Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\usbhelp.exe
Malicious functions:
Creates and executes the following:
- '%TEMP%\57812.exe'
- '%TEMP%\24175.exe'
- '%TEMP%\36187.exe'
- '%TEMP%\82180.exe'
- '%TEMP%\56133.exe'
- '%TEMP%\34041.exe'
- '%TEMP%\74654.exe'
- '%TEMP%\73562.exe'
- '%TEMP%\86745.exe'
- '%TEMP%\68304.exe'
- '%TEMP%\86242.exe'
- '%TEMP%\7772.exe'
- '%TEMP%\50768.exe'
- '%TEMP%\32207.exe'
- '%TEMP%\76787.exe'
- '%TEMP%\74654.exe' (downloaded from the Internet)
- '%TEMP%\86242.exe' (downloaded from the Internet)
- '%TEMP%\68304.exe' (downloaded from the Internet)
- '%TEMP%\34041.exe' (downloaded from the Internet)
- '%TEMP%\76787.exe' (downloaded from the Internet)
- '%TEMP%\73562.exe' (downloaded from the Internet)
- '%TEMP%\86745.exe' (downloaded from the Internet)
- '%TEMP%\56133.exe' (downloaded from the Internet)
- '%TEMP%\7772.exe' (downloaded from the Internet)
- '%TEMP%\50768.exe' (downloaded from the Internet)
- '%TEMP%\82180.exe' (downloaded from the Internet)
- '%TEMP%\32207.exe' (downloaded from the Internet)
- '%TEMP%\24175.exe' (downloaded from the Internet)
- '%TEMP%\36187.exe' (downloaded from the Internet)
- '%TEMP%\57812.exe' (downloaded from the Internet)
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %TEMP%\24175.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\11[1].ico
- %TEMP%\86745.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\10[1].ico
- %TEMP%\36187.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\9[1].ico
- %TEMP%\57812.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\12[1].ico
- %TEMP%\34041.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\15[1].ico
- %TEMP%\74654.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\14[1].ico
- %TEMP%\68304.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\13[1].ico
- %TEMP%\73562.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\8[1].ico
- %TEMP%\86242.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\3[1].ico
- %TEMP%\32207.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\2[1].ico
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\usb[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1[1].ico
- %TEMP%\76787.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\4[1].ico
- %TEMP%\82180.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\7[1].ico
- %TEMP%\56133.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\6[1].ico
- %TEMP%\7772.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\5[1].ico
- %TEMP%\50768.exe
Network activity:
Connects to:
- 'ma####rents.info':80
TCP:
HTTP GET requests:
- ma####rents.info/payloads/10.ico
- ma####rents.info/payloads/11.ico
- ma####rents.info/payloads/8.ico
- ma####rents.info/payloads/9.ico
- ma####rents.info/payloads/14.ico
- ma####rents.info/payloads/15.ico
- ma####rents.info/payloads/12.ico
- ma####rents.info/payloads/13.ico
- ma####rents.info/payloads/2.ico
- ma####rents.info/payloads/3.ico
- ma####rents.info/usb.php?ms#########################
- ma####rents.info/payloads/1.ico
- ma####rents.info/payloads/6.ico
- ma####rents.info/payloads/7.ico
- ma####rents.info/payloads/4.ico
- ma####rents.info/payloads/5.ico
UDP:
- DNS ASK ma####rents.info