Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Win32.HLLW.Autoruner2.25031

Added to the Dr.Web virus database: 2016-08-24

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /g'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /n'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /u'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /L'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /w'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /R'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /V'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /H'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /J'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /e'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /q'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /x'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /B'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /I'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /d'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /P'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /t'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Inoyikotadoqev' = 'rundll32.exe "%WINDIR%\etqetl.dll",Startup'
  • [<HKLM>\SYSTEM\ControlSet001\Control\Print\Providers\1981913064] 'Name' = '%TEMP%\2.tmp'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /k'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /F'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /a'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /s'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /o'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /C'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /y'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vuebo' = '%HOMEPATH%\vuebo.exe /m'
Creates the following services:
  • [<HKLM>\SYSTEM\ControlSet001\Services\83c30f20] 'imagepath' = '%WINDIR%\TEMP\4.tmp'
Creates the following files on removable media:
  • <Drive name for removable media>:\Passwords.exe
  • <Drive name for removable media>:\RCX7.tmp
  • <Drive name for removable media>:\RCX6.tmp
  • <Drive name for removable media>:\RCXA.tmp
  • <Drive name for removable media>:\RCX9.tmp
  • <Drive name for removable media>:\RCX8.tmp
  • <Drive name for removable media>:\Secret.exe
  • <Drive name for removable media>:\vuebo.exe
  • <Drive name for removable media>:\autorun.inf
  • <Drive name for removable media>:\Porn.exe
  • <Drive name for removable media>:\RCX5.tmp
  • <Drive name for removable media>:\Sexy.exe
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
  • hidden files
Executes the following:
  • '%HOMEPATH%\vuebo.exe'
  • '<SYSTEM32>\cmd.exe' /c del <Virus name>.exe
  • '<SYSTEM32>\cmd.exe' /c tasklist&&del BqjnC0gFVHRul8.exe
  • '<SYSTEM32>\rundll32.exe' "%WINDIR%\etqetl.dll",iep
  • '<SYSTEM32>\tasklist.exe'
  • '<SYSTEM32>\svchost.exe'
  • '%HOMEPATH%\win.exe'
  • '%HOMEPATH%\BqjnC0gFVHRul8.exe'
  • '%HOMEPATH%\wio.exe'
  • '<SYSTEM32>\rundll32.exe' "%WINDIR%\etqetl.dll",Startup
  • '%HOMEPATH%\wiq.exe'
Injects code into
the following system processes:
  • <SYSTEM32>\tasklist.exe
  • <SYSTEM32>\svchost.exe
  • <SYSTEM32>\spoolsv.exe
the following user processes:
  • safari.exe
Searches for windows to
detect programs and games:
  • ClassName: 'SkinuxWindow' WindowName: 'MySpaceIM with Skype'
Modifies settings of Windows Internet Explorer:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1208' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1200' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1001' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2000' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1405' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1209' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'currentlevel' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{A8A88C49-5EB2-4990-A1A2-0876022C854F}' = '{1a,37,61,59,23,52,35,0c,7a,5f,20,17,2f,1e,1a,19,0e,2b,01,73,13,37,13,12...
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{AEBA21FA-782A-4A90-978D-B72164C80120}' = '{1a,37,61,59,23,52,35,0c,7a,5f,20,17,2f,1e,1a,19,0e,2b,01,73,13,37,13,12...
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A10' = '00000000'
Modifies file system:
Creates the following files:
  • %HOMEPATH%\vuebo.exe
  • %TEMP%\1.tmp
  • %WINDIR%\Temp\4.tmp
  • %WINDIR%\opugifin.dll
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CAYJAJM1.php
  • %HOMEPATH%\win.exe
  • %HOMEPATH%\BqjnC0gFVHRul8.exe
  • %HOMEPATH%\wio.exe
  • %WINDIR%\etqetl.dll
  • %HOMEPATH%\wiq.exe
Sets the 'hidden' attribute to the following files:
  • <Drive name for removable media>:\vuebo.exe
  • <Drive name for removable media>:\autorun.inf
  • %HOMEPATH%\vuebo.exe
Deletes the following files:
  • <Drive name for removable media>:\Sexy.exe
  • <Drive name for removable media>:\Porn.exe
  • <Drive name for removable media>:\Passwords.exe
  • %TEMP%\2.tmp
  • <DRIVERS>\etc\hosts
  • %WINDIR%\Temp\4.tmp
Moves the following files:
  • from %HOMEPATH%\win.exe to %TEMP%\3.tmp
  • from %TEMP%\1.tmp to %TEMP%\2.tmp
Deletes itself.
Network activity:
Connects to:
  • '20#######838.edataupdate.com':80
  • 'localhost':1038
TCP:
HTTP GET requests:
  • http://20#######838.edataupdate.com/get2.php?c=##################################################################################################################################################...
UDP:
  • DNS ASK 20#######838.edataupdate.com
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Indicator' WindowName: ''