Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\windows update listner
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="Windows Update Listner" dir=in action=allow program="<SYSTEM32>\mppr.exe" enable=yes
Modifies file system
Creates the following files
- %TEMP%\rx3ld2ee.y0y.exe
- %TEMP%\radiobutton_uncheckednormaltexture.png
- <SYSTEM32>\mppr.exe
- %TEMP%\tmpd9d7.tmp.bat
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\rx3ld2ee.y0y.exe.log
- %TEMP%\tmpe4b5.tmp
- %TEMP%\tmpe4f4.tmp
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %HOMEPATH%\desktop.inf
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\mppr.exe
Deletes following files that it created itself
- %TEMP%\tmpe4b5.tmp
- %TEMP%\tmpe4f4.tmp
Network activity
Connects to
- 'localhost':443
- 'vv######jnj25i5.hopto.org':443
TCP
Other
- 'vv######jnj25i5.hopto.org':443
UDP
- DNS ASK ug######jhf02jbhdfg9u.com
- DNS ASK 91######nqtphj2.hopto.org
- DNS ASK cv######ynwfffgyui2w4.com
- DNS ASK dw######jfk8ds5.hopto.org
- DNS ASK 2w######jfui309.hopto.org
- DNS ASK ww######gyui3s1.hopto.org
- DNS ASK vv######jnj25i5.hopto.org
Miscellaneous
Searches for the following windows
- ClassName: 'NarratorUIClass' WindowName: ''
Creates and executes the following
- '%TEMP%\rx3ld2ee.y0y.exe'
- '<SYSTEM32>\mppr.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /mo 5 /tn "Microsoft\Windows\Windows Update Listner" /tr "<SYSTEM32>\mppr.exe" /RL HIGHEST & exit
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="Windows Update Listner" dir=in action=allow program="<SYSTEM32>\mppr.exe" enable=yes & exit
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmpD9D7.tmp.bat""
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 5 /tn "Microsoft\Windows\Windows Update Listner" /tr "<SYSTEM32>\mppr.exe" /RL HIGHEST
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /mo 5 /tn "Microsoft\Windows\Windows Update Listner" /tr "<SYSTEM32>\mppr.exe" /RL HIGHEST & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall add rule name="Windows Update Listner" dir=in action=allow program="<SYSTEM32>\mppr.exe" enable=yes & exit' (with hidden window)
