Trojan.DownLoader26.2027

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lacMcYws.exe' = '%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SSIkQYgQ.exe' = '%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'ImagePath' = '%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\vwYgEQEb] 'Start' = '00000002'

Infects the following executable files:

<STUBS_DIR>\test.exe
C:\Far2\Far.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Modifies file system:

Creates the following files:

%HOMEPATH%\gOEYMkgs\VQAa.exe
%HOMEPATH%\gOEYMkgs\cAYi.exe
%HOMEPATH%\gOEYMkgs\OIAS.exe
%HOMEPATH%\gOEYMkgs\xEcw.exe
%HOMEPATH%\gOEYMkgs\pgso.exe
<STUBS_DIR>\GUARD\GUARD.EXE.exe
%HOMEPATH%\gOEYMkgs\dAYM.exe
%HOMEPATH%\gOEYMkgs\BEQK.exe
%HOMEPATH%\gOEYMkgs\eEoI.exe
%HOMEPATH%\gOEYMkgs\LEAM.exe
%HOMEPATH%\gOEYMkgs\wYgs.exe
%HOMEPATH%\gOEYMkgs\AEUM.exe
%HOMEPATH%\gOEYMkgs\Ncgq.exe
%HOMEPATH%\gOEYMkgs\nogM.exe
%HOMEPATH%\gOEYMkgs\VoMa.exe
%HOMEPATH%\gOEYMkgs\cAwA.exe
%HOMEPATH%\gOEYMkgs\CMow.exe
%HOMEPATH%\gOEYMkgs\uIgg.exe
%HOMEPATH%\gOEYMkgs\sosu.exe
%HOMEPATH%\gOEYMkgs\vEMc.exe
%HOMEPATH%\gOEYMkgs\XQgo.exe
%HOMEPATH%\gOEYMkgs\rscI.exe
%HOMEPATH%\gOEYMkgs\iYEC.exe
%HOMEPATH%\gOEYMkgs\dcoS.exe
%HOMEPATH%\gOEYMkgs\fMYa.exe
%HOMEPATH%\gOEYMkgs\vEce.exe
%HOMEPATH%\gOEYMkgs\yQUg.exe
%HOMEPATH%\gOEYMkgs\IwUE.exe
%HOMEPATH%\gOEYMkgs\fMka.exe
%HOMEPATH%\gOEYMkgs\AsIu.exe
%HOMEPATH%\gOEYMkgs\JUUq.exe
%HOMEPATH%\gOEYMkgs\jwsa.exe
%HOMEPATH%\gOEYMkgs\kscO.exe
%HOMEPATH%\gOEYMkgs\vAcI.exe
%HOMEPATH%\gOEYMkgs\jQwg.exe
%HOMEPATH%\gOEYMkgs\WQoq.exe
%HOMEPATH%\gOEYMkgs\OMUc.exe
%HOMEPATH%\gOEYMkgs\qwAK.exe
%HOMEPATH%\gOEYMkgs\bcok.exe
%HOMEPATH%\gOEYMkgs\WAAI.exe
%HOMEPATH%\gOEYMkgs\bAQe.exe
%HOMEPATH%\gOEYMkgs\XooW.exe
%HOMEPATH%\gOEYMkgs\kAAO.exe
%HOMEPATH%\gOEYMkgs\VgoE.exe
%HOMEPATH%\gOEYMkgs\LAUq.exe
%HOMEPATH%\gOEYMkgs\ggcS.exe
%HOMEPATH%\gOEYMkgs\wQYm.exe
%HOMEPATH%\gOEYMkgs\BsYi.exe
%HOMEPATH%\gOEYMkgs\WYcW.exe
%HOMEPATH%\gOEYMkgs\fAcG.exe
%HOMEPATH%\gOEYMkgs\jYEa.exe
%HOMEPATH%\gOEYMkgs\AAYk.exe
%HOMEPATH%\gOEYMkgs\AYgm.exe
%HOMEPATH%\gOEYMkgs\wggS.exe
%HOMEPATH%\gOEYMkgs\PMsC.exe
%HOMEPATH%\gOEYMkgs\vgUC.exe
%HOMEPATH%\gOEYMkgs\VcUy.exe
%HOMEPATH%\gOEYMkgs\WgEm.exe
%HOMEPATH%\gOEYMkgs\UAEk.exe
%HOMEPATH%\gOEYMkgs\jwky.exe
%HOMEPATH%\gOEYMkgs\VkIC.exe
%HOMEPATH%\gOEYMkgs\xAsk.exe
%HOMEPATH%\gOEYMkgs\mQAE.exe
%HOMEPATH%\gOEYMkgs\DEkY.exe
