Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Internet Explorer Content Server' = '%PROGRAM_FILES%\Internet Explorer\PLUGINS\cssrrm.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Internet Explorer Content Server' = '%PROGRAM_FILES%\Internet Explorer\PLUGINS\cssrrm.exe'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\Internet Explorer\PLUGINS\cssrrm.exe -rm "<Full path to virus>"
Executes the following:
- <SYSTEM32>\net1.exe stop wscsvc
- <SYSTEM32>\net1.exe stop SharedAccess
- <SYSTEM32>\net1.exe stop wuauserv
- <SYSTEM32>\net.exe stop wscsvc
- <SYSTEM32>\net.exe stop SharedAccess
- <SYSTEM32>\net.exe stop wuauserv
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\n09230945[1].asp
- %PROGRAM_FILES%\Internet Explorer\PLUGINS\IEVML32v.dll
- %PROGRAM_FILES%\Internet Explorer\PLUGINS\cssrrm.exe
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\n09230945[1].asp
Deletes itself.
Network activity:
Connects to:
- 'www.wh###smyip.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- www.wh###smyip.com/automation/n09230945.asp
UDP:
- DNS ASK pi##.##atsmyip.com.au
- DNS ASK my#p.dk
- DNS ASK www.wh###smyip.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Trend Micro HijackThis - v2.0.2'
- ClassName: '' WindowName: 'Trend Micro HijackThis'
- ClassName: '' WindowName: 'Setup - TrojanHunter'
- ClassName: '' WindowName: 'Norman Security Suite - InstallShield Wizard'
- ClassName: '' WindowName: 'Faronics Anti-Executable Standard'
- ClassName: '' WindowName: 'COMODO BOClean lifetime free license'
- ClassName: '' WindowName: 'Kaspersky Anti-Hacker Setup '
- ClassName: '' WindowName: 'ESET Smart Security Setup'
- ClassName: '' WindowName: 'Setup - Online Armor'
- ClassName: '' WindowName: 'Comodo BOClean 4.25 Setup'
- ClassName: '' WindowName: 'Setup - Anti Trojan Elite'
- ClassName: '' WindowName: 'Tiny Desktop Firewall 2005 - Setup Wizard'
- ClassName: '' WindowName: 'Sunbelt Personal Firewall - InstallShield Wizard'
- ClassName: '' WindowName: 'Outpost Firewall Pro Setup'
- ClassName: '' WindowName: 'Setup - DiamondCS ProcessGuard'
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: 'Norton AntiBot - InstallShield Wizard'
- ClassName: '' WindowName: 'COMODO Firewall Pro Installer'
- ClassName: '' WindowName: 'Webroot Desktop Firewall - InstallShield Wizard'
- ClassName: '' WindowName: 'Setup - Spybot - Search & Destroy'
- ClassName: '' WindowName: 'Setup - PC Tools Firewall Plus'
- ClassName: '' WindowName: 'ZoneAlarm Pro Installation'
- ClassName: '' WindowName: 'Jetico Personal Firewall Setup - v 2.0.1.2'
