Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Win32.HLLM.Limar.4672

Added to the Dr.Web virus database: 2015-06-19

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • %HOMEPATH%\Start Menu\Programs\Startup\EezhVHwF2vM.exe
Malicious functions:
Executes the following:
  • '<SYSTEM32>\rundll32.exe' fldrclnr.dll,Wizard_RunDLL
  • '<SYSTEM32>\svchost.exe' netsvcs
  • '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
  • %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
  • %TEMP%\12.tmp
  • %TEMP%\13.tmp
  • %TEMP%\14.tmp
  • %TEMP%\F.tmp
  • %TEMP%\10.tmp
  • %TEMP%\11.tmp
  • %TEMP%\15.tmp
  • %TEMP%\19.tmp
  • %TEMP%\1A.tmp
  • %TEMP%\1B.tmp
  • %TEMP%\16.tmp
  • %TEMP%\17.tmp
  • %TEMP%\18.tmp
  • %TEMP%\E.tmp
  • %TEMP%\~TM4.tmp
  • %TEMP%\~TM5.tmp
  • %TEMP%\6.tmp
  • %TEMP%\1.tmp
  • %TEMP%\2.tmp
  • %TEMP%\3.tmp
  • %TEMP%\7.tmp
  • %TEMP%\B.tmp
  • %TEMP%\C.tmp
  • %TEMP%\D.tmp
  • %TEMP%\8.tmp
  • %TEMP%\9.tmp
  • %TEMP%\A.tmp
Sets the 'hidden' attribute to the following files:
  • %HOMEPATH%\Start Menu\Programs\Startup\EezhVHwF2vM.exe
Deletes the following files:
  • %TEMP%\12.tmp
  • %TEMP%\13.tmp
  • %TEMP%\14.tmp
  • %TEMP%\6.tmp
  • %TEMP%\10.tmp
  • %TEMP%\11.tmp
  • %TEMP%\15.tmp
  • %TEMP%\19.tmp
  • %TEMP%\1A.tmp
  • %TEMP%\1B.tmp
  • %TEMP%\16.tmp
  • %TEMP%\17.tmp
  • %TEMP%\18.tmp
  • %TEMP%\F.tmp
  • %TEMP%\~TM4.tmp
  • %TEMP%\~TM5.tmp
  • %TEMP%\7.tmp
  • %TEMP%\1.tmp
  • %TEMP%\2.tmp
  • %TEMP%\3.tmp
  • %TEMP%\8.tmp
  • %TEMP%\C.tmp
  • %TEMP%\D.tmp
  • %TEMP%\E.tmp
  • %TEMP%\9.tmp
  • %TEMP%\A.tmp
  • %TEMP%\B.tmp
Deletes itself.
Network activity:
Connects to:
  • 'ne####tuottnee.org':80
  • 'mi####iptonik.org':80
TCP:
HTTP POST requests:
  • http://mi####iptonik.org/nrclswp.phtm
  • http://ne####tuottnee.org/dosndmpgjqyfagddoznyniknqucekpeuduhjjcamwlvuogbnddeiimrtna.7z
  • http://mi####iptonik.org/yaaaaaacxmmimlcqms.tpl
  • http://mi####iptonik.org/tyelz.7z
UDP:
  • DNS ASK ne####tuottnee.org
  • DNS ASK mi####iptonik.org
Miscellaneous:
Searches for the following windows:
  • ClassName: 'SysListView32' WindowName: ''
  • ClassName: 'BaseBar' WindowName: 'ChanApp'
  • ClassName: 'OleMainThreadWndClass' WindowName: ''
  • ClassName: 'CSCHiddenWindow' WindowName: ''
  • ClassName: 'SystemTray_Main' WindowName: ''
  • ClassName: 'Proxy Desktop' WindowName: ''
  • ClassName: 'IEFrame' WindowName: ''
  • ClassName: 'Shell_TrayWnd' WindowName: ''
  • ClassName: 'MozillaWindowClass' WindowName: ''
  • ClassName: 'Chrome_WidgetWin_0' WindowName: ''
  • ClassName: 'OperaWindowClass' WindowName: ''