Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\dllcache\spoolsv.exe with <SYSTEM32>\dllcache\spoolsv.exe.new
- <SYSTEM32>\spoolsv.exe with <SYSTEM32>\spoolsv.exe.new
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\spoolsv.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1803' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'currentlevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
Modifies file system :
Creates the following files:
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\8PI70DM3\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YN7RD19E\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\UP6P0HKP\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\RJBUV52Y\desktop.ini
- %TEMP%\1.tmp
- %WINDIR%\Temp\2.tmp
Sets the 'hidden' attribute to the following files:
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YN7RD19E\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\UP6P0HKP\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\RJBUV52Y\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\8PI70DM3\desktop.ini
Deletes the following files:
- %WINDIR%\Temp\2.tmp
- %TEMP%\1.tmp
Moves the following system files:
- from <SYSTEM32>\spoolsv.exe to %WINDIR%\Temp\4.tmp
Moves the following files:
- from <SYSTEM32>\dllcache\spoolsv.exe.new to <SYSTEM32>\dllcache\spoolsv.exe
Moves itself:
- from <Full path to virus> to %TEMP%\3.tmp
Network activity:
Connects to:
- 'ru####kumoet.com':8080
- '4s##rs.com':80
TCP:
HTTP GET requests:
- 4s##rs.com/task/
UDP:
- DNS ASK ru####kumoet.com
- DNS ASK 4s##rs.com