Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\svchost] 'ImagePath' = '"%WINDIR%\Systеm32\svchost.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\svchost] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '<SYSTEM32>\msiexec.exe' /V
- 'C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\redgate.installerwizard.ui.exe' RG_I="Reflector Installer"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uou2244t.cmdline"
- '%WINDIR%\Systеm32\svchost.exe' -install
- '%TEMP%\is-L7M51.tmp\<File name>.tmp' /SL5="$30092,21454650,259072,<Full path to file>"
- '%WINDIR%\Systеm32\svchost.exe'
- '%TEMP%\is-M3H2O.tmp\NET Reflector\ReflectorInstaller Backup.exe'
Modifies file system:
Creates the following files:
- %TEMP%\CSC1.tmp
- %TEMP%\uou2244t.out
- %TEMP%\uou2244t.dll
- %TEMP%\RES2.tmp
- %TEMP%\uou2244t.cmdline
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\empty.msi
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\redgate.installerwizard.ui.exe
- %TEMP%\uou2244t.0.cs
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\install.bin
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\Microsoft Data Access Components (MDAC) 2.8.prq.~1
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\.NET Reflector Visual Studio_8.0.2.313_x86_r226499.wixpdb.~1
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\Local\Visual Studio.ess.~1
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\Local\Gallery.ess.~1
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\.NET Reflector Visual Studio_8.0.2.313_x86_r226499.msi.~1
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\install.data
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\Log 1 .txt
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Desktop_8.0.2.313_x86_r226499\.NET Reflector Desktop_8.0.2.313_x86_r226499.wixpdb.~1
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Desktop_8.0.2.313_x86_r226499\.NET Reflector Desktop_8.0.2.313_x86_r226499.msi.~1
- %WINDIR%\Systеm32\svchost.InstallLog
- %TEMP%\is-M3H2O.tmp\NET Reflector\is-N1KQV.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
- %WINDIR%\Systеm32\svchost.InstallState
- %TEMP%\is-M3H2O.tmp\NET Reflector\is-QBR6J.tmp
- %WINDIR%\Systеm32\is-PSVGK.tmp
- %TEMP%\is-L7M51.tmp\<File name>.tmp
- %TEMP%\is-M3H2O.tmp\NET Reflector\is-F93FV.tmp
- %TEMP%\is-M3H2O.tmp\NET Reflector\is-OCKAA.tmp
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\redgate.compressengine.dll
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\sqltoolbeltinstaller.project
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\redgate.installerwizard.ui.exe.config
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\redgate.installerwizard.engine.dll
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\projectitems.xml
- C:\Documents and Settings\LocalService\Application Data\MS\settings.s
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\0797C381B2F87EB5A1D5573BD15BA4F4
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\0797C381B2F87EB5A1D5573BD15BA4F4
Sets the 'hidden' attribute to the following files:
- %WINDIR%\Systеm32\svchost.exe
Deletes the following files:
- %TEMP%\uou2244t.cmdline
- %TEMP%\uou2244t.dll
- C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\install.data
- %TEMP%\uou2244t.0.cs
- %TEMP%\RES2.tmp
- %TEMP%\is-M3H2O.tmp\NET Reflector\ReflectorInstaller Backup.exe
- %TEMP%\uou2244t.out
- %TEMP%\CSC1.tmp
Moves the following files:
- from C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\.NET Reflector Visual Studio_8.0.2.313_x86_r226499.wixpdb.~1 to C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\.NET Reflector Visual Studio_8.0.2.313_x86_r226499.wixpdb
- from C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\.NET Reflector Visual Studio_8.0.2.313_x86_r226499.msi.~1 to C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\.NET Reflector Visual Studio_8.0.2.313_x86_r226499.msi
- from C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\Microsoft Data Access Components (MDAC) 2.8.prq.~1 to C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\Microsoft Data Access Components (MDAC) 2.8.prq
- from C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\Local\Visual Studio.ess.~1 to C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\Local\Visual Studio.ess
- from C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\Local\Gallery.ess.~1 to C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Visual Studio_8.0.2.313_x86_r226499\Local\Gallery.ess
- from C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Desktop_8.0.2.313_x86_r226499\.NET Reflector Desktop_8.0.2.313_x86_r226499.wixpdb.~1 to C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Desktop_8.0.2.313_x86_r226499\.NET Reflector Desktop_8.0.2.313_x86_r226499.wixpdb
- from %TEMP%\is-M3H2O.tmp\NET Reflector\is-OCKAA.tmp to %TEMP%\is-M3H2O.tmp\NET Reflector\readme.txt
- from %WINDIR%\Systеm32\is-PSVGK.tmp to %WINDIR%\Systеm32\svchost.exe
- from %TEMP%\is-M3H2O.tmp\NET Reflector\is-F93FV.tmp to %TEMP%\is-M3H2O.tmp\NET Reflector\RedGate Products Multi Keygen.rar
- from C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Desktop_8.0.2.313_x86_r226499\.NET Reflector Desktop_8.0.2.313_x86_r226499.msi.~1 to C:\{29982B66-08A9-4A5F-A0EE-464046A1D82C}\.NET Reflector Desktop_8.0.2.313_x86_r226499\.NET Reflector Desktop_8.0.2.313_x86_r226499.msi
- from %TEMP%\is-M3H2O.tmp\NET Reflector\is-QBR6J.tmp to %TEMP%\is-M3H2O.tmp\NET Reflector\ReflectorInstaller Backup.exe
Network activity:
Connects to:
- 'cs#######-2-crl.verisign.com':80
- 'so###eforge.net':443
- 'wp#d':80
- 'crl.verisign.com':80
TCP:
HTTP GET requests:
- http://cs#######-2-crl.verisign.com/CSC3-2009-2.crl
- http://crl.verisign.com/pca3.crl
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK cs#######-2-crl.verisign.com
- DNS ASK so###eforge.net
- DNS ASK wp#d
- DNS ASK crl.verisign.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
