Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\delete.avi
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Modifies file system
Creates the following files
- %TEMP%\tgldgofy.txt
- %TEMP%\l4e2tb3s.out
- %TEMP%\vbca8441bc5c9894363ade962c02df13c4.tmp
- %TEMP%\vbc8ebf86761c40466387e58af5c3974647.tmp
- %TEMP%\res6582.tmp
- C:\msocache.exe
- %TEMP%\2iyqsswo.0.vb
- %TEMP%\2iyqsswo.cmdline
- %TEMP%\2iyqsswo.out
- %TEMP%\sau2ftd3.cmdline
- %TEMP%\vbc7ab06cecc482482181a5b6e4d25eb4a3.tmp
- %TEMP%\res6c29.tmp
- C:\perflogs.exe
- %TEMP%\2pyylvlo.0.vb
- %TEMP%\2pyylvlo.cmdline
- %TEMP%\2pyylvlo.out
- %TEMP%\vbc7d317627792049a6a728f3f0b94182.tmp
- %TEMP%\vbc11df01554cfd4632acf78ef9a7175696.tmp
- %APPDATA%\system.exe
- %TEMP%\l4e2tb3s.0.vb
- %TEMP%\l4e2tb3s.cmdline
- C:\far2.exe
- %TEMP%\res60b0.tmp
- %TEMP%\vbce1a683c334467dbcd36c28e1bc2f62.tmp
- %PROGRAMDATA%\scusamahopresolatuausb\mltdckey.ico
- %TEMP%\sr1ak4ko.0.vb
- %TEMP%\sr1ak4ko.cmdline
- %TEMP%\sr1ak4ko.out
- %TEMP%\vbce81d05c97c894f2888e9b7b1207ff34b.tmp
- %TEMP%\vbc69a816a5ca144a68a3708e525f5cd422.tmp
- %TEMP%\res56dc.tmp
- C:\$recycle.bin.exe
- %TEMP%\res71f6.tmp
- %TEMP%\vbcd52ac5ef83f6439683cbc7339b6392ad.tmp
- %TEMP%\sau2ftd3.0.vb
- %TEMP%\vbcc8aa6b803e7e4ab5b73d5997c998689d.tmp
- %TEMP%\vbc16531ba247ac49549821762784dbe6f5.tmp
- %TEMP%\res5c1c.tmp
- C:\documents and settings.exe
- %TEMP%\vfwkhbr1.0.vb
- %TEMP%\vfwkhbr1.cmdline
- %TEMP%\vfwkhbr1.out
- %TEMP%\vbcded13730c1d142cbbb31323383e1b4e.tmp
- C:\scusamahopresolatuausb\hounmessaggioperte.exe
- %TEMP%\sau2ftd3.out
- C:\program files.exe
Sets the 'hidden' attribute to the following files
- C:\scusamahopresolatuausb\hounmessaggioperte.exe
Deletes the following files
- %TEMP%\res56dc.tmp
- %TEMP%\res6582.tmp
- %TEMP%\vbc8ebf86761c40466387e58af5c3974647.tmp
- %TEMP%\vbca8441bc5c9894363ade962c02df13c4.tmp
- %TEMP%\l4e2tb3s.0.vb
- %TEMP%\l4e2tb3s.cmdline
- %TEMP%\l4e2tb3s.out
- %TEMP%\vbcd52ac5ef83f6439683cbc7339b6392ad.tmp
- %TEMP%\vbcc8aa6b803e7e4ab5b73d5997c998689d.tmp
- %TEMP%\vbc7ab06cecc482482181a5b6e4d25eb4a3.tmp
- %TEMP%\2iyqsswo.0.vb
- %TEMP%\2iyqsswo.cmdline
- %TEMP%\2iyqsswo.out
- %TEMP%\2pyylvlo.cmdline
- %TEMP%\res71f6.tmp
- %TEMP%\vfwkhbr1.out
- %TEMP%\vfwkhbr1.cmdline
- %TEMP%\vfwkhbr1.0.vb
- %TEMP%\vbcded13730c1d142cbbb31323383e1b4e.tmp
- %TEMP%\vbce1a683c334467dbcd36c28e1bc2f62.tmp
- %TEMP%\res60b0.tmp
- %TEMP%\sau2ftd3.out
- %TEMP%\sau2ftd3.0.vb
- %TEMP%\sau2ftd3.cmdline
- %TEMP%\res6c29.tmp
- %TEMP%\vbc16531ba247ac49549821762784dbe6f5.tmp
- %TEMP%\res5c1c.tmp
- %TEMP%\sr1ak4ko.out
- %TEMP%\sr1ak4ko.0.vb
- %TEMP%\sr1ak4ko.cmdline
- %TEMP%\vbce81d05c97c894f2888e9b7b1207ff34b.tmp
- %TEMP%\vbc69a816a5ca144a68a3708e525f5cd422.tmp
- %TEMP%\vbc11df01554cfd4632acf78ef9a7175696.tmp
- %TEMP%\vbc7d317627792049a6a728f3f0b94182.tmp
Network activity
Connects to
- '93.##.148.239':2222
Miscellaneous
Creates and executes the following