%HOMEPATH%\gOEYMkgs\voge.exe
%HOMEPATH%\gOEYMkgs\IIUQ.exe
%HOMEPATH%\gOEYMkgs\qEoG.exe
%HOMEPATH%\gOEYMkgs\wsIe.exe
%HOMEPATH%\gOEYMkgs\AQIs.exe
<STUBS_DIR>\ZONEALARM\ZONEALARM.EXE.exe
%HOMEPATH%\gOEYMkgs\Esci.exe
%HOMEPATH%\gOEYMkgs\SwUO.exe
%HOMEPATH%\gOEYMkgs\aYwO.exe
%HOMEPATH%\gOEYMkgs\OQMo.exe
%HOMEPATH%\gOEYMkgs\skgU.exe
%HOMEPATH%\gOEYMkgs\wQUK.exe
<STUBS_DIR>\NAVAPW32\NAVAPW32.EXE.exe
%HOMEPATH%\gOEYMkgs\EAQO.exe
%HOMEPATH%\gOEYMkgs\Gwkk.exe
%HOMEPATH%\gOEYMkgs\VUcy.exe
%HOMEPATH%\gOEYMkgs\sgYW.exe
%HOMEPATH%\gOEYMkgs\GAoA.exe
%HOMEPATH%\gOEYMkgs\WYoa.exe
<STUBS_DIR>\MCAGENT\MCAGENT.EXE.exe
%HOMEPATH%\gOEYMkgs\NoYE.exe
%HOMEPATH%\gOEYMkgs\KEQS.exe
%HOMEPATH%\gOEYMkgs\LoQm.exe
%HOMEPATH%\gOEYMkgs\kEUg.exe
%HOMEPATH%\gOEYMkgs\Vokc.exe
%HOMEPATH%\gOEYMkgs\sswI.exe
%HOMEPATH%\gOEYMkgs\Mkgc.exe
%HOMEPATH%\gOEYMkgs\ncMQ.exe
%HOMEPATH%\gOEYMkgs\LIQW.exe
%HOMEPATH%\gOEYMkgs\Xwwi.exe
%HOMEPATH%\gOEYMkgs\BcMa.exe
%HOMEPATH%\gOEYMkgs\BQoM.exe
%HOMEPATH%\gOEYMkgs\rAYA.exe
%HOMEPATH%\gOEYMkgs\qMgU.exe
%HOMEPATH%\gOEYMkgs\PYsY.exe
%HOMEPATH%\gOEYMkgs\VIMO.exe
%HOMEPATH%\gOEYMkgs\fgkm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
%HOMEPATH%\gOEYMkgs\QIwS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
%HOMEPATH%\gOEYMkgs\rIYq.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
%HOMEPATH%\gOEYMkgs\JQQA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
%HOMEPATH%\gOEYMkgs\JwgC.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
%HOMEPATH%\gOEYMkgs\gsUA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
%HOMEPATH%\gOEYMkgs\kcsS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
%HOMEPATH%\gOEYMkgs\kEoe.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
%HOMEPATH%\gOEYMkgs\VcgO.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
%HOMEPATH%\gOEYMkgs\QwgA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
%HOMEPATH%\gOEYMkgs\TIEq.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
%HOMEPATH%\gOEYMkgs\wwgW.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
%HOMEPATH%\gOEYMkgs\XsgG.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
%ALLUSERSPROFILE%\caQc.txt
<Current directory>\<File name>
%TEMP%\UsAsYEcc.bat
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
%HOMEPATH%\gOEYMkgs\bgkO.exe
%HOMEPATH%\gOEYMkgs\BMEc.exe
%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws
%HOMEPATH%\gOEYMkgs\SSIkQYgQ
