Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'DrefIW' = '<SYSTEM32>\SysDrefIWv2.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DrefIW' = '<SYSTEM32>\SysDrefIWv2.exe'
Malicious functions:
Executes the following:
- '<SYSTEM32>\ntvdm.exe' -f -i1
Terminates or attempts to terminate
the following user processes:
- fsavgui.exe
- AVPM.EXE
- AVPCC.EXE
- ZONEALARM.EXE
- nod32.exe
- NAVAPW32.EXE
- AVGCTRL.EXE
- AVGCC32.EXE
- avgcc.exe
- AVP32.EXE
- AVP.EXE
- AVP.COM
Modifies file system :
Creates the following files:
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
- %TEMP%\c05L0uk.tmp
- <SYSTEM32>\SysDrefIWv2.exe
- %WINDIR%\vlg.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\SysDrefIWv2.exe
Deletes the following files:
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
- %TEMP%\c05L0uk.tmp
Network activity:
Connects to:
- 'eu.##dernet.org':6667
- 'ir#.##akenet.org':6667
- 'ir#.#izon.net':6667
- '74.##5.232.51':80
- 'ir#.#fnet.net':6667
- 'ir#.dal.net':6667
UDP:
- DNS ASK ir#.##.ircnet.net
- DNS ASK ir#.#izon.net
- DNS ASK ir#.#rcnet.ee
- DNS ASK us.##dernet.org
- DNS ASK ir#.##akenet.org
- DNS ASK ir#.#fnet.net
- DNS ASK www.google.com
- DNS ASK eu.##dernet.org
- DNS ASK ir#.dal.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b6c.b70.380001'
- ClassName: '(null)' WindowName: 'Registry Editor'
- ClassName: 'Indicator' WindowName: '(null)'
