Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtbuis.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemluiri.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdccvs.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembujpw.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemucofj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemcmcwg.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrloym.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemnzfcr.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkxxgj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemkkwqz.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqqbdn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemsybho.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqausl.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemdzvyf.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemhnhnn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemozqeb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqempoqux.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxckqn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqnewc.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemamcic.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzvsre.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtstif.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemvvetj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemaqvyj.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtsizb.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrccve.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemgoktn.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqememdjr.exe'
Malicious functions:
Creates and executes the following:
- '%TEMP%\Sysqembujpw.exe'
- '%TEMP%\Sysqemtbuis.exe'
- '%TEMP%\Sysqemluiri.exe'
- '%TEMP%\Sysqemucofj.exe'
- '%TEMP%\Sysqemcmcwg.exe'
- '%TEMP%\Sysqemrloym.exe'
- '%TEMP%\Sysqemdccvs.exe'
- '%TEMP%\Sysqemqqbdn.exe'
- '%TEMP%\Sysqemnzfcr.exe'
- '%TEMP%\Sysqemkxxgj.exe'
- '%TEMP%\Sysqemsybho.exe'
- '%TEMP%\Sysqemqausl.exe'
- '%TEMP%\Sysqemdzvyf.exe'
- '%TEMP%\Sysqemaqvyj.exe'
- '%TEMP%\Sysqemxckqn.exe'
- '%TEMP%\Sysqemhnhnn.exe'
- '%TEMP%\Sysqemozqeb.exe'
- '%TEMP%\Sysqemqnewc.exe'
- '%TEMP%\Sysqemamcic.exe'
- '%TEMP%\Sysqemzvsre.exe'
- '%TEMP%\Sysqempoqux.exe'
- '%TEMP%\Sysqemtsizb.exe'
- '%TEMP%\Sysqemtstif.exe'
- '%TEMP%\Sysqemvvetj.exe'
- '%TEMP%\Sysqemrccve.exe'
- '%TEMP%\Sysqemgoktn.exe'
- '%TEMP%\Sysqememdjr.exe'
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Modifies file system :
Creates the following files:
- %TEMP%\Sysqembujpw.exe
- %TEMP%\Sysqemtbuis.exe
- %TEMP%\Sysqemluiri.exe
- %TEMP%\Sysqemrloym.exe
- %TEMP%\Sysqemaqvyj.exe
- %TEMP%\Sysqemucofj.exe
- %TEMP%\Sysqemcmcwg.exe
- %TEMP%\Sysqemdccvs.exe
- %TEMP%\Sysqemnzfcr.exe
- %TEMP%\Sysqemkxxgj.exe
- %TEMP%\Sysqemkkwqz.exe
- %TEMP%\Sysqemqqbdn.exe
- %TEMP%\Sysqemsybho.exe
- %TEMP%\Sysqemqausl.exe
- %TEMP%\Sysqemdzvyf.exe
- %TEMP%\Sysqemzvsre.exe
- %TEMP%\Sysqemxckqn.exe
- %TEMP%\Sysqemhnhnn.exe
- %TEMP%\Sysqemamcic.exe
- %TEMP%\qpath.ini
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\Sysqemqnewc.exe
- %TEMP%\Sysqemozqeb.exe
- %TEMP%\Sysqemtsizb.exe
- %TEMP%\Sysqemtstif.exe
- %TEMP%\Sysqemvvetj.exe
- %TEMP%\Sysqememdjr.exe
- %TEMP%\Sysqempoqux.exe
- %TEMP%\Sysqemrccve.exe
- %TEMP%\Sysqemgoktn.exe
Sets the 'hidden' attribute to the following files:
- %TEMP%\Sysqemtbuis.exe
- %TEMP%\Sysqemluiri.exe
- %TEMP%\Sysqemdccvs.exe
- %TEMP%\Sysqembujpw.exe
- %TEMP%\Sysqemucofj.exe
- %TEMP%\Sysqemcmcwg.exe
- %TEMP%\Sysqemrloym.exe
- %TEMP%\Sysqemnzfcr.exe
- %TEMP%\Sysqemkxxgj.exe
- %TEMP%\Sysqemkkwqz.exe
- %TEMP%\Sysqemqqbdn.exe
- %TEMP%\Sysqemsybho.exe
- %TEMP%\Sysqemqausl.exe
- %TEMP%\Sysqemdzvyf.exe
- %TEMP%\Sysqemaqvyj.exe
- %TEMP%\Sysqemxckqn.exe
- %TEMP%\Sysqemhnhnn.exe
- %TEMP%\Sysqemozqeb.exe
- %TEMP%\Sysqemzvsre.exe
- %TEMP%\Sysqemqnewc.exe
- %TEMP%\Sysqamqqvaqqd.exe
- %TEMP%\Sysqemamcic.exe
- %TEMP%\Sysqemtsizb.exe
- %TEMP%\Sysqemtstif.exe
- %TEMP%\Sysqemvvetj.exe
- %TEMP%\Sysqememdjr.exe
- %TEMP%\Sysqempoqux.exe
- %TEMP%\Sysqemrccve.exe
- %TEMP%\Sysqemgoktn.exe