Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\msliksurserv] 'start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\msliksurserv.sys] 'ImagePath' = 'globalroot<DRIVERS>\msliksurserv.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\msliksurserv.sys] 'Start' = '00000001'
Malicious functions:
Creates and executes the following:
- '%TEMP%\is-70CRR.tmp\setup.exe'
- '%TEMP%\is-UDBG0.tmp\<Virus name>.tmp' /SL5="$30092,53248,53248,<Full path to virus>"
Executes the following:
- '<SYSTEM32>\msiexec.exe' /V
Modifies file system :
Creates the following files:
- %TEMP%\FR243532.tmp
- <DRIVERS>\msliksurserv.sys
- %TEMP%\is-70CRR.tmp\setup.exe
- %TEMP%\tmp2.tmp
- %TEMP%\tmp1.tmp
- <SYSTEM32>\msliksurcredo.dll
- %TEMP%\is-70CRR.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-UDBG0.tmp\<Virus name>.tmp
- %TEMP%\is-70CRR.tmp\_isetup\_shfoldr.dll
- <SYSTEM32>\msliksurdns.dll
- %TEMP%\is-70CRR.tmp\_isetup\_iscrypt.dll
Moves the following files:
- from %TEMP%\is-70CRR.tmp\setup.exe to %WINDIR%\Temp\tmp3.tmp
Network activity:
UDP:
- DNS ASK bq###ggfec.com
- DNS ASK fm###lefvt.com
- DNS ASK jt###kjsli.com
- DNS ASK an###chjrl.com
- DNS ASK tj###yoees.com
- DNS ASK zb###estdt.com
- DNS ASK tb###wweai.com
- DNS ASK tu###brmrg.com
- DNS ASK sq###jxnsr.com
- DNS ASK hb###ymlwd.com
- DNS ASK ny###leulj.com
- DNS ASK iy###qhxdm.com
- DNS ASK oi###mzttr.com
- DNS ASK fn###gtucr.com
- DNS ASK at###rizgz.com
- DNS ASK dn###pglum.com
- DNS ASK nx###yydbf.com
- DNS ASK wi###ughll.com
- DNS ASK xl###iwzxy.com
- DNS ASK an###ltmxo.com
- DNS ASK ok###rrynk.com
- DNS ASK rg###qiylp.com
- DNS ASK yq###hzhgq.com
- DNS ASK jd###ynnkx.com
- DNS ASK zm###kuybp.com
- DNS ASK qy###zwcxo.com
- DNS ASK qv###zuaca.com
- DNS ASK ng###rcits.com
- DNS ASK dg###wvftf.com
- DNS ASK wz###yxkrt.com
- DNS ASK mw###ogqmh.com
- DNS ASK wq###xagij.com
- DNS ASK rc###dclvu.com
- DNS ASK pf###jmiup.com
- DNS ASK da###qwiwx.com
- DNS ASK tw###lfngx.com
- DNS ASK ct###tdvfw.com
- DNS ASK vt###klxmc.com
- DNS ASK lx###nfqoz.com
- DNS ASK br###wtwnh.com
- DNS ASK du###cgoiq.com
- DNS ASK pm###tsrmk.com
- DNS ASK kz###lijva.com
- DNS ASK rp###cekmx.com
- DNS ASK rk###hvgci.com
- DNS ASK fy###aemtx.com
- DNS ASK dw###fafsy.com
- DNS ASK kk###xofbz.com
- DNS ASK yb###qqnrz.com
- DNS ASK xm###kaqai.com
- DNS ASK www.microsoft.com
- DNS ASK op###vnedr.com
- DNS ASK qk###wxekl.com
- DNS ASK gd###bifxa.com
- DNS ASK yh###xnibk.com
- DNS ASK xl###gyfck.com
- DNS ASK fj###jtppk.com
- DNS ASK ba###ypqdi.com
- DNS ASK ei###isptb.com
- DNS ASK yz###ylvec.com
- DNS ASK lg###wjcoi.com
- DNS ASK fb###joqut.com
- DNS ASK sw###cftqr.com
- DNS ASK od###jtjkz.com
- DNS ASK fh###siiry.com
- DNS ASK be###liefk.com
- DNS ASK cx###gxbii.com
- DNS ASK xi###xxoix.com
- DNS ASK ij###dvhjr.com
- DNS ASK sw###cwmdy.com
- DNS ASK za###dlyqg.com
- DNS ASK vp###hnxra.com
- DNS ASK ew###kwqrj.com
- DNS ASK fy###ltity.com
- DNS ASK kr###jqhga.com
- DNS ASK xu###qvnol.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'