Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'javaw' = '%APPDATA%\javaw.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'tbejv' = '%HOMEPATH%\tbejv\start.vbs'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Creates and executes the following:
- '%HOMEPATH%\tbejv\jrcy.exe' 1667284.BOP
- '%HOMEPATH%\tbejv\ShellChecker.exe'
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
- '<SYSTEM32>\wscript.exe' "%HOMEPATH%\tbejv\9782353.vbs"
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
Modifies file system :
Creates the following files:
- %HOMEPATH%\tbejv\83515.wao
- %HOMEPATH%\tbejv\82884.dws
- %HOMEPATH%\tbejv\94882.jbb
- %HOMEPATH%\tbejv\23305.dsz
- %HOMEPATH%\tbejv\8128.rnt
- %HOMEPATH%\tbejv\54551.dkl
- %HOMEPATH%\tbejv\73810.hpi
- %HOMEPATH%\tbejv\35937.ntv
- %HOMEPATH%\tbejv\48895.lhm
- %HOMEPATH%\tbejv\29315.ssw
- %HOMEPATH%\tbejv\12924.qwu
- %HOMEPATH%\tbejv\17471.oox
- %HOMEPATH%\tbejv\30028.omm
- %HOMEPATH%\tbejv\13898.kfi
- %HOMEPATH%\tbejv\48058.oiv
- %HOMEPATH%\tbejv\41715.erx
- %HOMEPATH%\tbejv\7577.nxj
- %HOMEPATH%\tbejv\18002.qib
- %HOMEPATH%\tbejv\59110.yyj
- %HOMEPATH%\tbejv\25899.nxt
- %HOMEPATH%\tbejv\37600.hro
- %HOMEPATH%\tbejv\63291.bup
- %HOMEPATH%\tbejv\16625.gak
- %HOMEPATH%\tbejv\29085.wvi
- %HOMEPATH%\tbejv\90716.txr
- %HOMEPATH%\tbejv\14617.ief
- %HOMEPATH%\tbejv\16093.axa
- %HOMEPATH%\tbejv\56043.qwn
- %HOMEPATH%\tbejv\45975.zpa
- %HOMEPATH%\tbejv\98591.pqi
- %HOMEPATH%\tbejv\48416.fog
- %HOMEPATH%\tbejv\20568.vew
- %HOMEPATH%\tbejv\81102.utq
- %HOMEPATH%\tbejv\46855.buo
- %HOMEPATH%\tbejv\22389.vih
- %HOMEPATH%\tbejv\1860.eki
- %HOMEPATH%\tbejv\74705.szq
- %HOMEPATH%\tbejv\8850.cap
- %HOMEPATH%\tbejv\26205.veu
- %HOMEPATH%\tbejv\77906.nbu
- %HOMEPATH%\tbejv\87349.ifx
- %HOMEPATH%\tbejv\24561.voa
- %HOMEPATH%\tbejv\9005.svf
- %HOMEPATH%\tbejv\67374.auz
- %HOMEPATH%\tbejv\5514.jkp
- %HOMEPATH%\tbejv\40036.rnm
- %HOMEPATH%\tbejv\24787.egt
- %HOMEPATH%\tbejv\7224.mdg
- %HOMEPATH%\tbejv\45114.dxl
- %HOMEPATH%\tbejv\12004.smy
- %HOMEPATH%\tbejv\1769.esu
- %HOMEPATH%\tbejv\11200.ook
- %HOMEPATH%\tbejv\40798.eio
- %HOMEPATH%\tbejv\67515.vlm
- %HOMEPATH%\tbejv\18818.gzt
- %HOMEPATH%\tbejv\94168.kog
