Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'bdv' = 'C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\bdv.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\aUtoRuN.inF
Malicious functions:
Executes the following:
- '<SYSTEM32>\attrib.exe' nul /f /c if exist j:\nul attrib +s +h +r +a j:\Photos\*.*
- '<SYSTEM32>\attrib.exe' nul /f /c if exist v:\nul attrib +s +h +r +a v:\Audio\*.*
- '<SYSTEM32>\attrib.exe' nul /f /c if exist l:\nul xcopy C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\*.* l:\ /h /k /c /e /y
- '<SYSTEM32>\xcopy.exe' C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\*.* e:\ /h /k /c /e /y
- '<SYSTEM32>\attrib.exe' nul /f /c if exist t:\nul attrib +s +h +r +a t:\Videoc~1\*.*
- '<SYSTEM32>\attrib.exe' nul /f /c if exist r:\nul attrib +s +h +r +a r:\Videoc~1\*.*
- '<SYSTEM32>\attrib.exe' +s +h +r +a e:\Audio\*.*
- '<SYSTEM32>\attrib.exe' nul /f /c if exist u:\nul attrib +s +h +r +a u:\Videoc~1\*.*
- '<SYSTEM32>\xcopy.exe' nul /f /c if exist <Drive name for removable media>:\nul attrib +s +h +r +a <Drive name for removable media>:\Videoc~1\*.*
- '<SYSTEM32>\attrib.exe' nul /f /c if exist t:\nul attrib +s +h +r +a t:\MyMusi~1
- '<SYSTEM32>\attrib.exe' nul /f /c if exist h:\nul attrib +s +h +r +a h:\Audio\*.*
- '<SYSTEM32>\attrib.exe' +s +h +r +a e:\Videoc~1\*.*
- '<SYSTEM32>\attrib.exe' nul /f /c if exist o:\nul xcopy C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\*.* o:\ /h /k /c /e /y
- '<SYSTEM32>\attrib.exe' nul /f /c if exist n:\nul xcopy C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\*.* n:\ /h /k /c /e /y
- '<SYSTEM32>\attrib.exe' nul /f /c if exist l:\nul attrib +s +h +r +a l:\MyMusi~1
- '<SYSTEM32>\attrib.exe' nul /f /c if exist r:\nul xcopy C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\*.* r:\ /h /k /c /e /y
- '<SYSTEM32>\attrib.exe' +s +h +r +a e:\MyMusi~1\*.*
- '<SYSTEM32>\attrib.exe' +s +h +r +a e:\MyMusi~1
- '<SYSTEM32>\attrib.exe' +s +h +r +a e:\Videos\*.*
- '<SYSTEM32>\attrib.exe' +s +h +r +a e:\Video\*.*
- '<SYSTEM32>\xcopy.exe' BDV.exe C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\ /h /k /y
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\BDv.bat" "
- '<SYSTEM32>\attrib.exe' +s +h +r +a C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\*.*
- '<SYSTEM32>\wscript.exe' "C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\bdv.vbs"
- '<SYSTEM32>\attrib.exe' +s +h +r +a e:\Mp3\*.*
- '<SYSTEM32>\attrib.exe' nul /f /c if exist h:\nul attrib +s +h +r +a h:\Sounds\*.*
- '<SYSTEM32>\attrib.exe' nul /f /c if exist t:\nul attrib +s +h +r +a t:\Received\*.*
- '<SYSTEM32>\attrib.exe' +s +h +r +a e:\Received\*.*
- '<SYSTEM32>\attrib.exe' +s +h +r +a e:\Sounds\*.*
- '<SYSTEM32>\attrib.exe' +s +h +r +a e:\Music\*.*
- '<SYSTEM32>\attrib.exe' nul /f /c if exist g:\nul attrib +s +h +r +a g:\Sounds\*.*
- '<SYSTEM32>\wscript.exe' /pid=2832
Injects code into
the following system processes:
- <SYSTEM32>\attrib.exe
- <SYSTEM32>\xcopy.exe
- <SYSTEM32>\cmd.exe
Modifies file system :
Creates the following files:
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\aUtoRuN.inF
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\bdv.vbs
- %TEMP%\1.tmp\BDv.bat
Sets the 'hidden' attribute to the following files:
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\BDV\aUtoRuN.inF
