Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\RemoteRegistry] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- %TEMP%\GLB1.tmp 6144 <Full path to virus>
Executes the following:
- <SYSTEM32>\wscript.exe "%TEMP%\Machine\EDMCFix\edmcfix.vbs"
- <SYSTEM32>\net1.exe Start "WebClient"
- <SYSTEM32>\wscript.exe "%TEMP%\Machine\McAfeeCustomProps\CUSTOM~1.VBS"
- <SYSTEM32>\wscript.exe %TEMP%\Machine\DNSSuffixList\ED5_AppendDNSSuffixlist.vbs WBG
- <SYSTEM32>\cscript.exe "%TEMP%\Machine\RupeeForadianFont\RegisterRupeeForadianFont.vbs"
- <SYSTEM32>\net1.exe Stop "WebClient"
- <SYSTEM32>\sc.exe stop IBMPMSVC
- <SYSTEM32>\wscript.exe "%TEMP%\Machine\OUAdmin\LOCALA~1.VBS"
- <SYSTEM32>\wscript.exe "%TEMP%\Machine\FixINews\WBGTIC~2.VBS"
- <SYSTEM32>\net.exe Stop "WebClient"
- <SYSTEM32>\net1.exe START "RemoteRegistry"
Modifies file system :
Creates the following files:
- %TEMP%\Machine\SMS20\~GLH0039.TMP
- %TEMP%\Machine\SMS20\~GLH003a.TMP
- %TEMP%\Machine\SMS20\~GLH0038.TMP
- %TEMP%\Machine\SMS20\~GLH0036.TMP
- %TEMP%\Machine\SMS20\~GLH0037.TMP
- %TEMP%\Machine\SMS20\~GLH003b.TMP
- %TEMP%\Machine\SMS20\~GLH003f.TMP
- %TEMP%\Machine\SMS20\~GLH0040.TMP
- %TEMP%\Machine\SMS20\~GLH003e.TMP
- %TEMP%\Machine\SMS20\~GLH003c.TMP
- %TEMP%\Machine\SMS20\~GLH003d.TMP
- %TEMP%\Machine\SMS20\~GLH0035.TMP
- %TEMP%\Machine\SMS20\~GLH002d.TMP
- %TEMP%\Machine\SMS20\~GLH002e.TMP
- %TEMP%\Machine\SMS20\~GLH002c.TMP
- %TEMP%\Machine\SMS20\~GLH002a.TMP
- %TEMP%\Machine\SMS20\~GLH002b.TMP
- %TEMP%\Machine\SMS20\~GLH002f.TMP
- %TEMP%\Machine\SMS20\~GLH0033.TMP
- %TEMP%\Machine\SMS20\~GLH0034.TMP
- %TEMP%\Machine\SMS20\~GLH0032.TMP
- %TEMP%\Machine\SMS20\~GLH0030.TMP
- %TEMP%\Machine\SMS20\~GLH0031.TMP
- %TEMP%\Machine\SMS20\~GLH0041.TMP
- C:\WBG\Utility\~GLH0051.TMP
- C:\WBG\Utility\~GLH0050.TMP
- %TEMP%\Machine\VPNProfile\NewProfiles\~GLH004e.TMP
- %TEMP%\Machine\VPNProfile\NewProfiles\~GLH004f.TMP
- %PROGRAM_FILES%\IBM\Lotus\Notes\framework\rcp\~GLH0052.TMP
- %WINDIR%\Fonts\Rupee_Foradian.ttf
- C:\WBG\Scripts\~GLH0056.TMP
- C:\temp\cd\download\Cache\~GLH0055.TMP
- C:\WBG\Scripts\~GLH0053.TMP
- C:\temp\cd\download\Cache\~GLH0054.TMP
- %TEMP%\Machine\VPNProfile\~GLH004d.TMP
- %TEMP%\Machine\SMS20\~GLH0045.TMP
- %TEMP%\Machine\SMS20\~GLH0046.TMP
- %TEMP%\Machine\SMS20\~GLH0044.TMP
- %TEMP%\Machine\SMS20\~GLH0042.TMP
