Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\regsvr32.exe' Legend.dll -s
- '<SYSTEM32>\hostname.exe'
Injects code into
the following system processes:
- <SYSTEM32>\hostname.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- <Current directory>\ёЅјю\hh\ЙъІъЙМВЮЅЬ.bmp
- <Current directory>\ёЅјю\hh\·иЕЈВі°Ј¶ы.bmp
- <Current directory>\ёЅјю\hh\ЙсјэКЦВ¶µВГЧА(°ўАµВ).bmp
- <Current directory>\ёЅјю\hh\Фу¶ЎЎ¤К©ДОµВ.bmp
- <Current directory>\ёЅјю\hh\Б¶ЅрКхК¦Д¦ёщ.bmp
- <Current directory>\ёЅјю\hh\°®ЙЇ.bmp
- <Current directory>\ёЅјю\hh\ЛШа«Ў¤°ўЛ№їЁ.bmp
- <Current directory>\ёЅјю\hh\ЛчОчСЕ.bmp
- <Current directory>\ёЅјю\hh\ЦХИХЦ®Г·ГЧМШ.bmp
- <Current directory>\ёЅјю\hh\Ѕы±Х.bmp
- <Current directory>\ёЅјю\hh\ёЈЕЦЕЦ.bmp
- <Current directory>\ёЅјю\hh\ГЧДЪМШ.bmp
- <Current directory>\ёЅјю\hh\ЙіУ°±ґАыМШ.bmp
- <Current directory>\ёЅјю\hh\ІјёжАё.bmp
- <Current directory>\ёЅјю\hh\ГфМ©.bmp
- <Current directory>\ёЅјю\hh\РВКЦHPТ©јБ.bmp
- <Current directory>\ёЅјю\hh\РЎµШНј.bmp
- <Current directory>\ёЅјю\hh\РЎµЖБэ.bmp
- <Current directory>\ёЅјю\hh\°Н¶ыАЧДИ.bmp
- <Current directory>\ёЅјю\hh\Г·ж«Е®Нх.bmp
- <Current directory>\ёЅјю\hh\Г·¶ыОДЎ¤АпїЛМШ.bmp
- <Current directory>\ёЅјю\hh\ёиАјµЩЛ№Ў¤ёсАОчСЗ.bmp
- <Current directory>\ёЅјю\hh\РВКЦMPТ©јБ.bmp
- <Current directory>\ёЅјю\hh\ЖХНЁHPТ©јБ.bmp
- <Current directory>\ёЅјю\hh\ЖХНЁMPТ©јБ.bmp
- <Current directory>\ёЅјю\hh\°ў¶ыІ®МШЎ¤І®¶чЛ№М№.bmp
- <Current directory>\ёЅјю\hh\ЗаЦ®КШ»¤ХЯЛюДИ.bmp
- <Current directory>\ёЅјю\hh\·зХс.bmp
- <Current directory>\ёЅјю\hh\МъЅіЎ¤БЦДЙЛ№.bmp
- <Current directory>\ёЅјю\hh\МъЅіРЎМъЦщ.bmp
- <Current directory>\ёЅјю\hh\і¤АППДЖХВЧ.bmp
- <Current directory>\ёЅјю\hh\ВуЙЄЎ¤ДЄДЙєа.bmp
- C:\SchedLgU.txt
- %TEMP%\YOUA4.Map
- <Current directory>\ёЅјю\hh\ВнБХЎ¤»щПЈїЁ(МмЅз).bmp
- <Current directory>\ёЅјю\hh\ВнБХЎ¤»щПЈїЁ(°ўАµВ).bmp
- <Current directory>\ёЅјю\hh\ЖпКїВе°НєХ.bmp
- <Current directory>\ёЅјю\hh\УКјюB.bmp
- <Current directory>\ёЅјю\hh\°¬АцЛї.bmp
- <Current directory>\ёЅјю\hh\·¶ХЬАыЛ№.bmp
- <Current directory>\ёЅјю\hh\ЙЇАј.bmp
- <Current directory>\ёЅјю\hh\О¬¶ыЎ¤їЛВі.bmp
- <Current directory>\ёЅјю\hh\ГА№Ю.bmp
- <Current directory>\ёЅјю\hh\іфЛ®№µ№«ЦчЕБАцЛї.bmp
- <Current directory>\ёЅјю\hh\РБґп.bmp
- <Current directory>\ёЅјю\hh\ґпЬЅДЭ.bmp
- <Current directory>\ёЅјю\hh\УКјюA.bmp
- <Current directory>\ёЅјю\hh\РйИх.bmp
- <Current directory>\ёЅјю\hh\±ґВЧЎ¤І©ДЪёзМШ(МмЅз).bmp
- <Current directory>\ёЅјю\hh\ИьАцСЗЎ¤їЛВіГф.bmp
- <Current directory>\ёЅјю\hh\ДИЛюАтж«.bmp
- <Current directory>\ёЅјю\ЕдЦГ.ini
