Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\TpphSvc] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- <SYSTEM32>\tpprhost.exe /INSTALL /SILENT
Executes the following:
- %WINDIR%\sleep.exe 5
- <SYSTEM32>\cmd.exe /c ""<Current directory>\cls$$$$-.bat" "
Modifies file system :
Creates the following files:
- %HOMEPATH%\Favorites\GSSHOP.url
- %HOMEPATH%\Favorites\gseshop.url
- %HOMEPATH%\Favorites\GS샵.url
- %HOMEPATH%\Favorites\gmarket.url
- %HOMEPATH%\Favorites\GS SHOP.url
- %HOMEPATH%\Favorites\H몰.url
- %HOMEPATH%\Favorites\wlakzpt.url
- %HOMEPATH%\Favorites\YES24.url
- %HOMEPATH%\Favorites\NS이숍.url
- %HOMEPATH%\Favorites\Hmall.url
- %HOMEPATH%\Favorites\LG패션샵.url
- %HOMEPATH%\Favorites\G마켓.url
- %HOMEPATH%\Favorites\assacom.url
- %HOMEPATH%\Favorites\cj마트.url
- %HOMEPATH%\Favorites\AK몰.url
- %HOMEPATH%\Favorites\지에스이숍.url
- %HOMEPATH%\Favorites\지에스홈쇼핑.url
- %HOMEPATH%\Favorites\cj쇼핑.url
- %HOMEPATH%\Favorites\CJON마트.url
- %HOMEPATH%\Favorites\G마캣.url
- %HOMEPATH%\Favorites\CJON mart.url
- %HOMEPATH%\Favorites\CJmall.url
- %HOMEPATH%\Favorites\cjon.url
- %WINDIR%\fileham_favicon.ico
- %ALLUSERSPROFILE%\Desktop\FileHam.lnk
- %ALLUSERSPROFILE%\Desktop\에이드라이브.lnk
- %HOMEPATH%\Favorites\Links\11번가.url
- %WINDIR%\adrive_favicon.ico
- %WINDIR%\tomfile_favicon.ico
- <Current directory>\cls$$$$-.bat
- <SYSTEM32>\tpprhost.exe
- %ALLUSERSPROFILE%\Desktop\예스파일.lnk
- %ALLUSERSPROFILE%\Desktop\톰파일.lnk
- %WINDIR%\yesfile_favicon.ico
- %WINDIR%\11st_favicon.ico
- %HOMEPATH%\Favorites\쿠팡.url
- %HOMEPATH%\Favorites\그루폰.url
- %HOMEPATH%\Favorites\티몬.url
- %HOMEPATH%\Favorites\플라이워치.url
- %HOMEPATH%\Favorites\티켓몬스터.url
- %HOMEPATH%\Favorites\groupon.url
- %WINDIR%\auction_favicon.ico
- %HOMEPATH%\Favorites\Links\옥션.url
- %HOMEPATH%\Favorites\Links\G마켓.url
- %HOMEPATH%\Favorites\rmfnvhs.url
- %WINDIR%\gmarket_favicon.ico
- %HOMEPATH%\Favorites\면세점.url
- %HOMEPATH%\Favorites\명품관.url
- %HOMEPATH%\Favorites\롯데홈쇼핑.url
- %HOMEPATH%\Favorites\롯데마트인터넷쇼핑몰.url
- %HOMEPATH%\Favorites\롯데인터넷면세점.url
- %HOMEPATH%\Favorites\신라면세점.url
- %HOMEPATH%\Favorites\씨제이마트.url
- %HOMEPATH%\Favorites\씨제이몰.url
- %HOMEPATH%\Favorites\신세계몰.url
- %HOMEPATH%\Favorites\신라인터넷면세점.url
- %HOMEPATH%\Favorites\신세계.url
- %HOMEPATH%\Favorites\롯데마트쇼핑몰.url
- %HOMEPATH%\Favorites\1300k.url
- %HOMEPATH%\Favorites\가방팝.url
- %HOMEPATH%\Favorites\11st.url
- %HOMEPATH%\Favorites\11qjsrk.url
- %HOMEPATH%\Favorites\11번가.url
- %HOMEPATH%\Favorites\꽃배달.url
- %HOMEPATH%\Favorites\디앤샵.url
- %HOMEPATH%\Favorites\롯데마트.url
- %HOMEPATH%\Favorites\더페이스샵.url
- %HOMEPATH%\Favorites\농수산홈쇼핑.url
- %HOMEPATH%\Favorites\대출.url
- %HOMEPATH%\Favorites\웹하드.url
- %HOMEPATH%\Favorites\이마트.url
- %HOMEPATH%\Favorites\원어데이.url
- %HOMEPATH%\Favorites\우체국쇼핑.url
- %HOMEPATH%\Favorites\워커힐면세점.url
- %HOMEPATH%\Favorites\이마트상품.url
- %HOMEPATH%\Favorites\지에스숍.url
- %HOMEPATH%\Favorites\지에스이샵.url