C:\Documents and Settings\LocalService\gOEYMkgs\SSIkQYgQ
%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe
%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe
%HOMEPATH%\gOEYMkgs\WEEQ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
%HOMEPATH%\gOEYMkgs\rsAe.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
%HOMEPATH%\gOEYMkgs\UIUg.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
%HOMEPATH%\gOEYMkgs\kEMa.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
%HOMEPATH%\gOEYMkgs\gYQK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
%HOMEPATH%\gOEYMkgs\JUoy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
%HOMEPATH%\gOEYMkgs\cIsY.exe
%HOMEPATH%\gOEYMkgs\HckU.exe
%HOMEPATH%\gOEYMkgs\nUYS.exe
<STUBS_DIR>\AVGCTRL\AVGCTRL.EXE.exe
%HOMEPATH%\gOEYMkgs\hEQQ.exe
<STUBS_DIR>\AVP32\AVP32.EXE.exe
%HOMEPATH%\gOEYMkgs\oQIg.exe
<STUBS_DIR>\AVP\AVP.EXE.exe
%HOMEPATH%\gOEYMkgs\pEgM.exe
%HOMEPATH%\gOEYMkgs\WQUO.exe
%HOMEPATH%\gOEYMkgs\IQoS.exe
<STUBS_DIR>\AVGCC32\AVGCC32.EXE.exe
%HOMEPATH%\gOEYMkgs\tswW.exe
%HOMEPATH%\gOEYMkgs\jQYK.exe
%HOMEPATH%\gOEYMkgs\SgoI.exe
%HOMEPATH%\gOEYMkgs\tgkw.exe
%HOMEPATH%\gOEYMkgs\FcMW.exe
%HOMEPATH%\gOEYMkgs\yMoA.exe
%HOMEPATH%\gOEYMkgs\AAYw.exe
%HOMEPATH%\gOEYMkgs\oYgo.exe
%HOMEPATH%\gOEYMkgs\JQwS.exe
<STUBS_DIR>\AVPM\AVPM.EXE.exe
%HOMEPATH%\gOEYMkgs\ekES.exe
<STUBS_DIR>\AVPCC\AVPCC.EXE.exe
%HOMEPATH%\gOEYMkgs\iIAe.exe
<STUBS_DIR>\AVSYNMGR\AVSYNMGR.EXE.exe
%HOMEPATH%\gOEYMkgs\vIQw.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
%HOMEPATH%\gOEYMkgs\vEko.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
%HOMEPATH%\gOEYMkgs\rAkU.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
%HOMEPATH%\gOEYMkgs\DAAy.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
%HOMEPATH%\gOEYMkgs\YUoK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
%HOMEPATH%\gOEYMkgs\socK.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
%HOMEPATH%\gOEYMkgs\fUgM.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
%HOMEPATH%\gOEYMkgs\xsYg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%HOMEPATH%\gOEYMkgs\fwoq.exe
%HOMEPATH%\gOEYMkgs\JgQU.exe
%HOMEPATH%\gOEYMkgs\Ewsa.exe
%HOMEPATH%\gOEYMkgs\XsIw.exe
%HOMEPATH%\gOEYMkgs\VEAc.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\gOEYMkgs\goIW.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\gOEYMkgs\bEIW.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe

