Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Win32.HLLM.Beagle.357

Added to the Dr.Web virus database: 2009-10-26

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'drvsyskit' = '%APPDATA%\drivers\winupgro.exe'
Sets the following service settings
  • [<HKLM>\System\CurrentControlSet\Services\111111s1ro1s1a] 'Start' = '00000001'
  • [<HKLM>\System\CurrentControlSet\Services\111111s1ro1s1a] 'ImagePath' = '%APPDATA%\drivers\111wfs1intwq.sys'
Creates the following services
  • '111111s1ro1s1a' %APPDATA%\drivers\111wfs1intwq.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
  • Windows Firewall
  • Windows Update
  • Windows Security Center
  • Windows Defender
blocks the following features:
  • User Account Control (UAC)
Searches for windows to
detect analytical utilities:
  • ClassName: 'OLLYDBG', WindowName: ''
  • ClassName: 'GBDYLLO', WindowName: ''
  • ClassName: 'pediy06', WindowName: ''
  • ClassName: 'FilemonClass', WindowName: ''
  • ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
  • ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
  • ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
  • ClassName: 'RegmonClass', WindowName: ''
  • ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
  • %APPDATA%\drivers\winupgro.exe
  • %APPDATA%\drivers\11s11ro1s1a2.sys
  • %APPDATA%\drivers\111wfs1intwq.sys
  • %WINDIR%\temp\udda3cd.tmp
  • %APPDATA%\drivers\downld\1074909.exe
  • %APPDATA%\drivers\downld\1077124.exe
  • %APPDATA%\drivers\downld\1077951.exe
  • %APPDATA%\drivers\downld\1079261.exe
  • %APPDATA%\drivers\downld\1081102.exe
  • %APPDATA%\drivers\downld\1082334.exe
  • %APPDATA%\drivers\downld\1087233.exe
  • %APPDATA%\drivers\downld\1088465.exe
  • %APPDATA%\drivers\downld\1088684.exe
Deletes the following files
  • %WINDIR%\temp\udda3cd.tmp
Network activity
Connects to
  • 'google.com':80
  • 'ab##erm.sk':80
  • 'ab##erm.sk':443
  • 'al#####anciarural.es':80
  • 'au####uzynas.net':80
  • 'au#####.autogidas.lt':80
  • 'au#####.autogidas.lt':443
  • 'az###.700megs.com':80
  • 'az###.gbs.me':80
  • 'ww##.gbs.me':80
  • 'ba###estate.com':80
  • 'bi###yorsan.com':80
  • 'ca###vuoi.com':80
TCP
HTTP GET requests
  • http://ab##erm.sk/xyz.php?cr#####
  • http://al#####anciarural.es/xyz.php?cr#####
  • http://au#####.autogidas.lt/xyz.php?cr#####
  • http://ww##.##ure.700megs.com/xyz.php?cr#################################################
  • http://ww##.gbs.me/?te###########################################################################################################################################################################...
  • http://ba###estate.com/xyz.php?cr#####
  • http://ca###vuoi.com/xyz.php?cr#####
Other
  • 'ab##erm.sk':443
  • 'au#####.autogidas.lt':443
UDP
  • DNS ASK google.com
  • DNS ASK bi###yorsan.com
  • DNS ASK bi#######elixna.altervista.org
  • DNS ASK ba###estate.com
  • DNS ASK ba####.110mb.com
  • DNS ASK ww##.gbs.me
  • DNS ASK az###.gbs.me
  • DNS ASK ww##.##ure.700megs.com
  • DNS ASK az###.700megs.com
  • DNS ASK au#####.autogidas.lt
  • DNS ASK au####uzynas.net
  • DNS ASK ar##.com.ve
  • DNS ASK ap###odas.org
  • DNS ASK an#####eventos.com.ar
  • DNS ASK al#####anciarural.es
  • DNS ASK ah#####nicekesan.com
  • DNS ASK ad##.net
  • DNS ASK ab##erm.sk
  • DNS ASK ca###vuoi.com
  • DNS ASK cd###arket.it
Miscellaneous
Searches for the following windows
  • ClassName: '18467-41' WindowName: ''
  • ClassName: 'AavmMessageClass' WindowName: ''
Creates and executes the following
  • '%APPDATA%\drivers\winupgro.exe'
  • '%APPDATA%\drivers\winupgro.exe' ' (with hidden window)