- %HOMEPATH%\tbejv\9211.rxu
- %HOMEPATH%\tbejv\70989.dik
- %HOMEPATH%\tbejv\30448.iut
- %HOMEPATH%\tbejv\96505.ubl
- %HOMEPATH%\tbejv\51080.ggw
- %HOMEPATH%\tbejv\27009.rgt
- %HOMEPATH%\tbejv\39064.cyp
- %HOMEPATH%\tbejv\31864.fkk
- %HOMEPATH%\tbejv\2830.irn
- %HOMEPATH%\tbejv\37850.gpu
- %HOMEPATH%\tbejv\1158.vup
- %HOMEPATH%\tbejv\91592.kie
- %APPDATA%\javaw.exe
- %HOMEPATH%\tbejv\start.vbs
- %HOMEPATH%\tbejv\start.cmd
- %HOMEPATH%\tbejv\75073.pvl
- %HOMEPATH%\tbejv\95392.gnr
- %HOMEPATH%\tbejv\77874.lsa
- %HOMEPATH%\tbejv\5423.flv
- %HOMEPATH%\tbejv\46691.lxz
- %HOMEPATH%\tbejv\55379.pha
- %HOMEPATH%\tbejv\99252.rjp
- %HOMEPATH%\tbejv\96229.nec
- %HOMEPATH%\tbejv\83728.tjl
- %HOMEPATH%\tbejv\24288.gih
- %HOMEPATH%\tbejv\7904.dxo
- %HOMEPATH%\tbejv\56491.lse
- %HOMEPATH%\tbejv\7941.xng
- %HOMEPATH%\tbejv\46889.wvn
- %HOMEPATH%\tbejv\90892.bag
- %HOMEPATH%\tbejv\90178.ykx
- %HOMEPATH%\tbejv\82536.ucb
- %HOMEPATH%\tbejv\95122.zmf
- %HOMEPATH%\tbejv\69200.hly
- %HOMEPATH%\tbejv\88878.zwc
- %HOMEPATH%\tbejv\5408.leb
- %HOMEPATH%\tbejv\84246.nzi
- %HOMEPATH%\tbejv\75291.jco
- %HOMEPATH%\tbejv\84829.qvc
- %HOMEPATH%\tbejv\91099.zvu
- %HOMEPATH%\tbejv\13093.qpk
- %HOMEPATH%\tbejv\79466.lku
- %HOMEPATH%\tbejv\59748.bxp
- %HOMEPATH%\tbejv\50077.qpn
- %HOMEPATH%\tbejv\32463.hwf
- %HOMEPATH%\tbejv\68383.wsv
- %HOMEPATH%\tbejv\79533.tgo
- %HOMEPATH%\tbejv\73619.zba
- %HOMEPATH%\tbejv\23058.vyz
- %HOMEPATH%\tbejv\79078.yrk
- %HOMEPATH%\tbejv\10248.rfm
- %HOMEPATH%\tbejv\79064.dyk
- %HOMEPATH%\tbejv\63719.gmr
- %HOMEPATH%\tbejv\19001.opy
- %HOMEPATH%\tbejv\95285.gej
- %HOMEPATH%\tbejv\6121.gjh
- %HOMEPATH%\tbejv\37995.ebb
- %HOMEPATH%\tbejv\92557.rpt
- %HOMEPATH%\tbejv\73261.ryt
- %HOMEPATH%\tbejv\4666.hfv
- %HOMEPATH%\tbejv\19873.dyt
- %HOMEPATH%\tbejv\19656.gtb
- %HOMEPATH%\tbejv\78566.fbd
- %HOMEPATH%\tbejv\21342.zvo
- %HOMEPATH%\tbejv\27538.wnj
- %HOMEPATH%\tbejv\27230.mxd
- %HOMEPATH%\tbejv\51381.wsl
- %HOMEPATH%\tbejv\39601.ikv
- %HOMEPATH%\tbejv\17243.pkm
- %HOMEPATH%\tbejv\84739.xwz
- %HOMEPATH%\tbejv\64008.opn
- %HOMEPATH%\tbejv\50870.hjo
- %HOMEPATH%\tbejv\71085.dyl
- %HOMEPATH%\tbejv\45351.jmg
- %HOMEPATH%\tbejv\9726.arr
- %HOMEPATH%\tbejv\40024.cmp