- '%APPDATA%\system.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\sr1ak4ko.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\4kujbcvh.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB28.tmp" "%TEMP%\vbc874E141689E845A7A1F8E1A95E4DCC55.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\dm5yplrm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFAFC.tmp" "%TEMP%\vbc646E8445BC174151A918A051A1C477DB.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\2ai2t23r.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF781.tmp" "%TEMP%\vbc1F8E081A290F4C2CB1C021C1C3B8D760.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\uewsybkz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\pb4glezb.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDC8.tmp" "%TEMP%\vbcFA8DD591A2B44CA6B295BF2967FF5E98.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES71F6.tmp" "%TEMP%\vbc11DF01554CFD4632ACF78EF9A7175696.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6C29.tmp" "%TEMP%\vbcD52AC5EF83F6439683CBC7339B6392AD.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\2iyqsswo.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6582.tmp" "%TEMP%\vbc8EBF86761C40466387E58AF5C3974647.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\l4e2tb3s.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES60B0.tmp" "%TEMP%\vbcE1A683C334467DBCD36C28E1BC2F62.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\vfwkhbr1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5C1C.tmp" "%TEMP%\vbc16531BA247AC49549821762784DBE6F5.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\sau2ftd3.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES56DC.tmp" "%TEMP%\vbc69A816A5CA144A68A3708E525F5CD422.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\2pyylvlo.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\mgmomro1.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\4kujbcvh.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB28.tmp" "%TEMP%\vbc874E141689E845A7A1F8E1A95E4DCC55.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\dm5yplrm.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFAFC.tmp" "%TEMP%\vbc646E8445BC174151A918A051A1C477DB.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\2ai2t23r.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF781.tmp" "%TEMP%\vbc1F8E081A290F4C2CB1C021C1C3B8D760.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\uewsybkz.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\pb4glezb.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES71F6.tmp" "%TEMP%\vbc11DF01554CFD4632ACF78EF9A7175696.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDC8.tmp" "%TEMP%\vbcFA8DD591A2B44CA6B295BF2967FF5E98.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\2pyylvlo.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\2iyqsswo.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6582.tmp" "%TEMP%\vbc8EBF86761C40466387E58AF5C3974647.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\l4e2tb3s.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES60B0.tmp" "%TEMP%\vbcE1A683C334467DBCD36C28E1BC2F62.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\vfwkhbr1.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5C1C.tmp" "%TEMP%\vbc16531BA247AC49549821762784DBE6F5.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\sau2ftd3.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES56DC.tmp" "%TEMP%\vbc69A816A5CA144A68A3708E525F5CD422.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\sr1ak4ko.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6C29.tmp" "%TEMP%\vbcD52AC5EF83F6439683CBC7339B6392AD.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\mgmomro1.cmdline"
