Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\google chrome helper update
Infects the following executable files
- %HOMEPATH%\desktop\utorrent.exe
- %HOMEPATH%\downloads\chromesetup.exe
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe
- %HOMEPATH%\downloads\magent_rfrset.exe
- %HOMEPATH%\downloads\mirc741.exe
- %HOMEPATH%\downloads\opera_ni_stable.exe
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\google chrome helper\chromehelper.exe
- %TEMP%\9xxukm.ico
- %TEMP%\rcx197c.tmp
- %TEMP%\rcx19bb.tmp
- %TEMP%\tnhahq.exe
- %TEMP%\rcx21ea.tmp
- %TEMP%\tnhahq.ico
- %TEMP%\rcx2769.tmp
- %TEMP%\rcx2dd3.tmp
- %TEMP%\wdtlmc.exe
- %TEMP%\rcx3dd1.tmp
- %TEMP%\wdtlmc.ico
- %TEMP%\rcx3e5f.tmp
- %TEMP%\rcx3f0c.tmp
- %TEMP%\uzpxvs.exe
- %TEMP%\rcx4026.tmp
- %TEMP%\uzpxvs.ico
- %TEMP%\rcx4075.tmp
- %TEMP%\rcx192c.tmp
- %TEMP%\rcx40c4.tmp
- %TEMP%\9xxukm.exe
- %TEMP%\rcxff3a.tmp
- %TEMP%\1hu.xml
- %TEMP%\cnxvfo.exe
- %TEMP%\rcxdcd5.tmp
- %TEMP%\cnxvfo.ico
- %TEMP%\rcxdd63.tmp
- %TEMP%\rcxddd1.tmp
- %TEMP%\e3g7yp.exe
- %TEMP%\rcxdecc.tmp
- %TEMP%\e3g7yp.ico
- %TEMP%\rcxdf2b.tmp
- %TEMP%\rcxdf6a.tmp
- %TEMP%\v1b6uz.exe
- %TEMP%\rcxebbf.tmp
- %WINDIR%
- %TEMP%\ftwaua.exe
- %TEMP%\rcxf7b7.tmp
- %TEMP%\ftwaua.ico
- %TEMP%\rcxe7d.tmp
- %TEMP%\8fokz8.exe
Deletes the following files
- %TEMP%\1hu.xml
- %TEMP%\cnxvfo.exe
- %TEMP%\cnxvfo.ico
- %TEMP%\e3g7yp.exe
- %TEMP%\e3g7yp.ico
- %TEMP%\ftwaua.exe
- %TEMP%\ftwaua.ico
- %TEMP%\9xxukm.exe
- %TEMP%\9xxukm.ico
- %TEMP%\tnhahq.exe
- %TEMP%\tnhahq.ico
- %TEMP%\wdtlmc.exe
- %TEMP%\wdtlmc.ico
- %TEMP%\uzpxvs.exe
- %TEMP%\uzpxvs.ico
- %TEMP%\8fokz8.exe
Moves the following files
- from %TEMP%\rcxdcd5.tmp to %TEMP%\cnxvfo.exe
- from %TEMP%\rcx4026.tmp to %TEMP%\uzpxvs.exe
- from %TEMP%\rcx3f0c.tmp to %TEMP%\wdtlmc.exe
- from %TEMP%\rcx3e5f.tmp to %TEMP%\wdtlmc.exe
- from %TEMP%\rcx3dd1.tmp to %TEMP%\wdtlmc.exe
- from %TEMP%\rcx2dd3.tmp to %TEMP%\tnhahq.exe
- from %TEMP%\rcx2769.tmp to %TEMP%\tnhahq.exe
- from %TEMP%\rcx21ea.tmp to %TEMP%\tnhahq.exe
- from %TEMP%\rcx19bb.tmp to %TEMP%\9xxukm.exe
- from %TEMP%\rcx197c.tmp to %TEMP%\9xxukm.exe
- from %TEMP%\rcx192c.tmp to %TEMP%\9xxukm.exe
- from %TEMP%\rcxe7d.tmp to %TEMP%\ftwaua.exe
- from %TEMP%\rcxff3a.tmp to %TEMP%\ftwaua.exe
- from %TEMP%\rcxf7b7.tmp to %TEMP%\ftwaua.exe
- from %TEMP%\rcxebbf.tmp to %TEMP%\v1b6uz.exe
- from %TEMP%\rcxdf6a.tmp to %TEMP%\e3g7yp.exe
- from %TEMP%\rcxdf2b.tmp to %TEMP%\e3g7yp.exe
- from %TEMP%\rcxdecc.tmp to %TEMP%\e3g7yp.exe
- from %TEMP%\rcxddd1.tmp to %TEMP%\cnxvfo.exe
- from %TEMP%\rcxdd63.tmp to %TEMP%\cnxvfo.exe
- from %TEMP%\rcx4075.tmp to %TEMP%\uzpxvs.exe
- from %TEMP%\rcx40c4.tmp to %TEMP%\uzpxvs.exe
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\google chrome helper\chromehelper.exe'
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /QUERY /TN "Google Chrome Helper Update"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /CREATE /XML "%TEMP%\1HU.xml" /TN "Google Chrome Helper Update"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /QUERY /TN "Google Chrome Helper Update"
- '%WINDIR%\syswow64\schtasks.exe' /QUERY /TN "Google Chrome Helper Update"
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /CREATE /XML "%TEMP%\1HU.xml" /TN "Google Chrome Helper Update"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /XML "%TEMP%\1HU.xml" /TN "Google Chrome Helper Update"