- %HOMEPATH%\tbejv\46468.ict
- %HOMEPATH%\tbejv\37778.lbs
- %HOMEPATH%\tbejv\25678.xcz
- %HOMEPATH%\tbejv\85711.cda
- %HOMEPATH%\tbejv\28731.hib
- %HOMEPATH%\tbejv\5053.djy
- %HOMEPATH%\tbejv\9782353.vbs
- %HOMEPATH%\tbejv\jrcy.exe
- %HOMEPATH%\tbejv\44118.DRU
- %HOMEPATH%\tbejv\ShellChecker.exe
- %HOMEPATH%\tbejv\18770.FBU
- %HOMEPATH%\tbejv\1667284.BOP
- %HOMEPATH%\tbejv\26400.fzg
- %HOMEPATH%\tbejv\9535.mmm
- %HOMEPATH%\tbejv\96478.gqv
- %HOMEPATH%\tbejv\58907.tzx
- %HOMEPATH%\tbejv\64682.fls
- %HOMEPATH%\tbejv\23026.cua
- %HOMEPATH%\tbejv\59081.yjc
- %HOMEPATH%\tbejv\84309.tai
- %HOMEPATH%\tbejv\66034.hjo
- %HOMEPATH%\tbejv\94132.ivl
- %HOMEPATH%\tbejv\76991.paj
- %HOMEPATH%\tbejv\12396.oxi
- %HOMEPATH%\tbejv\57318.vnw
- %HOMEPATH%\tbejv\77132.fic
- %HOMEPATH%\tbejv\88057.pzj
- %HOMEPATH%\tbejv\30885.pxo
- %HOMEPATH%\tbejv\36305.vrq
- %HOMEPATH%\tbejv\25821.yge
- %HOMEPATH%\tbejv\51975.eii
- %HOMEPATH%\tbejv\58457.ide
- %HOMEPATH%\tbejv\63550.kig
- %HOMEPATH%\tbejv\80860.jyr
- %HOMEPATH%\tbejv\16618.njw
- %HOMEPATH%\tbejv\39091.icf
- %HOMEPATH%\tbejv\34809.pzc
- %HOMEPATH%\tbejv\57179.ncz
- %HOMEPATH%\tbejv\24143.qjq
- %HOMEPATH%\tbejv\29989.uny
- %HOMEPATH%\tbejv\62206.csv
- %HOMEPATH%\tbejv\68856.bpl
- %HOMEPATH%\tbejv\89939.gbs
- %HOMEPATH%\tbejv\98688.onh
- %HOMEPATH%\tbejv\93909.tqn
- %HOMEPATH%\tbejv\99846.mhm
- %HOMEPATH%\tbejv\8252.mvc
- %HOMEPATH%\tbejv\24393.lrh
- %HOMEPATH%\tbejv\32386.qbe
- %HOMEPATH%\tbejv\99430.gju
- %HOMEPATH%\tbejv\53787.nua
- %HOMEPATH%\tbejv\28089.frg
- %HOMEPATH%\tbejv\33481.wii
- %HOMEPATH%\tbejv\75489.dan
- %HOMEPATH%\tbejv\9569.ogo
- %HOMEPATH%\tbejv\37123.kkl
- %HOMEPATH%\tbejv\49020.raz
- %HOMEPATH%\tbejv\59397.uom
- %HOMEPATH%\tbejv\55908.nrt
- %HOMEPATH%\tbejv\15527.dxd
- %HOMEPATH%\tbejv\67489.kxh
- %HOMEPATH%\tbejv\42221.cgp
- %HOMEPATH%\tbejv\53046.cnh
- %HOMEPATH%\tbejv\67023.tav
- %HOMEPATH%\tbejv\32169.uij
- %HOMEPATH%\tbejv\26111.qou
- %HOMEPATH%\tbejv\82524.rqj
- %HOMEPATH%\tbejv\37047.wyf
- %HOMEPATH%\tbejv\87987.nhl
- %HOMEPATH%\tbejv\79948.fik
- %HOMEPATH%\tbejv\22133.gde
- %HOMEPATH%\tbejv\78798.upo
- %HOMEPATH%\tbejv\51923.lhi
- %HOMEPATH%\tbejv\78379.efo
