Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'vlcc' = '<Full path to file>'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\client.lnk
Creates the following files on removable media
- <Drive name for removable media>:\google\client.exe
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\000814251_video_01.avi.exe
- <Drive name for removable media>:\correct.avi
Modifies file system
Creates the following files
- C:\google\client.exe
- %TEMP%\d8julamh.0.vb
- %ALLUSERSPROFILE%\google\install.ico
- D:\google\client.exe
- C:\totalcmd.exe
- %TEMP%\rese512.tmp
- %TEMP%\vbce501.tmp
- %TEMP%\d8julamh.out
- %TEMP%\d8julamh.cmdline
- %TEMP%\qnhmgpf9.0.vb
- C:\recovery.exe
- %TEMP%\rese14a.tmp
- %TEMP%\vbce13a.tmp
- %TEMP%\lfdnyrv3.out
- %TEMP%\lfdnyrv3.cmdline
- %TEMP%\qnhmgpf9.out
- %TEMP%\resd192.tmp
- %TEMP%\vbcf141.tmp
- %TEMP%\_yflzps3.0.vb
- %ALLUSERSPROFILE%\google\correct.ico
- %TEMP%\resfa94.tmp
- %TEMP%\vbcfa84.tmp
- %TEMP%\tqrueey0.out
- %TEMP%\tqrueey0.cmdline
- %TEMP%\tqrueey0.0.vb
- %ALLUSERSPROFILE%\google\000814251_video_01.ico
- D:\$recycle.bin.exe
- %TEMP%\resf5d4.tmp
- %TEMP%\vbcf5d3.tmp
- %TEMP%\9aonk6mo.out
- %TEMP%\9aonk6mo.cmdline
- %TEMP%\9aonk6mo.0.vb
- D:\install.log.exe
- %TEMP%\lfdnyrv3.0.vb
- %TEMP%\qnhmgpf9.cmdline
- C:\program files.exe
- %TEMP%\resdda2.tmp
- %TEMP%\vbcdd92.tmp
- %TEMP%\gfj2wu54.0.vb
- %TEMP%\mf69x8jl.0.vb
- C:\documents and settings.exe
- %TEMP%\rescdbb.tmp
- %TEMP%\vbccdaa.tmp
- %TEMP%\gfj2wu54.out
- %TEMP%\gfj2wu54.cmdline
- C:\$recycle.bin.exe
- %TEMP%\mf69x8jl.out
- %TEMP%\resc967.tmp
- %TEMP%\vbcc957.tmp
- %TEMP%\re4drx97.out
- %TEMP%\re4drx97.cmdline
- %TEMP%\re4drx97.0.vb
- %ALLUSERSPROFILE%\google\ilvviil.ico
- %TEMP%\_yflzps3.cmdline
- %TEMP%\resf142.tmp
- %TEMP%\vbcd191.tmp
- %TEMP%\2qpqcmf2.0.vb
- %TEMP%\mf69x8jl.cmdline
- %TEMP%\fkshlxdt.out
- %TEMP%\fkshlxdt.cmdline
- %TEMP%\fkshlxdt.0.vb
- C:\perflogs.exe
- %TEMP%\resd9eb.tmp
- %TEMP%\vbcd9ea.tmp
- %TEMP%\yom3hs9u.out
- %TEMP%\yom3hs9u.cmdline
- %TEMP%\yom3hs9u.0.vb
- C:\msocache.exe
- %TEMP%\resd604.tmp
- %TEMP%\vbcd5f4.tmp
- %TEMP%\2qpqcmf2.out
- %TEMP%\2qpqcmf2.cmdline
- C:\far2.exe
- %TEMP%\_yflzps3.out
Sets the 'hidden' attribute to the following files
- C:\google\client.exe
- D:\google\client.exe
- <Drive name for removable media>:\google\client.exe
Deletes the following files
- %TEMP%\resc967.tmp
- %TEMP%\fkshlxdt.cmdline
- %TEMP%\rese14a.tmp
- %TEMP%\vbce13a.tmp
- %TEMP%\lfdnyrv3.out
- %TEMP%\lfdnyrv3.cmdline
- %TEMP%\lfdnyrv3.0.vb
- %TEMP%\rese512.tmp
- %TEMP%\vbce501.tmp
- %TEMP%\qnhmgpf9.0.vb
- %TEMP%\qnhmgpf9.cmdline
- %TEMP%\qnhmgpf9.out
- %TEMP%\vbcf141.tmp
- %TEMP%\tqrueey0.cmdline
- %TEMP%\d8julamh.out
- %TEMP%\d8julamh.cmdline
- %TEMP%\d8julamh.0.vb
- %TEMP%\resf5d4.tmp
- %TEMP%\vbcf5d3.tmp
- %TEMP%\9aonk6mo.out
- %TEMP%\9aonk6mo.0.vb
- %TEMP%\9aonk6mo.cmdline
- %TEMP%\resfa94.tmp
- %TEMP%\vbcfa84.tmp
- %TEMP%\tqrueey0.0.vb
- %TEMP%\fkshlxdt.out
- %TEMP%\resf142.tmp
- %TEMP%\fkshlxdt.0.vb
- %TEMP%\mf69x8jl.cmdline
- %TEMP%\vbcc957.tmp
- %TEMP%\re4drx97.out
- %TEMP%\re4drx97.cmdline
- %TEMP%\re4drx97.0.vb
- %TEMP%\rescdbb.tmp
- %TEMP%\vbccdaa.tmp
- %TEMP%\gfj2wu54.0.vb
- %TEMP%\gfj2wu54.cmdline
- %TEMP%\gfj2wu54.out
- %TEMP%\resd192.tmp
- %TEMP%\vbcd191.tmp
- %TEMP%\mf69x8jl.out
- %TEMP%\resdda2.tmp
- %TEMP%\mf69x8jl.0.vb
- %TEMP%\resd604.tmp
- %TEMP%\vbcd5f4.tmp
- %TEMP%\2qpqcmf2.0.vb
- %TEMP%\2qpqcmf2.out
- %TEMP%\2qpqcmf2.cmdline
- %TEMP%\resd9eb.tmp
- %TEMP%\vbcd9ea.tmp
- %TEMP%\yom3hs9u.cmdline
- %TEMP%\yom3hs9u.0.vb
- %TEMP%\yom3hs9u.out
- %TEMP%\vbcdd92.tmp
- %TEMP%\tqrueey0.out
Network activity
Connects to
- 'vo##.ddns.net':88
UDP
- DNS ASK vo##.ddns.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\re4drx97.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tqrueey0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF5D4.tmp" "%TEMP%\vbcF5D3.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9aonk6mo.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF142.tmp" "%TEMP%\vbcF141.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d8julamh.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE512.tmp" "%TEMP%\vbcE501.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qnhmgpf9.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE14A.tmp" "%TEMP%\vbcE13A.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lfdnyrv3.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFA94.tmp" "%TEMP%\vbcFA84.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDDA2.tmp" "%TEMP%\vbcDD92.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD9EB.tmp" "%TEMP%\vbcD9EA.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yom3hs9u.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD604.tmp" "%TEMP%\vbcD5F4.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2qpqcmf2.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD192.tmp" "%TEMP%\vbcD191.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mf69x8jl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCDBB.tmp" "%TEMP%\vbcCDAA.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gfj2wu54.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC967.tmp" "%TEMP%\vbcC957.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fkshlxdt.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_yflzps3.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\re4drx97.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\tqrueey0.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF5D4.tmp" "%TEMP%\vbcF5D3.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9aonk6mo.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF142.tmp" "%TEMP%\vbcF141.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\d8julamh.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE512.tmp" "%TEMP%\vbcE501.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qnhmgpf9.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE14A.tmp" "%TEMP%\vbcE13A.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lfdnyrv3.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFA94.tmp" "%TEMP%\vbcFA84.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDDA2.tmp" "%TEMP%\vbcDD92.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD9EB.tmp" "%TEMP%\vbcD9EA.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yom3hs9u.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD604.tmp" "%TEMP%\vbcD5F4.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2qpqcmf2.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD192.tmp" "%TEMP%\vbcD191.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\mf69x8jl.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCDBB.tmp" "%TEMP%\vbcCDAA.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gfj2wu54.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC967.tmp" "%TEMP%\vbcC957.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fkshlxdt.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\_yflzps3.cmdline"
