Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe] 'Debugger' = 'upnpsytem.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = 'ctfmon.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\RECYCLER\S-1-6-20-3802918391-3809376219-530039213-2313\flrun.exe
- <Drive name for removable media>:\RECYCLER\S-1-6-20-3802918391-3809376219-530039213-2313\Desktop.ini
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks the following features:
- System Restore (SR)
Creates and executes the following:
- '<SYSTEM32>\upnpsytem.exe'
Executes the following:
- '<SYSTEM32>\ipconfig.exe' /pid=3040
- '<SYSTEM32>\ipconfig.exe' /pid=2480
- '<SYSTEM32>\ipconfig.exe' /flushdns
Injects code into
the following system processes:
- <SYSTEM32>\ipconfig.exe
- %WINDIR%\Explorer.EXE
Terminates or attempts to terminate
the following user processes:
- MCAGENT.EXE
- fsav32.exe
- fsav.exe
- zlclient.exe
- spidernt.exe
- nod32.exe
- bdss.exe
- bdagent.exe
- 360tray.exe
- GUARD.EXE
- Drweb32w.exe
- ClamWin.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG' WindowName: ''
Hides the following processes:
- C:\bf32d3b0\<Virus name>.exe
- <SYSTEM32>\upnpsytem.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\upnpsytem.exe
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\RECYCLER\S-1-6-20-3802918391-3809376219-530039213-2313\flrun.exe
- <SYSTEM32>\upnpsytem.exe
Modifies the HOSTS file.
Network activity:
Connects to:
- 'fr######.buscandophotos.info':6501
- '23###########l1i1lil1iljijl.mejorphotos.info':52019
- 'st######.buscandophotos.info':31960
- 'n3####.imageshares.info':22048
- 'n3####.imageshares.info':5276
- 'll################llliiiiilililllliljjjljijljijlj.mejorphotos.info':7302
- 't0##.##uvoyoutube.info':5276
- 'k1####.imageshares.info':34091
- 'b3####.#euvoyoutube.info':6501
- '23###########l1i1lil1iljijl.mejorphotos.info':51601
- 't0##.##uvoyoutube.info':52019
- 'st######.buscandophotos.info':5276
- 'k1####.imageshares.info':9103
- 'p0##.###candophotos.info':6501
- 'b3##.###candophotos.info':52019
- 'f1###.#euvoyoutube.info':31960
- 'il###########lliliilililllili.mejorphotos.info':52019
- 'll################llliiiiilililllliljjjljijljijlj.mejorphotos.info':31960
- 'p0####.imageshares.info':9899
- 'f1###.#euvoyoutube.info':52019
- 'n3####.imageshares.info':9899
- 't0##.##uvoyoutube.info':9103
- 'n3####.imageshares.info':34091
- 'b3##.###candophotos.info':22048
- 'f1###.#euvoyoutube.info':51601
- 'p0##.###candophotos.info':7601
- 'k1####.imageshares.info':6501
- 'b1####.imageshares.info':41350
- 'p0####.imageshares.info':31960
- 'f1###.#euvoyoutube.info':22048
- 'b3####.#euvoyoutube.info':9899
- 'fr######.buscandophotos.info':41350
- 'k1####.imageshares.info':22048
- 'p0##.###candophotos.info':9103
- 'll################llliiiiilililllliljjjljijljijlj.mejorphotos.info':22048
UDP:
- DNS ASK b1####.imageshares.info
- DNS ASK ll################llliiiiilililllliljjjljijljijlj.mejorphotos.info
- DNS ASK fr######.buscandophotos.info
- DNS ASK b3####.#euvoyoutube.info
- DNS ASK il###########lliliilililllili.mejorphotos.info
- DNS ASK st######.buscandophotos.info
- DNS ASK 23###########l1i1lil1iljijl.mejorphotos.info
- DNS ASK p0##.###candophotos.info
- DNS ASK n3####.imageshares.info
- DNS ASK b3##.###candophotos.info
- DNS ASK f1###.#euvoyoutube.info
- DNS ASK k1####.imageshares.info
- DNS ASK t0##.##uvoyoutube.info
- DNS ASK p0####.imageshares.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'WispWindowClass' WindowName: ''