Deletes the following files:

%HOMEPATH%\gOEYMkgs\sosu.exe
%HOMEPATH%\gOEYMkgs\nogM.exe
%HOMEPATH%\gOEYMkgs\CMow.exe
%HOMEPATH%\gOEYMkgs\uIgg.exe
%HOMEPATH%\gOEYMkgs\VoMa.exe
%HOMEPATH%\gOEYMkgs\dcoS.exe
%HOMEPATH%\gOEYMkgs\fMYa.exe
%HOMEPATH%\gOEYMkgs\cAwA.exe
%HOMEPATH%\gOEYMkgs\iYEC.exe
%HOMEPATH%\gOEYMkgs\jYEa.exe
%HOMEPATH%\gOEYMkgs\EAQO.exe
%HOMEPATH%\gOEYMkgs\Gwkk.exe
%HOMEPATH%\gOEYMkgs\sgYW.exe
%HOMEPATH%\gOEYMkgs\GAoA.exe
%HOMEPATH%\gOEYMkgs\KEQS.exe
%HOMEPATH%\gOEYMkgs\WYoa.exe
%HOMEPATH%\gOEYMkgs\NoYE.exe
%HOMEPATH%\gOEYMkgs\LoQm.exe
%HOMEPATH%\gOEYMkgs\kEUg.exe
%HOMEPATH%\gOEYMkgs\dAYM.exe
%HOMEPATH%\gOEYMkgs\BEQK.exe
%HOMEPATH%\gOEYMkgs\wYgs.exe
%HOMEPATH%\gOEYMkgs\AEUM.exe
%HOMEPATH%\gOEYMkgs\eEoI.exe
%HOMEPATH%\gOEYMkgs\VgoE.exe
%HOMEPATH%\gOEYMkgs\bcok.exe
%HOMEPATH%\gOEYMkgs\XooW.exe
%HOMEPATH%\gOEYMkgs\kAAO.exe
%HOMEPATH%\gOEYMkgs\LEAM.exe
%HOMEPATH%\gOEYMkgs\rscI.exe
%HOMEPATH%\gOEYMkgs\Ncgq.exe
%HOMEPATH%\gOEYMkgs\vEMc.exe
%HOMEPATH%\gOEYMkgs\XQgo.exe
%HOMEPATH%\gOEYMkgs\xEcw.exe
%HOMEPATH%\gOEYMkgs\cAYi.exe
%HOMEPATH%\gOEYMkgs\OIAS.exe
%HOMEPATH%\gOEYMkgs\pgso.exe
%HOMEPATH%\gOEYMkgs\VQAa.exe
%HOMEPATH%\gOEYMkgs\PMsC.exe
%HOMEPATH%\gOEYMkgs\vgUC.exe
%HOMEPATH%\gOEYMkgs\aYwO.exe
%HOMEPATH%\gOEYMkgs\DEkY.exe
%HOMEPATH%\gOEYMkgs\VcUy.exe
%HOMEPATH%\gOEYMkgs\wggS.exe
%HOMEPATH%\gOEYMkgs\VkIC.exe
%HOMEPATH%\gOEYMkgs\AAYk.exe
%HOMEPATH%\gOEYMkgs\AYgm.exe
%HOMEPATH%\gOEYMkgs\SwUO.exe
%HOMEPATH%\gOEYMkgs\voge.exe
%HOMEPATH%\gOEYMkgs\IIUQ.exe
%HOMEPATH%\gOEYMkgs\wsIe.exe
%HOMEPATH%\gOEYMkgs\AQIs.exe
%HOMEPATH%\gOEYMkgs\qEoG.exe
%HOMEPATH%\gOEYMkgs\wQUK.exe
%HOMEPATH%\gOEYMkgs\Esci.exe
%HOMEPATH%\gOEYMkgs\OQMo.exe
%HOMEPATH%\gOEYMkgs\skgU.exe
%HOMEPATH%\gOEYMkgs\VIMO.exe
%HOMEPATH%\gOEYMkgs\fgkm.exe
%HOMEPATH%\gOEYMkgs\ncMQ.exe
%HOMEPATH%\gOEYMkgs\PYsY.exe
%HOMEPATH%\gOEYMkgs\BQoM.exe
%HOMEPATH%\gOEYMkgs\Vokc.exe
%HOMEPATH%\gOEYMkgs\VUcy.exe
%HOMEPATH%\gOEYMkgs\rAYA.exe
%HOMEPATH%\gOEYMkgs\qMgU.exe
%HOMEPATH%\gOEYMkgs\Mkgc.exe
%HOMEPATH%\gOEYMkgs\WgEm.exe
%HOMEPATH%\gOEYMkgs\UAEk.exe
%HOMEPATH%\gOEYMkgs\xAsk.exe
%HOMEPATH%\gOEYMkgs\mQAE.exe
%HOMEPATH%\gOEYMkgs\jwky.exe
%HOMEPATH%\gOEYMkgs\BcMa.exe
%HOMEPATH%\gOEYMkgs\sswI.exe
%HOMEPATH%\gOEYMkgs\LIQW.exe
%HOMEPATH%\gOEYMkgs\Xwwi.exe
%HOMEPATH%\gOEYMkgs\WAAI.exe
%HOMEPATH%\gOEYMkgs\socK.exe
%HOMEPATH%\gOEYMkgs\fUgM.exe
%HOMEPATH%\gOEYMkgs\DAAy.exe
%HOMEPATH%\gOEYMkgs\vEko.exe
%HOMEPATH%\gOEYMkgs\YUoK.exe
%HOMEPATH%\gOEYMkgs\kEoe.exe
%HOMEPATH%\gOEYMkgs\VcgO.exe
%HOMEPATH%\gOEYMkgs\HckU.exe
%HOMEPATH%\gOEYMkgs\QwgA.exe
