Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'O00ucSib3oGaHW78234A' = '<SYSTEM32>\AV Protection 2011v121.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'hXXwVlOtz0yAiD2' = '%APPDATA%\dwme.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'VivD3nF4aHJ7EgZ8234A' = '%APPDATA%\Lcc11ibDoG4m6W7\AV Protection 2011v121.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '0A1.exe' = '%ProgramFiles(x86)%\LP\649A\0A1.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Security Center
- Windows Defender
blocks the following features:
- Windows Action Center
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Far\Plugins\FTP\Hosts]
- [HKCU\Software\BPFTP]
- [HKCU\Software\TurboFTP]
- [HKCU\Software\Sota\FFFTP]
- [HKCU\Software\Sota\FFFTP\Options]
- [HKCU\Software\CoffeeCup Software\Internet\Profiles]
- [HKCU\Software\FTPWare\COREFTP\Sites]
- [HKCU\Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224]
- [HKCU\Software\VanDyke\SecureFX]
- [HKCU\Software\Cryer\WebSitePublisher]
- [HKLM\Software\Wow6432Node\NCH Software\ClassicFTP\FTPAccounts]
- [HKCU\Software\NCH Software\ClassicFTP\FTPAccounts]
- [HKCU\Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar]
- [HKCU\SOFTWARE\NCH Software\Fling\Accounts]
- [HKCU\Software\FTPClient\Sites]
- [HKLM\Software\Wow6432Node\FTPClient\Sites]
- [HKCU\Software\SoftX.org\FTPClient\Sites]
- [HKLM\Software\Wow6432Node\SoftX.org\FTPClient\Sites]
- [HKCU\Software\Martin Prikryl]
- [HKLM\Software\Wow6432Node\Martin Prikryl]
- [HKCU\Software\South River Technologies\WebDrive\Connections]
- [HKLM\Software\Wow6432Node\South River Technologies\WebDrive\Connections]
- [HKCU\Software\FlashPeak\BlazeFtp\Settings]
- [HKCU\SOFTWARE\Wow6432Node\Robo-FTP 3.7\FTPServers]
- [HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\FTPServers]
- [HKCU\Software\BPFTP\Bullet Proof FTP\Options]
- [HKCU\Software\BulletProof Software\BulletProof FTP Client\Options]
- [HKCU\Software\BulletProof Software\BulletProof FTP Client\Main]
- [HKCU\Software\BPFTP\Bullet Proof FTP\Main]
- [HKLM\Software\FileZilla Client]
- [HKCU\Software\Far\SavedDialogHistory\FTPHost]
- [HKCU\Software\Far2\SavedDialogHistory\FTPHost]
- [HKCU\Software\Ghisler\Windows Commander]
- [HKCU\Software\Ghisler\Total Commander]
- [HKLM\Software\Wow6432Node\Ghisler\Windows Commander]
- [HKLM\Software\Ghisler\Windows Commander]
- [HKLM\Software\Wow6432Node\Ghisler\Total Commander]
- [HKLM\Software\Ghisler\Total Commander]
- [HKCU\Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar]
- [HKCU\Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar]
- [HKCU\Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar]
- [HKCU\SOFTWARE\Wow6432Node\Robo-FTP 3.7\Scripts]
- [HKLM\SOFTWARE\Wow6432Node\NCH Software\Fling\Accounts]
- [HKCU\Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar]
- [HKCU\Software\FlashFXP\3]
- [HKCU\Software\FlashFXP]
- [HKLM\Software\Wow6432Node\FlashFXP\3]
- [HKLM\Software\FlashFXP\3]
- [HKLM\Software\Wow6432Node\FlashFXP]
- [HKLM\Software\FlashFXP]
- [HKCU\Software\FileZilla]
- [HKCU\Software\FileZilla Client]
- [HKLM\Software\Wow6432Node\FileZilla]
- [HKLM\Software\FileZilla]
- [HKLM\Software\Wow6432Node\FileZilla Client]
- [HKCU\Software\Far2\Plugins\FTP\Hosts]
- [HKCU\Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar]
- [HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\Scripts]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
Modifies file system
Creates the following files
- %TEMP%\pijc64b.tmp
- %ProgramFiles(x86)%\lp\649a\0a1.exe
- %HOMEPATH%\desktop\av protection 2011.lnk
- %APPDATA%\microsoft\windows\start menu\programs\av protection 2011\av protection 2011.lnk
- %APPDATA%\pwkk8frl9\av protection 2011.ico
- %APPDATA%\ldr.ini
- %TEMP%\pij147a.tmp
- %APPDATA%\ab488\861a.b48
- %TEMP%\pij144b.tmp
- %TEMP%\pijee55.tmp
- %TEMP%\pijee44.tmp
- %APPDATA%\dwme.exe
- %TEMP%\dwme.exe
- %WINDIR%\syswow64\av protection 2011v121.exe
- %TEMP%\pijc66b.tmp
- %APPDATA%\lcc11ibdog4m6w7\av protection 2011v121.exe
- %ProgramFiles(x86)%\lp\649a\7510.tmp
Deletes the following files
- %TEMP%\pijc64b.tmp
- %TEMP%\pijc66b.tmp
- %TEMP%\pijee44.tmp
- %TEMP%\pijee55.tmp
- %TEMP%\pij144b.tmp
- %TEMP%\pij147a.tmp
- %WINDIR%\syswow64\av protection 2011v121.exe
Modifies the HOSTS file.
Network activity
Connects to
- 'google.com':80
- 'ar####dlegion.com':80
TCP
HTTP GET requests
- http://google.com/
- http://ar####dlegion.com/716354_m61.png?pr#########################################
UDP
- DNS ASK google.com
- DNS ASK pi####ewonline.com
- DNS ASK re###esys5.com
- DNS ASK ar####dlegion.com
- DNS ASK gi####oolstome.com
- DNS ASK re####frommains.com
- DNS ASK li###klubs.com
- DNS ASK TR#####SDATAFORME.COM
Miscellaneous
Searches for the following windows
- ClassName: 'npkjangh' WindowName: 'jbaohnjmedhkg'
- ClassName: '' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Media Center Tray Applet' WindowName: ''
- ClassName: '' WindowName: 'View Available Networks'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Creates and executes the following
- '%TEMP%\dwme.exe'
- '%APPDATA%\dwme.exe' auto
- '%WINDIR%\syswow64\av protection 2011v121.exe' Protection 2011v121.exe 5985<Full path to file>
- '%APPDATA%\lcc11ibdog4m6w7\av protection 2011v121.exe' Protection 2011v121.exe 5985%WINDIR%\SysWOW64\AV Protection 2011v121.exe
- '%APPDATA%\dwme.exe' start%APPDATA%\AB488\1EB64.exe%%APPDATA%\AB488
- '%ProgramFiles(x86)%\lp\649a\7510.tmp'
- '%APPDATA%\dwme.exe' start%ProgramFiles(x86)%\8861A\lvvm.exe%%ProgramFiles(x86)%\8861A
Executes the following
- '%WINDIR%\explorer.exe'
