Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\skxyrpdme] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\bgojzplnw] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- %WINDIR%\tiplnwevf.exe wb
Executes the following:
- <SYSTEM32>\reg.exe delete HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
- <SYSTEM32>\reg.exe delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
- <SYSTEM32>\reg.exe delete HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
- <SYSTEM32>\sc.exe description skxyrpdme ╫╝▓╗╜Ё╚╦╥╡┴╧╤╣┤є╦√╥╗░б╙├╫╝╓╨┼╠╚ч╥к╓╨╣ў╝╙╗·║¤╢╖╨╨╔│╗·╔·╨б═э╥╢═╢╔·╖╢╛═╚▌╔¤╣·
- <SYSTEM32>\sc.exe create skxyrpdme BinPath= "<SYSTEM32>\skxyrpdme.exe rbxgnbtt" type= own type= interact start= auto DisplayName= exirpmo
- <SYSTEM32>\sc.exe create bgojzplnw BinPath= "%WINDIR%\bgojzplnw.exe vonpykwpvm" type= own type= interact start= auto DisplayName= dgrvtgn
- <SYSTEM32>\cmd.exe /c %WINDIR%\fpvnay.BAT
- <SYSTEM32>\sc.exe description bgojzplnw ▓╗╡╓╕ш╙ы╠с║л░ь╠х╥╗│б╗╢╡╚┐╔╕╓╙ы└√
- <SYSTEM32>\reg.exe delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
- <SYSTEM32>\reg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
Modifies file system :
Creates the following files:
- %WINDIR%\fpvnay.BAT
- %WINDIR%\tiplnwevf.exe
- %WINDIR%\bgojzplnw.exe
- <SYSTEM32>\skxyrpdme.exe
Sets the 'hidden' attribute to the following files:
- <Full path to virus>
Deletes the following files:
- %WINDIR%\Media\Windows XP Menu Command.wav
- %WINDIR%\Media\Windows XP Logon Sound.wav
- %WINDIR%\Media\Windows XP Notify.wav
- %WINDIR%\Media\Windows XP Minimize.wav
- %WINDIR%\Media\Windows XP Logoff Sound.wav
- %WINDIR%\Media\Windows XP Hardware Insert.wav
- %WINDIR%\Media\Windows XP Hardware Fail.wav
- %WINDIR%\Media\Windows XP Information Bar.wav
- %WINDIR%\Media\Windows XP Hardware Remove.wav
- %WINDIR%\Media\Windows XP Pop-up Blocked.wav
- %WINDIR%\Media\Windows XP Start.wav
- %WINDIR%\Media\Windows XP Shutdown.wav
- %WINDIR%\tiplnwevf.exe
- %WINDIR%\Media\Windows XP Startup.wav
- %WINDIR%\Media\Windows XP Ringout.wav
- %WINDIR%\Media\Windows XP Recycle.wav
- %WINDIR%\Media\Windows XP Print complete.wav
- %WINDIR%\Media\Windows XP Ringin.wav
- %WINDIR%\Media\Windows XP Restore.wav
- %WINDIR%\Media\Windows XP Exclamation.wav
- %WINDIR%\Media\recycle.wav
- %WINDIR%\Media\onestop.mid
- %WINDIR%\Media\ringout.wav
- %WINDIR%\Media\ringin.wav
- %WINDIR%\Media\notify.wav
- %WINDIR%\Media\chord.wav
- %WINDIR%\Media\chimes.wav
- %WINDIR%\Media\flourish.mid
- %WINDIR%\Media\ding.wav
- %WINDIR%\Media\start.wav
- %WINDIR%\Media\Windows XP Default.wav
- %WINDIR%\Media\Windows XP Critical Stop.wav
- %WINDIR%\Media\Windows XP Error.wav
- %WINDIR%\Media\Windows XP Ding.wav
- %WINDIR%\Media\Windows XP Battery Low.wav
- %WINDIR%\Media\town.mid
- %WINDIR%\Media\tada.wav
- %WINDIR%\Media\Windows XP Battery Critical.wav
- %WINDIR%\Media\Windows XP Balloon.wav
Network activity:
Connects to:
- '58.#9.58.27':443
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'YXBDWHARNPCBLAN' WindowName: 'klgdhjdsfoselkf'