- %HOMEPATH%\tbejv\38306.awg
- %HOMEPATH%\tbejv\21352.fiy
- %HOMEPATH%\tbejv\96628.xtn
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\tbejv\82884.dws
- %HOMEPATH%\tbejv\94882.jbb
- %HOMEPATH%\tbejv\73810.hpi
- %HOMEPATH%\tbejv\8128.rnt
- %HOMEPATH%\tbejv\54551.dkl
- %HOMEPATH%\tbejv\83515.wao
- %HOMEPATH%\tbejv\35937.ntv
- %HOMEPATH%\tbejv\48895.lhm
- %HOMEPATH%\tbejv\29315.ssw
- %HOMEPATH%\tbejv\12924.qwu
- %HOMEPATH%\tbejv\17471.oox
- %HOMEPATH%\tbejv\30028.omm
- %HOMEPATH%\tbejv\23305.dsz
- %HOMEPATH%\tbejv\48058.oiv
- %HOMEPATH%\tbejv\41715.erx
- %HOMEPATH%\tbejv\25899.nxt
- %HOMEPATH%\tbejv\18002.qib
- %HOMEPATH%\tbejv\59110.yyj
- %HOMEPATH%\tbejv\13898.kfi
- %HOMEPATH%\tbejv\37600.hro
- %HOMEPATH%\tbejv\63291.bup
- %HOMEPATH%\tbejv\16625.gak
- %HOMEPATH%\tbejv\29085.wvi
- %HOMEPATH%\tbejv\90716.txr
- %HOMEPATH%\tbejv\14617.ief
- %HOMEPATH%\tbejv\9005.svf
- %HOMEPATH%\tbejv\56043.qwn
- %HOMEPATH%\tbejv\45975.zpa
- %HOMEPATH%\tbejv\81102.utq
- %HOMEPATH%\tbejv\48416.fog
- %HOMEPATH%\tbejv\20568.vew
- %HOMEPATH%\tbejv\16093.axa
- %HOMEPATH%\tbejv\46855.buo
- %HOMEPATH%\tbejv\22389.vih
- %HOMEPATH%\tbejv\1860.eki
- %HOMEPATH%\tbejv\74705.szq
- %HOMEPATH%\tbejv\8850.cap
- %HOMEPATH%\tbejv\26205.veu
- %HOMEPATH%\tbejv\98591.pqi
- %HOMEPATH%\tbejv\87349.ifx
- %HOMEPATH%\tbejv\24561.voa
- %HOMEPATH%\tbejv\40036.rnm
- %HOMEPATH%\tbejv\67374.auz
- %HOMEPATH%\tbejv\5514.jkp
- %HOMEPATH%\tbejv\77906.nbu
- %HOMEPATH%\tbejv\24787.egt
- %HOMEPATH%\tbejv\7224.mdg
- %HOMEPATH%\tbejv\45114.dxl
- %HOMEPATH%\tbejv\12004.smy
- %HOMEPATH%\tbejv\1769.esu
- %HOMEPATH%\tbejv\11200.ook
- %HOMEPATH%\tbejv\7577.nxj
- %HOMEPATH%\tbejv\67515.vlm
- %HOMEPATH%\tbejv\18818.gzt
- %HOMEPATH%\tbejv\30448.iut
- %HOMEPATH%\tbejv\9211.rxu
- %HOMEPATH%\tbejv\70989.dik
- %HOMEPATH%\tbejv\40798.eio
- %HOMEPATH%\tbejv\96505.ubl
- %HOMEPATH%\tbejv\51080.ggw
- %HOMEPATH%\tbejv\27009.rgt
- %HOMEPATH%\tbejv\39064.cyp
- %HOMEPATH%\tbejv\31864.fkk
- %HOMEPATH%\tbejv\2830.irn
- %HOMEPATH%\tbejv\94168.kog
- %HOMEPATH%\tbejv\1158.vup
- %HOMEPATH%\tbejv\91592.kie
- %HOMEPATH%\tbejv\75073.pvl
- %HOMEPATH%\tbejv\start.cmd
- %HOMEPATH%\tbejv\start.vbs
- %HOMEPATH%\tbejv\37850.gpu