- %HOMEPATH%\Favorites\지에스샵.url
- %HOMEPATH%\Favorites\이마트인터넷쇼핑몰.url
- %HOMEPATH%\Favorites\지마켓.url
- %HOMEPATH%\Favorites\옥션.url
- %HOMEPATH%\Favorites\씨제이.url
- %HOMEPATH%\Favorites\아싸컴.url
- %HOMEPATH%\Favorites\씨제이온마트.url
- %HOMEPATH%\Favorites\씨제이쇼핑.url
- %HOMEPATH%\Favorites\씨제이오쇼핑.url
- %HOMEPATH%\Favorites\아이스타일.url
- %HOMEPATH%\Favorites\예스24.url
- %HOMEPATH%\Favorites\예스이십사.url
- %HOMEPATH%\Favorites\연예인디씨.url
- %HOMEPATH%\Favorites\아이스타일24.url
- %HOMEPATH%\Favorites\엔조이뉴욕.url
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Favorites\assacom.url
- %HOMEPATH%\Favorites\cj마트.url
- %HOMEPATH%\Favorites\지에스이숍.url
- %HOMEPATH%\Favorites\지에스홈쇼핑.url
- %HOMEPATH%\Favorites\CJON mart.url
- %HOMEPATH%\Favorites\CJON마트.url
- %HOMEPATH%\Favorites\cj쇼핑.url
- %HOMEPATH%\Favorites\cjon.url
- %HOMEPATH%\Favorites\지에스이샵.url
- %HOMEPATH%\Favorites\이마트.url
- %HOMEPATH%\Favorites\이마트상품.url
- %HOMEPATH%\Favorites\원어데이.url
- %HOMEPATH%\Favorites\웹하드.url
- %HOMEPATH%\Favorites\지에스샵.url
- %HOMEPATH%\Favorites\지에스숍.url
- %HOMEPATH%\Favorites\이마트인터넷쇼핑몰.url
- %HOMEPATH%\Favorites\지마켓.url
- %HOMEPATH%\Favorites\G마캣.url
- %HOMEPATH%\Favorites\티몬.url
- %HOMEPATH%\Favorites\쿠팡.url
- %HOMEPATH%\Favorites\YES24.url
- %HOMEPATH%\Favorites\플라이워치.url
- %HOMEPATH%\Favorites\rmfnvhs.url
- <Current directory>\cls$$$$-.bat
- %HOMEPATH%\Favorites\그루폰.url
- %HOMEPATH%\Favorites\groupon.url
- %HOMEPATH%\Favorites\wlakzpt.url
- %HOMEPATH%\Favorites\GS SHOP.url
- %HOMEPATH%\Favorites\GS샵.url
- %HOMEPATH%\Favorites\G마켓.url
- %HOMEPATH%\Favorites\gmarket.url
- %HOMEPATH%\Favorites\LG패션샵.url
- %HOMEPATH%\Favorites\NS이숍.url
- %HOMEPATH%\Favorites\gseshop.url
- %HOMEPATH%\Favorites\H몰.url
- %HOMEPATH%\Favorites\롯데마트쇼핑몰.url
- %HOMEPATH%\Favorites\롯데마트인터넷쇼핑몰.url
- %HOMEPATH%\Favorites\디앤샵.url
- %HOMEPATH%\Favorites\롯데마트.url
- %HOMEPATH%\Favorites\면세점.url
- %HOMEPATH%\Favorites\명품관.url
- %HOMEPATH%\Favorites\롯데인터넷면세점.url
- %HOMEPATH%\Favorites\롯데홈쇼핑.url
- %HOMEPATH%\Favorites\더페이스샵.url
- %HOMEPATH%\Favorites\11st.url
- %HOMEPATH%\Favorites\1300k.url
- %HOMEPATH%\Favorites\11qjsrk.url
- %HOMEPATH%\Favorites\11번가.url
- %HOMEPATH%\Favorites\농수산홈쇼핑.url
- %HOMEPATH%\Favorites\대출.url
- %HOMEPATH%\Favorites\가방팝.url
- %HOMEPATH%\Favorites\꽃배달.url
- %HOMEPATH%\Favorites\신라면세점.url
- %HOMEPATH%\Favorites\연예인디씨.url
- %HOMEPATH%\Favorites\예스24.url
- %HOMEPATH%\Favorites\아이스타일.url
- %HOMEPATH%\Favorites\아이스타일24.url
- %HOMEPATH%\Favorites\우체국쇼핑.url
- %HOMEPATH%\Favorites\워커힐면세점.url
- %HOMEPATH%\Favorites\예스이십사.url
- %HOMEPATH%\Favorites\옥션.url
- %HOMEPATH%\Favorites\아싸컴.url
- %HOMEPATH%\Favorites\씨제이마트.url
- %HOMEPATH%\Favorites\씨제이몰.url
- %HOMEPATH%\Favorites\신라인터넷면세점.url
- %HOMEPATH%\Favorites\신세계.url
- %HOMEPATH%\Favorites\씨제이온마트.url
- %HOMEPATH%\Favorites\씨제이.url
- %HOMEPATH%\Favorites\씨제이쇼핑.url
- %HOMEPATH%\Favorites\씨제이오쇼핑.url
Deletes itself.
