Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\skype\shell\open\command] '' = '"%PROGRAM_FILES%\Skype\Phone\Skype.exe" "/uri:%1"'
- [<HKLM>\SOFTWARE\Classes\skype.callto\shell\open\command] '' = '"%PROGRAM_FILES%\Skype\Phone\Skype.exe" "/callto:%l"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Skype' = '"%PROGRAM_FILES%\Skype\Phone\Skype.exe" /minimized /regrun'
- [<HKLM>\SOFTWARE\Classes\Skype.Content\shell\open\command] '' = '"%PROGRAM_FILES%\Skype\Phone\Skype.exe" /file:"%1"'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com] 'CLSID' = '{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Skype\Phone\Skype.exe' = '%PROGRAM_FILES%\Skype\Phone\Skype.exe:*:Enabled:Skype'
Creates and executes the following:
- '%TEMP%\_ir_sf_temp_0\skype.exe'
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1740146 "__IRAFN:<Full path to virus>" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding 5127D941D0C086D9DF15E74554BB29A1 M Global\MSI0000
- '<SYSTEM32>\attrib.exe' +r "%PROGRAM_FILES%\Skype"
- '<SYSTEM32>\msiexec.exe' -Embedding B63CCE4D57B103E18671DAC1DD55E2DE
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\7ZipSfx.000\skype_5.8.32.154.msi" /qb
- '<SYSTEM32>\msiexec.exe' /V
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\es.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\et.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\fi.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\en.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\da.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\de.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\el.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\it.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\ja.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\ko.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\id.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\fr.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\he.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\hu.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\inputfields.png
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\loader.gif
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\loader.png
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\icons.png
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\connection.png
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\dropdown.png
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\facebook.png
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\ar.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\bg.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\cs.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\js\login.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\messageBottom.png
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\messageTop.png
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\index.html
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\lt.js
- %PROGRAM_FILES%\Skype\third-party_attributions.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Skype\Skype.lnk
- %ALLUSERSPROFILE%\Desktop\Skype.lnk
- %CommonProgramFiles%\Skype\Skype4COM.dll
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\css\platform\win.css
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\css\platform\mac.css
- %PROGRAM_FILES%\Skype\Phone\Skype.exe
- %WINDIR%\Installer\MSI18.tmp
- %TEMP%\www.softpir.com Setup Log.txt
- %ALLUSERSPROFILE%\Desktop\Unattended Soft.url
- %WINDIR%\Installer\MSI17.tmp
- %HOMEPATH%\SendTo\Skype.lnk
- %PROGRAM_FILES%\Skype\desktop.ini
- %WINDIR%\Installer\{1845470B-EB14-4ABC-835B-E36C693DC07D}\SkypeIcon.exe
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\pt.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\pt-br.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\ro.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\pl.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\lv.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\nl.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\no.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\tr.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\uk.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\vi.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\zh-hant.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\ru.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\sv.js
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\languages\zh-hans.js
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %TEMP%\Cab5.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI8.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- %TEMP%\_ir_sf_temp_0\IRIMG2.JPG
- %TEMP%\_ir_sf_temp_0\skype.exe
- %TEMP%\7ZipSfx.000\skype_5.8.32.154.msi
- %TEMP%\_ir_sf_temp_0\IRIMG1.JPG
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %TEMP%\Cab1.tmp
- %TEMP%\Cab3.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %WINDIR%\Installer\240f7.msi
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- %WINDIR%\Installer\MSIE.tmp
- %TEMP%\CabF.tmp
- %TEMP%\Cab11.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIA.tmp
- C:\Config.Msi\240fa.rbs
- %WINDIR%\Installer\MSIC.tmp
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\buttons.png
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\capsLock.png
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\checkbox.png
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\images\background.png
- %TEMP%\Cab13.tmp
- %TEMP%\Cab15.tmp
- %ALLUSERSPROFILE%\Application Data\Skype\Apps\login\css\login.css
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- %WINDIR%\Installer\MSI9.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
Deletes the following files:
- %WINDIR%\Installer\MSI18.tmp
- %WINDIR%\Installer\MSIA.tmp
- C:\Config.Msi\240fa.rbs
- %TEMP%\Cab13.tmp
- %TEMP%\Cab15.tmp
- %WINDIR%\Installer\MSI17.tmp
- %TEMP%\_ir_sf_temp_0\IRIMG1.JPG
- %TEMP%\_ir_sf_temp_0\IRIMG2.JPG
- %TEMP%\_ir_sf_temp_0\skype.exe
- %WINDIR%\Installer\240f7.msi
- %WINDIR%\Installer\240f9.ipi
- %TEMP%\7ZipSfx.000\skype_5.8.32.154.msi
- %TEMP%\Cab5.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI8.tmp
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\Cab1.tmp
- %TEMP%\Cab3.tmp
- %WINDIR%\Installer\MSIE.tmp
- %TEMP%\CabF.tmp
- %TEMP%\Cab11.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSID.tmp
Network activity:
Connects to:
- 'www.download.windowsupdate.com':80
- 'wp#d':80
TCP:
HTTP GET requests:
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- wp#d/wpad.dat
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'tSkMainForm.UnicodeClass' WindowName: ''