%HOMEPATH%\gOEYMkgs\rAkU.exe
%HOMEPATH%\gOEYMkgs\Ewsa.exe
%HOMEPATH%\gOEYMkgs\XsIw.exe
%HOMEPATH%\gOEYMkgs\IQoS.exe
%HOMEPATH%\gOEYMkgs\JgQU.exe
%HOMEPATH%\gOEYMkgs\xsYg.exe
%HOMEPATH%\gOEYMkgs\VEAc.exe
%HOMEPATH%\gOEYMkgs\goIW.exe
%HOMEPATH%\gOEYMkgs\fwoq.exe
%HOMEPATH%\gOEYMkgs\bEIW.exe
%HOMEPATH%\gOEYMkgs\JUoy.exe
%HOMEPATH%\gOEYMkgs\cIsY.exe
%HOMEPATH%\gOEYMkgs\kEMa.exe
%HOMEPATH%\gOEYMkgs\rsAe.exe
%HOMEPATH%\gOEYMkgs\gYQK.exe
%HOMEPATH%\gOEYMkgs\BMEc.exe
%TEMP%\UsAsYEcc.bat
%HOMEPATH%\gOEYMkgs\WEEQ.exe
%HOMEPATH%\gOEYMkgs\bgkO.exe
%HOMEPATH%\gOEYMkgs\UIUg.exe
%HOMEPATH%\gOEYMkgs\wwgW.exe
%HOMEPATH%\gOEYMkgs\rIYq.exe
%HOMEPATH%\gOEYMkgs\XsgG.exe
%HOMEPATH%\gOEYMkgs\TIEq.exe
%HOMEPATH%\gOEYMkgs\JQQA.exe
%HOMEPATH%\gOEYMkgs\kcsS.exe
%HOMEPATH%\gOEYMkgs\JwgC.exe
%HOMEPATH%\gOEYMkgs\QIwS.exe
%HOMEPATH%\gOEYMkgs\gsUA.exe
%HOMEPATH%\gOEYMkgs\vEce.exe
%HOMEPATH%\gOEYMkgs\yQUg.exe
%HOMEPATH%\gOEYMkgs\AsIu.exe
%HOMEPATH%\gOEYMkgs\JUUq.exe
%HOMEPATH%\gOEYMkgs\IwUE.exe
%HOMEPATH%\gOEYMkgs\OMUc.exe
%HOMEPATH%\gOEYMkgs\jwsa.exe
%HOMEPATH%\gOEYMkgs\jQwg.exe
%HOMEPATH%\gOEYMkgs\WQoq.exe
%HOMEPATH%\gOEYMkgs\fMka.exe
%HOMEPATH%\gOEYMkgs\WYcW.exe
<Full path to file>
%HOMEPATH%\gOEYMkgs\bAQe.exe
%HOMEPATH%\gOEYMkgs\BsYi.exe
%HOMEPATH%\gOEYMkgs\fAcG.exe
%HOMEPATH%\gOEYMkgs\wQYm.exe
%HOMEPATH%\gOEYMkgs\qwAK.exe
%HOMEPATH%\gOEYMkgs\LAUq.exe
%HOMEPATH%\gOEYMkgs\ggcS.exe
%HOMEPATH%\gOEYMkgs\oQIg.exe
%HOMEPATH%\gOEYMkgs\nUYS.exe
%HOMEPATH%\gOEYMkgs\ekES.exe
%HOMEPATH%\gOEYMkgs\SgoI.exe
%HOMEPATH%\gOEYMkgs\hEQQ.exe
%HOMEPATH%\gOEYMkgs\pEgM.exe
%HOMEPATH%\gOEYMkgs\WQUO.exe
%HOMEPATH%\gOEYMkgs\tswW.exe
%HOMEPATH%\gOEYMkgs\jQYK.exe
%HOMEPATH%\gOEYMkgs\vIQw.exe
%HOMEPATH%\gOEYMkgs\AAYw.exe
%HOMEPATH%\gOEYMkgs\oYgo.exe
%HOMEPATH%\gOEYMkgs\kscO.exe
%HOMEPATH%\gOEYMkgs\vAcI.exe
%HOMEPATH%\gOEYMkgs\JQwS.exe
%HOMEPATH%\gOEYMkgs\yMoA.exe
%HOMEPATH%\gOEYMkgs\iIAe.exe
%HOMEPATH%\gOEYMkgs\tgkw.exe
%HOMEPATH%\gOEYMkgs\FcMW.exe

Network activity:

Connects to:

'74.##5.232.51':80

TCP:

HTTP GET requests:

http:/// via 74.##5.232.51
http://google.com/ via 74.##5.232.51

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'SSIkQYgQ.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'lacMcYws.exe'

Creates and executes the following:

'%ALLUSERSPROFILE%\tuIMYcEM\ZgMYMIIE.exe'
'<Full path to file>'
'%HOMEPATH%\gOEYMkgs\SSIkQYgQ.exe'
'%ALLUSERSPROFILE%\WuIEgAsU\lacMcYws.exe'

Executes the following:

'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c "<Current directory>\<File name>"
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней