Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
deletes volume shadow copies.
Creates and executes the following (exploit)
- '%APPDATA%\h.exe'
Executes the following
- '%WINDIR%\syswow64\net.exe' stop MpsSvc
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c mkdir "%APPDATA%" & exit
Injects code into
the following system processes:
- %WINDIR%\syswow64\explorer.exe
Modifies file system
Creates the following files
- %APPDATA%\h.exe
- %APPDATA%\margin.note.properties.xml
- %APPDATA%\15.png
- %APPDATA%\tucuman
- %APPDATA%\pstexturedinstanced.hlsl
- %APPDATA%\gourl_lr_photoshop_cn.csv
- %APPDATA%\gbpc-euc-h
- %APPDATA%\readme_sl_si.txt
- %APPDATA%\htmlhelp.button.locate.xml
- %APPDATA%\forward.png
- %APPDATA%\gtk20.mo
- %APPDATA%\gre.zdct
- %APPDATA%\vsuntexturedinstanced.hlsl
- %APPDATA%\phenology.j
- %APPDATA%\style.forms.htm
- %APPDATA%\warning-3.png
- %APPDATA%\examplexml2fo.java
- %APPDATA%\add-rksj-v
- %APPDATA%\hyph_mr_in.dic
- %APPDATA%\foil.subtitle.properties.xml
- %APPDATA%\luxembourg
- %APPDATA%\header.rule.xml
- %APPDATA%\callout.graphics.path.xml
- %APPDATA%\xblibrary.js.xml
- %APPDATA%\15.svg
- %APPDATA%\downtrend.rtu
- %APPDATA%\yst9ydt
- %APPDATA%\it.pak
- %APPDATA%\standard_keyboard.png
- %APPDATA%\suppress.header.navigation.xml
- %APPDATA%\chunker.output.media-type.xml
- %APPDATA%\postage_videoinset.png
- %APPDATA%\vertexoutput.hlsli
- %APPDATA%\bl cg10 wmg4 cg3.ado
- %APPDATA%\ip.dll
- %TEMP%\nsse928.tmp\system.dll
Deletes the following files
- %APPDATA%\h.exe
Network activity
UDP
- DNS ASK mu###ocaugh.com
- DNS ASK ru###hegde.ru
- DNS ASK bo###babrab.ru
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c mkdir "%APPDATA%" & exit' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc config MpsSvc start= disabled' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop MpsSvc' (with hidden window)
- '%WINDIR%\syswow64\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\syswow64\cmd.exe' /c sc config MpsSvc start= disabled
- '%WINDIR%\syswow64\cmd.exe' /c net stop MpsSvc
- '%WINDIR%\syswow64\sc.exe' config MpsSvc start= disabled
- '%WINDIR%\syswow64\net1.exe' stop MpsSvc
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' -nohome
