Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\secinit.exe.lnk
Malicious functions
Launches a large number of processes
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %WINDIR%\syswow64\secioit.exe
- <Current directory>\updata.bat
- <Current directory>\76bie2.mir
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\secioit.exe
- <Current directory>\updata.bat
Deletes the following files
- <Current directory>\updata.bat
- <Current directory>\76bie2.mir
Substitutes the following files
- <Current directory>\updata.bat
Network activity
Connects to
- 'localhost':80
UDP
- DNS ASK ig.##anzu.com
- DNS ASK 8u#.com
Miscellaneous
Modifies value of AutoConfigURL parameter to 'http://ig.52anzu.com:8579/lua.rar'
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\secioit.exe'
- '<Current directory>\76bie2.mir'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c <Current directory>\updata.bat
- '%WINDIR%\syswow64\cmd.exe' /c icacls <DRIVERS>\etc /t /grant:r everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls <DRIVERS>\etc /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo y"
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc /g everyone:f
- '%WINDIR%\syswow64\icacls.exe' <DRIVERS>\etc /t /grant:r everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c netsh ipsec static delete all
- '%WINDIR%\syswow64\netsh.exe' ipsec static delete all
- '%WINDIR%\syswow64\cmd.exe' /c <Current directory>\updata.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls <DRIVERS>\etc /t /grant:r everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls <DRIVERS>\etc /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh ipsec static delete all' (with hidden window)
