Win32.HLLC.Asdas.19

Win32.HLLC.Asdas.19

Added to the Dr.Web virus database: 2010-10-07

Virus description added: 2012-11-04

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] 'RemovableStorage' = '{fc349cf9-d6d2-4753-bfc0-63604db05b79}'

Modifies master boot record (MBR).

Malicious functions:

Creates and executes the following:

Executes the following:

<SYSTEM32>\regsvr32.exe /s "%TEMP%\windll.dll"
<SYSTEM32>\ping.exe 192.192.192.192 -n 1 -w 5000
<SYSTEM32>\cmd.exe /C ""%TEMP%\vji3.cmd" "%TEMP%\ftp-password-recovery-master-1.36.exe""

Searches for windows to

detect analytical utilities:

Modifies file system :

Creates the following files:

%TEMP%\windll.dll
%PROGRAM_FILES%\158234.dat
%TEMP%\smss.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\banner2[1].php
%CommonProgramFiles%\Removable\RemovableStorage.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\banner3[1].php
%TEMP%\vji3.cmd
%TEMP%\nsm2.tmp\NSISdl.dll
%TEMP%\ftp-password-recovery-master-1.36.exe
%PROGRAM_FILES%\138000.dat
%TEMP%\ftp-password-recovery-master-1.36.log
%TEMP%\loader.exe

Deletes the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\banner3[1].php
%TEMP%\nsm2.tmp\NSISdl.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\banner2[1].php
%TEMP%\vji3.cmd
%PROGRAM_FILES%\138000.dat
%TEMP%\ftp-password-recovery-master-1.36.exe
%TEMP%\windll.dll
%PROGRAM_FILES%\158234.dat

Network activity:

Connects to:

TCP:

HTTP GET requests:

www.we####rtalkz.com/banner2.php?q=############################################################################################
www.we####rtalkz.com/banner3.php?q=##############################################################################################
cu####tversion.biz/windows/version.php?ve###########################################

UDP:

Miscellaneous:

Searches for the following windows: