Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305134.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305134.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305129.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305129.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305139.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305139.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305157.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305157.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305147.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305147.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 201210230519.exe' = '%CommonProgramFiles%\svchtst.exe 201210230519.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 201210230515.exe' = '%CommonProgramFiles%\svchtst.exe 201210230515.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305113.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305113.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305124.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305124.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305119.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305119.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 201210230522.exe' = '%CommonProgramFiles%\svchtst.exe 201210230522.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305247.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305247.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305242.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305242.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305251.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305251.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 201210230532.exe' = '%CommonProgramFiles%\svchtst.exe 201210230532.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305254.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305254.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305225.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305225.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 201210230528.exe' = '%CommonProgramFiles%\svchtst.exe 201210230528.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305230.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305230.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305238.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305238.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305233.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305233.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 201210230510.exe' = '%CommonProgramFiles%\svchtst.exe 201210230510.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102304937.exe' = '%CommonProgramFiles%\svchtst.exe 2012102304937.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102304932.exe' = '%CommonProgramFiles%\svchtst.exe 2012102304932.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102304941.exe' = '%CommonProgramFiles%\svchtst.exe 2012102304941.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102304950.exe' = '%CommonProgramFiles%\svchtst.exe 2012102304950.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102304944.exe' = '%CommonProgramFiles%\svchtst.exe 2012102304944.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102304913.exe' = '%CommonProgramFiles%\svchtst.exe 2012102304913.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 201210230497.exe' = '%CommonProgramFiles%\svchtst.exe 201210230497.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102304919.exe' = '%CommonProgramFiles%\svchtst.exe 2012102304919.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102304929.exe' = '%CommonProgramFiles%\svchtst.exe 2012102304929.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102304925.exe' = '%CommonProgramFiles%\svchtst.exe 2012102304925.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102304953.exe' = '%CommonProgramFiles%\svchtst.exe 2012102304953.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305039.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305039.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305034.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305034.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305047.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305047.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305055.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305055.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305051.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305051.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 201210230504.exe' = '%CommonProgramFiles%\svchtst.exe 201210230504.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102304957.exe' = '%CommonProgramFiles%\svchtst.exe 2012102304957.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305010.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305010.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305028.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305028.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ':\Program Files\Common Files\svchtst.exe 2012102305023.exe' = '%CommonProgramFiles%\svchtst.exe 2012102305023.exe'
Malicious functions:
Creates and executes the following:
- %CommonProgramFiles%\svchtst.exe 2012102305134.exe
- %CommonProgramFiles%\svchtst.exe 2012102305129.exe
- %CommonProgramFiles%\svchtst.exe 2012102305139.exe
- %CommonProgramFiles%\svchtst.exe 2012102305157.exe
- %CommonProgramFiles%\svchtst.exe 2012102305147.exe
- %CommonProgramFiles%\svchtst.exe 2012102305124.exe
- %CommonProgramFiles%\svchtst.exe 201210230515.exe
- %CommonProgramFiles%\svchtst.exe 201210230510.exe
- %CommonProgramFiles%\svchtst.exe 201210230519.exe
- %CommonProgramFiles%\svchtst.exe 2012102305119.exe
- %CommonProgramFiles%\svchtst.exe 2012102305113.exe
- %CommonProgramFiles%\svchtst.exe 2012102305247.exe
- %CommonProgramFiles%\svchtst.exe 2012102305242.exe
- %CommonProgramFiles%\svchtst.exe 2012102305251.exe
- %CommonProgramFiles%\svchtst.exe 201210230532.exe
- %CommonProgramFiles%\svchtst.exe 2012102305254.exe
- %CommonProgramFiles%\svchtst.exe 2012102305238.exe
- %CommonProgramFiles%\svchtst.exe 201210230528.exe
- %CommonProgramFiles%\svchtst.exe 201210230522.exe
- %CommonProgramFiles%\svchtst.exe 2012102305225.exe
- %CommonProgramFiles%\svchtst.exe 2012102305233.exe
- %CommonProgramFiles%\svchtst.exe 2012102305230.exe
- %CommonProgramFiles%\svchtst.exe 2012102305055.exe
- %CommonProgramFiles%\svchtst.exe 2012102304932.exe
- %CommonProgramFiles%\svchtst.exe 2012102304929.exe
- %CommonProgramFiles%\svchtst.exe 2012102304937.exe
- %CommonProgramFiles%\svchtst.exe 2012102304944.exe
- %CommonProgramFiles%\svchtst.exe 2012102304941.exe
- %CommonProgramFiles%\svchtst.exe 2012102304925.exe
- C:\ЖЖЅвФЄЛШЈЁРЮёДУІЕМРтєЕЈ©.exe
- C:\417.exe
- %CommonProgramFiles%\svchtst.exe 201210230497.exe
- %CommonProgramFiles%\svchtst.exe 2012102304919.exe
- %CommonProgramFiles%\svchtst.exe 2012102304913.exe
- %CommonProgramFiles%\svchtst.exe 2012102305034.exe
- %CommonProgramFiles%\svchtst.exe 2012102305028.exe
- %CommonProgramFiles%\svchtst.exe 2012102305039.exe
- %CommonProgramFiles%\svchtst.exe 2012102305051.exe
- %CommonProgramFiles%\svchtst.exe 2012102305047.exe
- %CommonProgramFiles%\svchtst.exe 2012102305023.exe
- %CommonProgramFiles%\svchtst.exe 2012102304953.exe
- %CommonProgramFiles%\svchtst.exe 2012102304950.exe
- %CommonProgramFiles%\svchtst.exe 2012102304957.exe
- %CommonProgramFiles%\svchtst.exe 2012102305010.exe
- %CommonProgramFiles%\svchtst.exe 201210230504.exe
Executes the following:
- <SYSTEM32>\taskkill.exe /f /im Ksafetray.exe
Hides the following processes:
Modifies file system :
Creates the following files:
- C:\ЖЖЅвФЄЛШЈЁРЮёДУІЕМРтєЕЈ©.exe
- C:\417.exe
Sets the 'hidden' attribute to the following files:
- C:\ЖЖЅвФЄЛШЈЁРЮёДУІЕМРтєЕЈ©.exe
- C:\417.exe
Moves the following files:
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305134.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305129.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305139.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305157.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305147.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 201210230519.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 201210230515.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305113.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305124.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305119.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 201210230522.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305247.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305242.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305251.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 201210230532.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305254.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305225.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 201210230528.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305230.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305238.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305233.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 201210230510.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102304937.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102304932.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102304941.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102304950.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102304944.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102304913.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 201210230497.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102304919.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102304929.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102304925.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102304953.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305039.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305034.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305047.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305055.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305051.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 201210230504.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102304957.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305010.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305028.exe
- from C:\417.exe to %CommonProgramFiles%\svchtst.exe 2012102305023.exe
Network activity:
Connects to:
- 'xx#####1983.gicp.net':9000
UDP:
- DNS ASK xx#####1983.gicp.net
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