- %HOMEPATH%\tbejv\95392.gnr
- %HOMEPATH%\tbejv\77874.lsa
- %HOMEPATH%\tbejv\5423.flv
- %HOMEPATH%\tbejv\46691.lxz
- %HOMEPATH%\tbejv\55379.pha
- %HOMEPATH%\tbejv\99252.rjp
- %HOMEPATH%\tbejv\84829.qvc
- %HOMEPATH%\tbejv\83728.tjl
- %HOMEPATH%\tbejv\24288.gih
- %HOMEPATH%\tbejv\46889.wvn
- %HOMEPATH%\tbejv\56491.lse
- %HOMEPATH%\tbejv\7941.xng
- %HOMEPATH%\tbejv\96229.nec
- %HOMEPATH%\tbejv\90892.bag
- %HOMEPATH%\tbejv\90178.ykx
- %HOMEPATH%\tbejv\82536.ucb
- %HOMEPATH%\tbejv\95122.zmf
- %HOMEPATH%\tbejv\69200.hly
- %HOMEPATH%\tbejv\88878.zwc
- %HOMEPATH%\tbejv\7904.dxo
- %HOMEPATH%\tbejv\84246.nzi
- %HOMEPATH%\tbejv\75291.jco
- %HOMEPATH%\tbejv\79466.lku
- %HOMEPATH%\tbejv\91099.zvu
- %HOMEPATH%\tbejv\13093.qpk
- %HOMEPATH%\tbejv\5408.leb
- %HOMEPATH%\tbejv\59748.bxp
- %HOMEPATH%\tbejv\50077.qpn
- %HOMEPATH%\tbejv\32463.hwf
- %HOMEPATH%\tbejv\68383.wsv
- %HOMEPATH%\tbejv\79533.tgo
- %HOMEPATH%\tbejv\73619.zba
- %HOMEPATH%\tbejv\95285.gej
- %HOMEPATH%\tbejv\79078.yrk
- %HOMEPATH%\tbejv\10248.rfm
- %HOMEPATH%\tbejv\50870.hjo
- %HOMEPATH%\tbejv\63719.gmr
- %HOMEPATH%\tbejv\19001.opy
- %HOMEPATH%\tbejv\19873.dyt
- %HOMEPATH%\tbejv\19656.gtb
- %HOMEPATH%\tbejv\37995.ebb
- %HOMEPATH%\tbejv\79064.dyk
- %HOMEPATH%\tbejv\6121.gjh
- %HOMEPATH%\tbejv\4666.hfv
- %HOMEPATH%\tbejv\64008.opn
- %HOMEPATH%\tbejv\39601.ikv
- %HOMEPATH%\tbejv\78566.fbd
- %HOMEPATH%\tbejv\21342.zvo
- %HOMEPATH%\tbejv\67489.kxh
- %HOMEPATH%\tbejv\27230.mxd
- %HOMEPATH%\tbejv\51381.wsl
- %HOMEPATH%\tbejv\45351.jmg
- %HOMEPATH%\tbejv\9726.arr
- %HOMEPATH%\tbejv\84739.xwz
- %HOMEPATH%\tbejv\27538.wnj
- %HOMEPATH%\tbejv\17243.pkm
- %HOMEPATH%\tbejv\71085.dyl
- %HOMEPATH%\tbejv\92557.rpt
- %HOMEPATH%\tbejv\28731.hib
- %HOMEPATH%\tbejv\40024.cmp
- %HOMEPATH%\tbejv\46468.ict
- %HOMEPATH%\tbejv\94132.ivl
- %HOMEPATH%\tbejv\25678.xcz
- %HOMEPATH%\tbejv\85711.cda
- %HOMEPATH%\tbejv\9782353.vbs
- %HOMEPATH%\tbejv\jrcy.exe
- %HOMEPATH%\tbejv\44118.DRU
- %HOMEPATH%\tbejv\37778.lbs
- %HOMEPATH%\tbejv\5053.djy
- %HOMEPATH%\tbejv\1667284.BOP
- %HOMEPATH%\tbejv\66034.hjo
- %HOMEPATH%\tbejv\23026.cua
- %HOMEPATH%\tbejv\26400.fzg
- %HOMEPATH%\tbejv\9535.mmm
- %HOMEPATH%\tbejv\73261.ryt