- <Current directory>\ёЅјю\hh\1.bmp
- <Current directory>\ёЅјю\hh\1.txt
- <Current directory>\ёЅјю\ТСБ¬ЅУ.ico
- <Current directory>\ёЅјю\ОґБ¬ЅУ.ico
- <Current directory>\ёЅјю\№эНј.ini
- <Current directory>\ёЅјю\hh\3.txt
- <Current directory>\ёЅјю\hh\4.bmp
- <Current directory>\ёЅјю\hh\4.txt
- <Current directory>\ёЅјю\hh\2.bmp
- <Current directory>\ёЅјю\hh\2.txt
- <Current directory>\ёЅјю\hh\3.bmp
- <Current directory>\ёЅјю\ЗшУт.ini
- <Current directory>\bin\ИООс.ini
- <Current directory>\bin\їнґш.txt
- <Current directory>\bin\ЧўІбВл.txt
- <Current directory>\ЙиЦГ№¤ѕЯ.exe
- <Current directory>\Ф¶¶ЛїШЦЖ.exe
- <Current directory>\bin\bin.ini
- <SYSTEM32>\damahou.dll
- <SYSTEM32>\Legend.dll
- <SYSTEM32>\validation.dll
- <Current directory>\bin\ОпЖ·.ini
- <Current directory>\bin\ґрМв.txt
- <Current directory>\bin\ј¶±р.ini
- <Current directory>\ёЅјю\hh\їЁА¤.bmp
- <Current directory>\ёЅјю\hh\їЁДЭДИ.bmp
- <Current directory>\ёЅјю\hh\НБ№Ю.bmp
- <Current directory>\ёЅјю\hh\ЅЈКҐОчб°.bmp
- <Current directory>\ёЅјю\hh\І©їП.bmp
- <Current directory>\ёЅјю\hh\ХјІ·К¦ПЈДЄДИ.bmp
- <Current directory>\ёЅјю\hh\ґуЛѕјА.bmp
- <Current directory>\ёЅјю\hh\°ВАјДМДМ.bmp
- <Current directory>\ёЅјю\hh\°В·ЖАыСЗЎ¤±ґТБАјЛ№.bmp
- <Current directory>\ёЅјю\hh\ПДВеїЛЎ¤ёкБЦµВ.bmp
- <Current directory>\ёЅјю\hh\НвЅ»К№ЅЪЕµУр(ЛШа«).bmp
- <Current directory>\ёЅјю\hh\НвЅ»К№ЅЪЕµУр(°ўАµВ).bmp
- <Current directory>\ёЅјю\hh\їАц.bmp
- <Current directory>\ёЅјю\hh\9.bmp
- <Current directory>\ёЅјю\hh\G.S.D.bmp
- <Current directory>\ёЅјю\hh\into.bmp
- <Current directory>\ёЅјю\hh\5.txt
- <Current directory>\ёЅјю\hh\6.txt
- <Current directory>\ёЅјю\hh\8.bmp
- <Current directory>\ёЅјю\hh\їЛВЧМШ.bmp
- <Current directory>\ёЅјю\hh\ИлГЕHPТ©јБ.bmp
- <Current directory>\ёЅјю\hh\ИлГЕMPТ©јБ.bmp
- <Current directory>\ёЅјю\hh\ЗЗ°ІЎ¤·САЧЕµ.bmp
- <Current directory>\ёЅјю\hh\СЗ±ґВЮ.bmp
- <Current directory>\ёЅјю\hh\ТБЙі¶ЕА.bmp
Deletes the following files:
- C:\SchedLgU.txt
Moves the following files:
- from %TEMP%\YOUA4.Map to %TEMP%\136578\...\TemporaryFile
Network activity:
Connects to:
- '3.##33.net':8088
- '7.##33.net':8088
- '5.##33.net':8088
- '8.##33.net':8088
- '4.##33.net':8088
- '6.##33.net':8088
- 'localhost':1036
- '9.##33.net':8088
- '1.##33.net':8088
- '2.##33.net':8088
UDP:
- DNS ASK 5.##33.net
- DNS ASK 3.##33.net
- DNS ASK 8.##33.net
- DNS ASK 4.##33.net
- DNS ASK 7.##33.net
- DNS ASK 9.##33.net
- DNS ASK 6.##33.net
- DNS ASK 1.##33.net
- DNS ASK 2.##33.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''