Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Creates and executes the following:
- C:\eejq.exe (downloaded from the Internet)
- C:\750234914 (downloaded from the Internet)
- C:\xrlu.exe (downloaded from the Internet)
- C:\dvovwc.exe (downloaded from the Internet)
- C:\ooqtyf.exe (downloaded from the Internet)
- C:\tuwhay.exe (downloaded from the Internet)
- C:\yjixhlb.exe (downloaded from the Internet)
- C:\ixqriv.exe (downloaded from the Internet)
- C:\iieldyt.exe (downloaded from the Internet)
- C:\biabqjx.exe (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\hrobc[1].php
- C:\xrlu.exe
- C:\eejq.exe
- C:\750234914
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\lebbcd[1].php
- C:\dvovwc.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\vrbopg[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\vqnnb[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\leoolvw[1].php
- C:\ooqtyf.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\xqdres[1].php
- C:\tuwhay.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\adjjkma[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\vsoptt[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\clzmanoopc[1].php
- C:\yjixhlb.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\unaooftg[1].php
- C:\iieldyt.exe
- C:\biabqjx.exe
- C:\ixqriv.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\mollmz[1].php
Deletes itself.
Network activity:
Connects to:
- 'ca###epro.com':80
TCP:
HTTP GET requests:
- ca###epro.com/gzftg/hrobc.php
- ca###epro.com/gzftg/lebbcd.php
- ca###epro.com/gzftg/leoolvw.php
- ca###epro.com/gzftg/vrbopg.php?ad###############################################
- ca###epro.com/gzftg/vqnnb.php
- ca###epro.com/gzftg/xqdres.php?ad########
- ca###epro.com/gzftg/vsoptt.php
- ca###epro.com/gzftg/clzmanoopc.php
- ca###epro.com/gzftg/adjjkma.php
- ca###epro.com/gzftg/unaooftg.php
- ca###epro.com/gzftg/mollmz.php
UDP:
- DNS ASK ca###epro.com
