Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\ir41_qc.dll with %TEMP%\18.tmp
- <SYSTEM32>\ir32_32.dll with %TEMP%\1A.tmp
- <SYSTEM32>\libxml2.dll with %TEMP%\14.tmp
- <SYSTEM32>\dbmsrpcn.dll with %TEMP%\16.tmp
- <SYSTEM32>\jgaw400.dll with %TEMP%\1C.tmp
- <SYSTEM32>\msvbvm50.dll with %TEMP%\24.tmp
- <SYSTEM32>\liblwres.dll with %TEMP%\26.tmp
- <SYSTEM32>\cliconfg.exe with %TEMP%\1E.tmp
- <SYSTEM32>\xpssvcs.dll with %TEMP%\20.tmp
- <SYSTEM32>\mapistub.dll with %TEMP%\6.tmp
- <SYSTEM32>\libisccfg.dll with %TEMP%\8.tmp
- <SYSTEM32>\ir41_qcx.dll with %TEMP%\2.tmp
- <SYSTEM32>\WindowsCodecs.dll with %TEMP%\4.tmp
- <SYSTEM32>\libmysql.dll with %TEMP%\A.tmp
- <SYSTEM32>\prntvpt.dll with %TEMP%\10.tmp
- <SYSTEM32>\jgpl400.dll with %TEMP%\12.tmp
- <SYSTEM32>\WMPhoto.dll with %TEMP%\C.tmp
- <SYSTEM32>\xpsshhdr.dll with %TEMP%\E.tmp
Modifies master boot record (MBR).
Malicious functions:
Creates and executes the following:
- %TEMP%\WLXPL.exe \444x
Modifies file system :
Creates the following files:
- %TEMP%\WLXPL.exe
- %WINDIR%\udeqp.bcx
- %TEMP%\WLXPhotoLibraryMain.dll
Deletes the following files:
- %TEMP%\1D.tmp
- %TEMP%\1F.tmp
- %TEMP%\1B.tmp
- %TEMP%\17.tmp
- %TEMP%\19.tmp
- %TEMP%\25.tmp
- %TEMP%\27.tmp
- %TEMP%\23.tmp
- %TEMP%\21.tmp
- %TEMP%\22.tmp
- %TEMP%\9.tmp
- %TEMP%\B.tmp
- %TEMP%\7.tmp
- %TEMP%\3.tmp
- %TEMP%\5.tmp
- %TEMP%\13.tmp
- %TEMP%\15.tmp
- %TEMP%\11.tmp
- %TEMP%\D.tmp
- %TEMP%\F.tmp
Moves the following system files:
- from <SYSTEM32>\ir41_qc.dll to %TEMP%\19.tmp
- from <SYSTEM32>\ir32_32.dll to %TEMP%\1B.tmp
- from <SYSTEM32>\libxml2.dll to %TEMP%\15.tmp
- from <SYSTEM32>\dbmsrpcn.dll to %TEMP%\17.tmp
- from <SYSTEM32>\jgaw400.dll to %TEMP%\1D.tmp
- from <SYSTEM32>\msvbvm50.dll to %TEMP%\25.tmp
- from <SYSTEM32>\liblwres.dll to %TEMP%\27.tmp
- from <SYSTEM32>\cliconfg.exe to %TEMP%\1F.tmp
- from <SYSTEM32>\xpssvcs.dll to %TEMP%\21.tmp
- from <SYSTEM32>\mapistub.dll to %TEMP%\7.tmp
- from <SYSTEM32>\libisccfg.dll to %TEMP%\9.tmp
- from <SYSTEM32>\ir41_qcx.dll to %TEMP%\3.tmp
- from <SYSTEM32>\WindowsCodecs.dll to %TEMP%\5.tmp
- from <SYSTEM32>\libmysql.dll to %TEMP%\B.tmp
- from <SYSTEM32>\prntvpt.dll to %TEMP%\11.tmp
- from <SYSTEM32>\jgpl400.dll to %TEMP%\13.tmp
- from <SYSTEM32>\WMPhoto.dll to %TEMP%\D.tmp
- from <SYSTEM32>\xpsshhdr.dll to %TEMP%\F.tmp
Moves itself:
- from <Full path to virus> to %TEMP%\1.tmp
