Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Video Driver' = '%APPDATA%\ntdlr.exe'
Malicious functions
Injects code into
the following user processes:
- recov.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Microsoft\MSNMessenger]
- [<HKLM>\Software\Wow6432Node\DVD Audio Extractor\Settings]
- [<HKLM>\Software\Wow6432Node\F-Secure\BackWeb\iLauncher]
- [<HKLM>\SOFTWARE\Wow6432Node\Headlight\GetRight]
- [<HKCU>\Software\Valve\Half-Life\Settings]
- [<HKLM>\SOFTWARE\Wow6432Node\Ahead\InCD]
- [<HKCU>\Software\JoWooD\InstalledGames\IG2]
- [<HKLM>\SOFTWARE\Wow6432Node\Macromedia\Flash\7\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Macromedia\Fireworks\7\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Macromedia\Dreamweaver\7\Registration]
- [<HKCU>\Software\JSG\Matrix Saver V2]
- [<HKLM>\SOFTWARE\Wow6432Node\NuMega\SmartCheck]
- [<HKLM>\Software\Wow6432Node\OnlineTVPlayer\RegInfo]
- [<HKLM>\SOFTWARE\Wow6432Node\O&O\O&O Defrag\8.0\Pro\licenses]
- [<HKLM>\SOFTWARE\Wow6432Node\PowerQuest\PartitionMagic\8.0\UserInfo]
- [<HKCU>\Software\Passware\Windows Key\7\Registration]
- [<HKLM>\Software\Wow6432Node\EnTech\PowerStrip]
- [<HKLM>\Software\Wow6432Node\Steganos\SIAVPN]
- [<HKLM>\Software\Wow6432Node\TechSmith\SnagIt\8]
- [<HKLM>\SOFTWARE\Wow6432Node\TexasCalc\License]
- [<HKLM>\SOFTWARE\Wow6432Node\Pegasys Inc.\TMPGEnc DVD Author\1.0]
- [<HKLM>\SOFTWARE\Wow6432Node\TuneUp\Utilities\6.0]
- [<HKLM>\SOFTWARE\Wow6432Node\TuneUp\Utilities\7.0]
- [<HKLM>\SOFTWARE\Wow6432Node\Nullsoft\Winamp]
- [<HKCU>\Software\Valve\Day of Defeat\Settings]
- [<HKCU>\Software\IMVU\username]
- [<HKLM>\SOFTWARE\Wow6432Node\CyberLink\PowerProducer\3.0\UserReg]
- [<HKCU>\Software\Valve\Counter-Strike\Settings]
- [<HKCU>\Software\Microsoft\IdentityCRL]
- [<HKCU>\Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users]
- [<HKCU>\Software\America Online\AIM6\Passwords]
- [<HKCU>\Software\AIM\AIMPRO]
- [<HKCU>\Software\Yahoo\Pager]
- [<HKLM>\Software\Wow6432Node\Mirabilis\ICQ\NewOwners]
- [<HKCU>\Software\Mirabilis\ICQ\NewOwners]
- [<HKCU>\Software\Google\Google Talk\Accounts]
- [<HKCU>\Software\Paltalk]
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Identities\{91255D00-95D9-49F5-8E84-7C027F5283B7}\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKCU>\Identities\{91255D00-95D9-49F5-8E84-7C027F5283B7}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Software\Microsoft\Windows Live Mail]
- [<HKLM>\SOFTWARE\Wow6432Node\ACD Systems\PicaView]
- [<HKLM>\SOFTWARE\Wow6432Node\Adobe\Photoshop\7.0\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Elcom\Advanced PDF Password Recovery\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Elcom\Advanced PDF Password Recovery Pro\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Elcom\Advanced ZIP Password Recovery\Registration]
- [<HKCU>\Software\@stake\LC5\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\TechSmith\Camtasia Studio\4.0]
- [<HKLM>\Software\Wow6432Node\Techland\Chrome]
- [<HKLM>\Software\Wow6432Node\Codec Tweak Tool]
- [<HKLM>\SOFTWARE\Wow6432Node\Cyberlink\PowerDVD]
- [<HKCU>\Software\IMVU\password]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
Modifies file system
Creates the following files
- %TEMP%\software\recov.exe
- %TEMP%\software\protected.exe
- %APPDATA%\ntdlr.exe
- %TEMP%\software\offc.dat
- %TEMP%\software\dial.dat
- %TEMP%\software\chro.dat
- %TEMP%\software\ffox.dat
Sets the 'hidden' attribute to the following files
- %TEMP%\software\recov.exe
- %TEMP%\software\protected.exe
Deletes the following files
- %TEMP%\software\offc.dat
- %TEMP%\software\dial.dat
- %TEMP%\software\chro.dat
- %TEMP%\software\ffox.dat
Network activity
Connects to
- 'bl###shades.ru':8080
UDP
- DNS ASK st####ze.sytes.net
- DNS ASK bl###shades.ru
Miscellaneous
Creates and executes the following
- '%TEMP%\software\recov.exe'
- '%TEMP%\software\protected.exe'
- '%APPDATA%\ntdlr.exe'
- '%TEMP%\software\recov.exe' /stext "%TEMP%\Software\offc.dat"
- '%TEMP%\software\recov.exe' /stext "%TEMP%\Software\mess.dat"
- '%TEMP%\software\recov.exe' /stext "%TEMP%\Software\mail.dat"
- '%TEMP%\software\recov.exe' /stext "%TEMP%\Software\dial.dat"
- '%TEMP%\software\recov.exe' /stext "%TEMP%\Software\chro.dat"
- '%TEMP%\software\recov.exe' /stext "%TEMP%\Software\iexp.dat"
- '%TEMP%\software\recov.exe' /stext "%TEMP%\Software\ptsg.dat"
- '%TEMP%\software\recov.exe' /stext "%TEMP%\Software\ffox.dat"
- '%APPDATA%\ntdlr.exe' ' (with hidden window)
