdate2\MUpdate2.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN1.0" dir=out action=block program="%ProgramFiles%\AhnLab\V3Lite30\MUpdate2\MUpdate2.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN2.0" dir=in action=block program="%ProgramFiles%\ESTsoft\ALYac\AYUpdSrv.aye"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="OpenVPN2.0" dir=out action=block program="%ProgramFiles%\ESTsoft\ALYac\AYUpdSrv.aye"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Torrentservice" dir=in action=block program="%ProgramFiles%\Naver\NaverVaccine\NvcAgent.npc"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Torrentservice" dir=out action=block program="%ProgramFiles%\Naver\NaverVaccine\NvcAgent.npc"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Msn Messenger" dir=in action=block program="%ProgramFiles%\AVAST Software\Avast\setup\instup.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Msn Messenger" dir=out action=block program="%ProgramFiles%\AVAST Software\Avast\setup\instup.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Skype updater" dir=in action=block program="%ProgramFiles%\AhnLab\Safe Transaction\MUpdate2\MUpdate2.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Skype updater" dir=out action=block program="%ProgramFiles%\AhnLab\Safe Transaction\MUpdate2\MUpdate2.exe"
Modifies file system:
Creates the following files:
- %TEMP%\Installer.msi
- %WINDIR%\Installer\MSI5.tmp
- C:\Config.Msi\25bc5.rbs
- %WINDIR%\Installer\MSI3.tmp
- %APPDATA%\Windows Defender\is-6P98E.tmp
- %APPDATA%\Windows Defender\is-JF50E.tmp
- %APPDATA%\Windows Defender\is-MFH5A.tmp
- %APPDATA%\Windows Defender\is-LLCTA.tmp
- %APPDATA%\Windows Defender\is-QBFGV.tmp
- %APPDATA%\Windows Defender\is-6QIVI.tmp
- %APPDATA%\Windows Defender\is-6SMG4.tmp
- %APPDATA%\Windows Defender\is-OFH1M.tmp
- %APPDATA%\Windows Defender\is-HGV1L.tmp
- %APPDATA%\Windows Defender\is-FL73G.tmp
- %APPDATA%\Windows Defender\is-EQ1ON.tmp
- %TEMP%\is-TKK7O.tmp\Installer.tmp
- %TEMP%\MW-071a1762-2910-44e8-b84f-53cbe54e777b\files\Installer.exe
- %TEMP%\MW-071a1762-2910-44e8-b84f-53cbe54e777b\files.cab
- %TEMP%\MW-071a1762-2910-44e8-b84f-53cbe54e777b\msiwrapper.ini
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\25bc4.ipi
- %WINDIR%\Installer\25bc2.msi
- %TEMP%\start.exe
- %TEMP%\Install.cmd
- %WINDIR%\Installer\25bc6.msi
- %WINDIR%\Installer\MSI7.tmp
Deletes the following files:
- %TEMP%\is-TKK7O.tmp\Installer.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI3.tmp
- C:\Config.Msi\25bc5.rbs
- %TEMP%\MW-071a1762-2910-44e8-b84f-53cbe54e777b\files\Installer.exe
- %TEMP%\MW-071a1762-2910-44e8-b84f-53cbe54e777b\msiwrapper.ini
- %TEMP%\MW-071a1762-2910-44e8-b84f-53cbe54e777b\files.cab
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\25bc2.msi
- %WINDIR%\Installer\25bc4.ipi
- %TEMP%\Installer.msi
- %TEMP%\Install.cmd
Moves the following files:
- from %APPDATA%\Windows Defender\is-EQ1ON.tmp to %APPDATA%\Windows Defender\config.json
- from %APPDATA%\Windows Defender\is-FL73G.tmp to %APPDATA%\Windows Defender\5WEf9yT5sWfFi1Kl9X400Fn6coNx9Q.7z
- from %APPDATA%\Windows Defender\is-HGV1L.tmp to %APPDATA%\Windows Defender\7z.dll
- from %APPDATA%\Windows Defender\is-OFH1M.tmp to %APPDATA%\Windows Defender\7z.exe
- from %APPDATA%\Windows Defender\is-6SMG4.tmp to %APPDATA%\Windows Defender\7z.sfx
- from %APPDATA%\Windows Defender\is-6QIVI.tmp to %APPDATA%\Windows Defender\7zCon.sfx
- from %APPDATA%\Windows Defender\is-QBFGV.tmp to %APPDATA%\Windows Defender\7-zip.dll
- from %APPDATA%\Windows Defender\is-LLCTA.tmp to %APPDATA%\Windows Defender\7-zip32.dll
- from %APPDATA%\Windows Defender\is-MFH5A.tmp to %APPDATA%\Windows Defender\99ViXKOd1VLRtoVj46T5eFd9598qgy.bat
- from %APPDATA%\Windows Defender\is-JF50E.tmp to %APPDATA%\Windows Defender\99ViXKOd1VLRtoVj46T5eFd9598qgy.vbs
- from %APPDATA%\Windows Defender\is-6P98E.tmp to %APPDATA%\Windows Defender\W7lG01Z7Axxvic04p4jzRLL2EPQ79r.bat
Miscellaneous:
Creates and executes the following:
- '%TEMP%\start.exe'
- '%TEMP%\MW-071a1762-2910-44e8-b84f-53cbe54e777b\files\Installer.exe' /VERYSILENT
- '%TEMP%\is-TKK7O.tmp\Installer.tmp' /SL5="$300EA,1962781,57856,%TEMP%\MW-071a1762-2910-44e8-b84f-53cbe54e777b\files\Installer.exe" /VERYSILENT
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Install.cmd""
- '<SYSTEM32>\msiexec.exe' /i %TEMP%\Installer.msi /quiet
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 22A7D0F50E24F318DF3415124DC1D047
- '<SYSTEM32>\expand.exe' -R files.cab -F:* files
- '<SYSTEM32>\cmd.exe' /C ""%APPDATA%\Windows Defender\W7lG01Z7Axxvic04p4jzRLL2EPQ79r.bat""
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Windows Defender\99ViXKOd1VLRtoVj46T5eFd9598qgy.vbs"
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\Windows Defender\99ViXKOd1VLRtoVj46T5eFd9598qgy.bat"
- '<SYSTEM32>\net1.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%TEMP%\MW-071a1762-2910-44e8-b84f-53cbe54e777b\files"
- '<SYSTEM32>\netsh.exe' Advfirewall set allprofiles state on
- '<SYSTEM32>\schtasks.exe' /create /xml "%APPDATA%\Windows Defender\esHF0D7KPMui4M0wxfpyG866L26xK0.xml" /tn "Windows Local Network Service"
- '<SYSTEM32>\xcopy.exe' /s /y /k /f "%APPDATA%\Windows Defender\Windows Local Network Service.bat" "%HOMEPATH%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
