Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'G~v(57103{' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'P#OG48091@' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'bjT,37647x' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'Ye(772154p' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '>R:o80922w' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '|+8U97251+' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '%W(740216!' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '/BtB74306H' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '^=EL26363{' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '4Goq17525T' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '1UR682380S' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'h!#-8044y' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '[h)r48721I' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '[f]X69518K' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'E#?i26283U' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'wl;u97304U' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '.D.H92989*' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'L2K715474?' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'R)M*14932%' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '=ky'8449[' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swupdsv.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'yr0T520117' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'xuP#90162Z' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '])?B29014b' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashavast.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashserv.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashdisp.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgUard.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe] 'Debugger' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 't^$j89770+' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] '<mzB28372x' = '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks the following features:
- System Restore (SR)
- User Account Control (UAC)
Creates and executes the following:
- '%APPDATA%\Microsoft\SystemCertificates\iexpoler.exe'
- '%APPDATA%\Microsoft\SystemCertificates\mht_251020.exe'
Executes the following:
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\<Virus name>.jpg
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Hides the following processes:
- %APPDATA%\Microsoft\SystemCertificates\mht_251020.exe
- %APPDATA%\Microsoft\SystemCertificates\iexpoler.exe
Modifies file system :
Creates the following files:
- %TEMP%\<Virus name>.jpg
- %APPDATA%\Microsoft\SystemCertificates\iexpoler.exe
- %APPDATA%\Microsoft\SystemCertificates\cduascduas1c298nc9samh9cda98cmj192jmcd989ascdascdascdasc.dciuashmd9hm1298mdc89mu98ad89asmuc98312u89cum98savmf8sdhm8vf7hm278mh312mhc7mha78scdas
- %APPDATA%\Microsoft\SystemCertificates\mht_251020.exe
- %PROGRAM_FILES%\Internet Explorer\ie8props.propdescsc
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Microsoft\SystemCertificates\iexpoler.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND49.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND45.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND43.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND42.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND4.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND39.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND49D.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND38.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND35.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND34.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND30.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND3.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND29.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND28.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND36.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND5.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND50.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND528.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND827.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND8.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND735.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND713.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND7.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND68.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND65.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND6.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND58.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND57.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND563.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND560.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND55.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND54.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND53.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND27.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND9.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND26.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND243.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND104.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND1.WAV.exe
- %PROGRAM_FILES%\Windows Media Player\npds.zip.exe
- %PROGRAM_FILES%\Windows Media Player\npdrmv2.zip.exe
- %PROGRAM_FILES%\NetMeeting\TestSnd.wav.exe
- %PROGRAM_FILES%\NetMeeting\Blip.wav.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND105.WAV.exe
- %PROGRAM_FILES%\Messenger\type.wav.exe
- %PROGRAM_FILES%\Messenger\newemail.wav.exe
- %PROGRAM_FILES%\Messenger\newalert.wav.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\notfound.wav.exe
- %PROGRAM_FILES%\Internet Explorer\ie8props.propdescsc
- %APPDATA%\Microsoft\SystemCertificates\mht_251020.exe
- %APPDATA%\Microsoft\SystemCertificates\cduascduas1c298nc9samh9cda98cmj192jmcd989ascdascdascdasc.dciuashmd9hm1298mdc89mu98ad89asmuc98312u89cum98savmf8sdhm8vf7hm278mh312mhc7mha78scdas
- %PROGRAM_FILES%\Messenger\online.wav.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND108.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND111.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND112.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND240.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND24.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND22.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND21.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND20.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND19.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND181.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND18.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND17.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND16.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND14.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND136.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND131.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND13.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND12.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND25.WAV.exe
- %PROGRAM_FILES%\Windows NT\Pinball\SOUND999.WAV.exe
Deletes the following files:
- <SYSTEM32>\Restore\MachineGuid.txt
Network activity:
Connects to:
- 'dh##.#ontexist.com':8080
UDP:
- DNS ASK dh##.#ontexist.com
Miscellaneous:
Searches for the following windows:
- ClassName: '18467-41' WindowName: '(null)'
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'