- %HOMEPATH%\tbejv\58907.tzx
- %HOMEPATH%\tbejv\64682.fls
- %HOMEPATH%\tbejv\12396.oxi
- %HOMEPATH%\tbejv\57318.vnw
- %HOMEPATH%\tbejv\84309.tai
- %HOMEPATH%\tbejv\96478.gqv
- %HOMEPATH%\tbejv\59081.yjc
- %HOMEPATH%\tbejv\76991.paj
- %HOMEPATH%\tbejv\15527.dxd
- %HOMEPATH%\tbejv\51975.eii
- %HOMEPATH%\tbejv\77132.fic
- %HOMEPATH%\tbejv\88057.pzj
- %HOMEPATH%\tbejv\24393.lrh
- %HOMEPATH%\tbejv\36305.vrq
- %HOMEPATH%\tbejv\25821.yge
- %HOMEPATH%\tbejv\34809.pzc
- %HOMEPATH%\tbejv\57179.ncz
- %HOMEPATH%\tbejv\63550.kig
- %HOMEPATH%\tbejv\30885.pxo
- %HOMEPATH%\tbejv\58457.ide
- %HOMEPATH%\tbejv\39091.icf
- %HOMEPATH%\tbejv\8252.mvc
- %HOMEPATH%\tbejv\98688.onh
- %HOMEPATH%\tbejv\24143.qjq
- %HOMEPATH%\tbejv\29989.uny
- %HOMEPATH%\tbejv\23058.vyz
- %HOMEPATH%\tbejv\68856.bpl
- %HOMEPATH%\tbejv\89939.gbs
- %HOMEPATH%\tbejv\99430.gju
- %HOMEPATH%\tbejv\53787.nua
- %HOMEPATH%\tbejv\99846.mhm
- %HOMEPATH%\tbejv\62206.csv
- %HOMEPATH%\tbejv\93909.tqn
- %HOMEPATH%\tbejv\32386.qbe
- %HOMEPATH%\tbejv\80860.jyr
- %HOMEPATH%\tbejv\49020.raz
- %HOMEPATH%\tbejv\28089.frg
- %HOMEPATH%\tbejv\33481.wii
- %HOMEPATH%\tbejv\78379.efo
- %HOMEPATH%\tbejv\9569.ogo
- %HOMEPATH%\tbejv\37123.kkl
- %HOMEPATH%\tbejv\53046.cnh
- %HOMEPATH%\tbejv\67023.tav
- %HOMEPATH%\tbejv\55908.nrt
- %HOMEPATH%\tbejv\75489.dan
- %HOMEPATH%\tbejv\59397.uom
- %HOMEPATH%\tbejv\42221.cgp
- %HOMEPATH%\tbejv\51923.lhi
- %HOMEPATH%\tbejv\79948.fik
- %HOMEPATH%\tbejv\32169.uij
- %HOMEPATH%\tbejv\26111.qou
- %HOMEPATH%\tbejv\16618.njw
- %HOMEPATH%\tbejv\37047.wyf
- %HOMEPATH%\tbejv\87987.nhl
- %HOMEPATH%\tbejv\21352.fiy
- %HOMEPATH%\tbejv\96628.xtn
- %HOMEPATH%\tbejv\78798.upo
- %HOMEPATH%\tbejv\82524.rqj
- %HOMEPATH%\tbejv\22133.gde
- %HOMEPATH%\tbejv\38306.awg
Network activity:
Connects to:
- '4s#.#etai.net':80
- 'wp#d':80
TCP:
HTTP GET requests:
- 4s#.#etai.net/bot.php?id#########################################################################################################################################################################################################################################
- wp#d/wpad.dat
UDP:
- DNS ASK 4s#.#etai.net
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'