- %TEMP%\Machine\SMS20\~GLH0043.TMP
- %TEMP%\Machine\SMS20\~GLH0047.TMP
- %TEMP%\Machine\SMS20\~GLH004b.TMP
- %TEMP%\Machine\SMS20\~GLH004c.TMP
- %TEMP%\Machine\SMS20\~GLH004a.TMP
- %TEMP%\Machine\SMS20\~GLH0048.TMP
- %TEMP%\Machine\SMS20\~GLH0049.TMP
- %TEMP%\Machine\EnableNSDService\~GLH000a.TMP
- %TEMP%\Machine\FixINews\~GLH000b.TMP
- %TEMP%\Machine\EDMCFix\~GLH0009.TMP
- %TEMP%\Machine\DocumentumFix\~GLH0007.TMP
- %TEMP%\Machine\DocumentumFix\~GLH0008.TMP
- %TEMP%\Machine\FixINews\~GLH000c.TMP
- %TEMP%\Machine\McAfeeCustomProps\~GLH0010.TMP
- %TEMP%\Machine\MCDLLRename\~GLH0011.TMP
- %TEMP%\Machine\LLOGOUT\~GLH000f.TMP
- %TEMP%\Machine\FixINews\~GLH000d.TMP
- %TEMP%\Machine\ISUSPM_Uninstall\~GLH000e.TMP
- %TEMP%\Machine\DocumentumFix\~GLH0006.TMP
- %TEMP%\GLW4.tmp
- %TEMP%\GLG6.tmp
- %TEMP%\GLK3.tmp
- %TEMP%\GLB1.tmp
- %TEMP%\GLC2.tmp
- %TEMP%\Machine\~GLH0000.TMP
- %TEMP%\Machine\DisableJVMProperties\~GLH0004.TMP
- %TEMP%\Machine\DNSSuffixList\~GLH0005.TMP
- %TEMP%\Machine\8021x\~GLH0003.TMP
- %TEMP%\Machine\8021x\~GLH0001.TMP
- %TEMP%\Machine\8021x\~GLH0002.TMP
- %TEMP%\Machine\newWMI\~GLH0012.TMP
- %TEMP%\Machine\SAP & BW\Open Text\Livelink Imaging\~GLH0022.TMP
- %TEMP%\Machine\SAP & BW\Open Text\Livelink Imaging\~GLH0023.TMP
- %TEMP%\Machine\SAP & BW\Open Text\Document Pipelines\~GLH0021.TMP
- %TEMP%\Machine\SametimeAutoLogonFix\~GLH001f.TMP
- %TEMP%\Machine\SAP & BW\Open Text\~GLH0020.TMP
- %TEMP%\Machine\SAP & BW\Open Text\Scan\~GLH0024.TMP
- %TEMP%\Machine\SMS20\~GLH0028.TMP
- %TEMP%\Machine\SMS20\~GLH0029.TMP
- %TEMP%\Machine\SMS20\~GLH0027.TMP
- %TEMP%\Machine\SAPINI\~GLH0025.TMP
- %TEMP%\Machine\SitelistXML\~GLH0026.TMP
- %TEMP%\Machine\RupeeForadianFont\~GLH001e.TMP
- %TEMP%\Machine\NotesPresetFeeds\~GLH0016.TMP
- %TEMP%\Machine\OUAdmin\~GLH0017.TMP
- %TEMP%\Machine\NotesPresetFeeds\~GLH0015.TMP
- %TEMP%\Machine\NotesBuddyList\~GLH0013.TMP
- %TEMP%\Machine\NotesPresetFeeds\~GLH0014.TMP
- %TEMP%\Machine\OUAdmin\~GLH0018.TMP
- %TEMP%\Machine\RASPOST\~GLH001c.TMP
- %TEMP%\Machine\RupeeForadianFont\~GLH001d.TMP
- %TEMP%\Machine\PGFIX_PSEXEC\~GLH001b.TMP
- %TEMP%\Machine\PGFIX_PSEXEC\~GLH0019.TMP
- %TEMP%\Machine\PGFIX_PSEXEC\~GLH001a.TMP
Deletes the following files:
- C:\WBG\Utility\Local Area Connection-Machine-Cert.xml
- %TEMP%\GLW4.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
