Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Cleanup' = 'C:\cleanup.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'AnntraxCoder' = '<Full path to virus>'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\glbkflo] 'Start' = '00000000'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Registry Editor (RegEdit)
Creates and executes the following:
- '<Current directory>\abismo.exe' /nogui /reboot WindowsLog.txt
Attempts to shut down the Windows operating system.
Modifies file system :
Creates the following files:
- C:\cleanup.bat
- C:\zip.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\flashplayer[1]
- C:\cleanup.exe
- <Current directory>\abismo.exe
- <Current directory>\WindowsLog.txt
- <DRIVERS>\hjopsuw.sys
- %PROGRAM_FILES%\gxwssep.txt
Network activity:
Connects to:
- 'ww###########-com-ie-explorer.googlecode.com':443
- 'ge#.#dobe.com':80
- 'localhost':1037
- 'si########3929.hospedagemdesites.ws':80
TCP:
HTTP GET requests:
- ge#.#dobe.com/br/flashplayer/
HTTP POST requests:
- si########3929.hospedagemdesites.ws/aeiou/index.php
UDP:
- DNS ASK ge#.#dobe.com
- DNS ASK ww###########-com-ie-explorer.googlecode.com
- DNS ASK si########3929.hospedagemdesites.ws
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'
Modifies value of AutoConfigURL parameter
