Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\prvdisk] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\ianoSvrup] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%CommonProgramFiles%\Intel\ianotife.exe'
- '%TEMP%\nse2.tmp\ns6.tmp' sc create prvdisk binpath= <SYSTEM32>\PrvMon\prvdisk.sys type= kernel start= system group= Base tag= yes
- '%TEMP%\nse2.tmp\ns5.tmp' sc start ianoSvrup
- '%TEMP%\nse2.tmp\ns3.tmp' sc create ianoSvrup binpath= "%CommonProgramFiles%\Intel\ianotife.exe" type= share start= auto displayname= "Ianno Web Cache Services"
- '%TEMP%\nse2.tmp\ns4.tmp' sc description ianoSvrup "К№УГIanno Web CahceјјКхМṩЅшРР»ҐБЄНшдЇААФ¤¶БјУЛЩ·юОсЎЈИз№ыНЈЦ№ёГ·юОсЈ¬ФтјЖЛг»ъЅ«І»ѕЯ±ёХвР©јјКхМṩµДјУЛЩ№¦ДЬЎЈ"
Executes the following:
- '<SYSTEM32>\sc.exe' create prvdisk binpath= <SYSTEM32>\PrvMon\prvdisk.sys type= kernel start= system group= Base tag= yes
- '<SYSTEM32>\wscript.exe' "%CommonProgramFiles%\Intel\note.vbs"
- '<SYSTEM32>\sc.exe' start ianoSvrup
- '<SYSTEM32>\sc.exe' create ianoSvrup binpath= "%CommonProgramFiles%\Intel\ianotife.exe" type= share start= auto displayname= "Ianno Web Cache Services"
- '<SYSTEM32>\sc.exe' description ianoSvrup "К№УГIanno Web CahceјјКхМṩЅшРР»ҐБЄНшдЇААФ¤¶БјУЛЩ·юОсЎЈИз№ыНЈЦ№ёГ·юОсЈ¬ФтјЖЛг»ъЅ«І»ѕЯ±ёХвР©јјКхМṩµДјУЛЩ№¦ДЬЎЈ"
Modifies file system :
Creates the following files:
- %TEMP%\nse2.tmp\ns5.tmp
- %CommonProgramFiles%\Intel\pro.txt
- %TEMP%\nse2.tmp\ns4.tmp
- %TEMP%\nse2.tmp\nsExec.dll
- %TEMP%\nse2.tmp\ns3.tmp
- %WINDIR%\tudouva.pac
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\ol[1].asp
- %CommonProgramFiles%\Intel\suject.db-journal
- %CommonProgramFiles%\Intel\note.vbs
- <SYSTEM32>\PrvMon\prvdisk.sys
- %TEMP%\nse2.tmp\ns6.tmp
- %CommonProgramFiles%\Intel\vison.txt
- %CommonProgramFiles%\Intel\ianotife.exe
- %CommonProgramFiles%\Intel\note.txt
- %CommonProgramFiles%\Intel\sqlite3.dll
- %CommonProgramFiles%\Intel\ypac.txt
- %CommonProgramFiles%\Intel\suject.db
- %TEMP%\nse2.tmp\AccessControl.dll
- %TEMP%\nse2.tmp\System.dll
- %CommonProgramFiles%\Intel\config-n.xml
- %CommonProgramFiles%\Intel\prvdisk.sys
- %CommonProgramFiles%\Intel\config-s.xml
Deletes the following files:
- %TEMP%\nse2.tmp\nsExec.dll
- %TEMP%\nse2.tmp\AccessControl.dll
- %TEMP%\nse2.tmp\System.dll
- %CommonProgramFiles%\Intel\suject.db-journal
- %CommonProgramFiles%\Intel\note.vbs
- %TEMP%\nse2.tmp\ns4.tmp
- %TEMP%\nse2.tmp\ns3.tmp
- %TEMP%\nse2.tmp\ns5.tmp
- %CommonProgramFiles%\Intel\prvdisk.sys
- %TEMP%\nse2.tmp\ns6.tmp
Network activity:
Connects to:
- 'tj.###mitogu.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- tj.###mitogu.com/wl.txt
- tj.###mitogu.com/ps.txt
- tj.###mitogu.com/ol.asp?c=####
UDP:
- DNS ASK tj.###mitogu.com
