Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%HOMEPATH%\spip\FXBPUH~1.EXE %HOMEPATH%\spip\CVMFJC~1.DOC'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\kdeomd.int
- %HOMEPATH%\spip\bwrmecamup.docx
- %HOMEPATH%\spip\caat.xls
- %HOMEPATH%\spip\cvklg.mp3
- %HOMEPATH%\spip\cvmfjcfw.docx
- %HOMEPATH%\spip\dxqegfhok.msc
- %HOMEPATH%\spip\fgsekxol.icm
- %HOMEPATH%\spip\fwnr.msc
- %HOMEPATH%\spip\fxbpuh.xl
- %HOMEPATH%\spip\fxbpuh.xl.exe
- %HOMEPATH%\spip\hxie.msc
- %HOMEPATH%\spip\jlxgbk.bin
- %HOMEPATH%\spip\kdeomd.int
- %HOMEPATH%\spip\kthc.xl
- %HOMEPATH%\spip\lcgr.vbe
- %HOMEPATH%\spip\lgtera.icm
- %HOMEPATH%\spip\lnqram.bmp
- %HOMEPATH%\spip\lsbr.icm
- %HOMEPATH%\spip\ltstgwrb.mp2
- %HOMEPATH%\spip\medqisc.jpg
- %HOMEPATH%\spip\mmekpaeu.xl
- %HOMEPATH%\spip\nnbblpsr.3gp
- %HOMEPATH%\spip\nwqcr.mp3
- %HOMEPATH%\spip\ocjbppdui.exe
- %HOMEPATH%\spip\qstij.xls
- %HOMEPATH%\spip\rrrkfhhh.xl
- %HOMEPATH%\spip\sfhsm.bin
- %HOMEPATH%\spip\sobph.icm
- %HOMEPATH%\spip\araeltmx.msc
- %HOMEPATH%\spip\uxfpmwhs.exe
- %TEMP%\rarsfx0\fxbpuh.xl.exe
- %TEMP%\rarsfx0\bwrmecamup.docx
- %TEMP%\rarsfx0\sfhsm.bin
- %TEMP%\rarsfx0\cvmfjcfw.docx
- %TEMP%\rarsfx0\lcgr.vbe
- %TEMP%\rarsfx0\fxbpuh.xl
- %TEMP%\rarsfx0\kthc.xl
- %TEMP%\rarsfx0\araeltmx.msc
- %TEMP%\rarsfx0\xoivvgtwkh.dll
- %TEMP%\rarsfx0\ocjbppdui.exe
- %TEMP%\rarsfx0\nnbblpsr.3gp
- %TEMP%\rarsfx0\rrrkfhhh.xl
- %TEMP%\rarsfx0\ltstgwrb.mp2
- %TEMP%\rarsfx0\cvklg.mp3
- %TEMP%\rarsfx0\uxfpmwhs.exe
- %TEMP%\rarsfx0\sobph.icm
- %TEMP%\rarsfx0\lnqram.bmp
- %TEMP%\rarsfx0\jlxgbk.bin
- %TEMP%\rarsfx0\fgsekxol.icm
- %TEMP%\rarsfx0\hxie.msc
- %TEMP%\rarsfx0\mmekpaeu.xl
- %TEMP%\rarsfx0\dxqegfhok.msc
- %TEMP%\rarsfx0\caat.xls
- %TEMP%\rarsfx0\fwnr.msc
- %TEMP%\rarsfx0\medqisc.jpg
- %TEMP%\rarsfx0\lsbr.icm
- %TEMP%\rarsfx0\qstij.xls
- %TEMP%\rarsfx0\nwqcr.mp3
- %TEMP%\rarsfx0\lgtera.icm
- %HOMEPATH%\temp\sfhsm.bin
- %HOMEPATH%\spip\xoivvgtwkh.dll
Sets the 'hidden' attribute to the following files
- %TEMP%\rarsfx0\fxbpuh.xl
- %HOMEPATH%\spip\sobph.icm
- %HOMEPATH%\spip\sfhsm.bin
- %HOMEPATH%\spip\rrrkfhhh.xl
- %HOMEPATH%\spip\qstij.xls
- %HOMEPATH%\spip\ocjbppdui.exe
- %HOMEPATH%\spip\nwqcr.mp3
- %HOMEPATH%\spip\nnbblpsr.3gp
- %HOMEPATH%\spip\mmekpaeu.xl
- %HOMEPATH%\spip\medqisc.jpg
- %HOMEPATH%\spip\ltstgwrb.mp2
- %HOMEPATH%\spip\lsbr.icm
- %HOMEPATH%\spip\lnqram.bmp
- %HOMEPATH%\spip\lgtera.icm
- %HOMEPATH%\spip\uxfpmwhs.exe
- %HOMEPATH%\spip\lcgr.vbe
- %HOMEPATH%\spip\kdeomd.int
- %HOMEPATH%\spip\jlxgbk.bin
- %HOMEPATH%\spip\hxie.msc
- %HOMEPATH%\spip\fxbpuh.xl.exe
- %HOMEPATH%\spip\fxbpuh.xl
- %HOMEPATH%\spip\fwnr.msc
- %HOMEPATH%\spip\fgsekxol.icm
- %HOMEPATH%\spip\dxqegfhok.msc
- %HOMEPATH%\spip\cvmfjcfw.docx
- %HOMEPATH%\spip\cvklg.mp3
- %HOMEPATH%\spip\caat.xls
- %HOMEPATH%\spip\bwrmecamup.docx
- %HOMEPATH%\spip\araeltmx.msc
- %HOMEPATH%\spip\kthc.xl
- %HOMEPATH%\spip\xoivvgtwkh.dll
Deletes the following files
- %TEMP%\rarsfx0\fxbpuh.xl
Network activity
UDP
- DNS ASK google.com
- 'localhost':51107
- 'localhost':58300
- 'localhost':50001
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\RarSFX0\lcgr.vbe"
- '%TEMP%\rarsfx0\fxbpuh.xl' cvmfjcfw.docx
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /release
- '%WINDIR%\syswow64\cmd.exe' /c fxbpuh.xl cvmfjcfw.docx
- '%WINDIR%\syswow64\ipconfig.exe' /release
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /renew
- '%WINDIR%\syswow64\ipconfig.exe' /renew
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /release' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c fxbpuh.xl cvmfjcfw.docx' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /renew' (with hidden window)
