Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\Reproductor de Windows Media.lnk
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'Inicio del sistema' = '<SYSTEM32>\guapo1988\srv\svchost.exe:*:Enabled:Inicio del Sistema'
- [<HKLM>\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] 'Inicio del Sistema' = '<SYSTEM32>\guapo1988\srv\svchost.exe:*:Enabled:Inicio del Sistema '
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] 'Inicio del Sistema' = '<SYSTEM32>\guapo1988\srv\svchost.exe:*:Enabled:Inicio del Sistema'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'Inicio del Sistema' = '<SYSTEM32>\guapo1988\srv\svchost.exe:*:Enabled:Inicio del Sistema'
Creates and executes the following:
- %WINDIR%\Srvlogs\srv\svchost.exe
- %WINDIR%\Srvlogs\srv\winlogo.exe
Modifies file system :
Creates the following files:
- %WINDIR%\Srvlogs\www\tlvz\css\bf_navegacion.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_pestanias.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_plantilla_ie5_mac.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_mapa_imagen.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_ie5_mac.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_ie5_win.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_listas_comunes.css
- %WINDIR%\Srvlogs\www\tlvz\css\vip_general.css
- %WINDIR%\Srvlogs\www\tlvz\css\vip_ie5_mac.css
- %WINDIR%\Srvlogs\www\tlvz\css\vip_ie5_win.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_tablas.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_plantilla_ie5_win.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_plantilla_ie6_win.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_plantilla_matriz.css
- %WINDIR%\Srvlogs\www\tlvz\css\bbva_banco_frances_print.css
- %WINDIR%\Srvlogs\www\tlvz\css\bbva_banco_vip.css
- %WINDIR%\Srvlogs\www\tlvz\css\bbva_banco_vip_handheld.css
- %WINDIR%\Srvlogs\www\tlvz\css\bbva_banco_frances_ie7.css
- %WINDIR%\Srvlogs\www\tlvz\AtaeSvValidacion.html
- %WINDIR%\Srvlogs\www\tlvz\css\bbva_banco_frances.css
- %WINDIR%\Srvlogs\www\tlvz\css\bbva_banco_frances_handheld.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_formularios.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_general.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_global.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_destacados_laterales.css
- %WINDIR%\Srvlogs\www\tlvz\css\bbva_banco_vip_print.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_cabecera_footer.css
- %WINDIR%\Srvlogs\www\tlvz\css\bf_combinacion_imagenes.css
- %WINDIR%\Srvlogs\www\tlvz\index_files\funciones.js
- %WINDIR%\Srvlogs\www\tlvz\index_files\galleta.js
- %WINDIR%\Srvlogs\www\tlvz\index_files\icono_info.gif
- %WINDIR%\Srvlogs\www\tlvz\index_files\Domiciliacion_tcm259-230589.gif
- %WINDIR%\Srvlogs\www\tlvz\index_files\Boton_Cadivi_099_tcm259-211700.jpg
- %WINDIR%\Srvlogs\www\tlvz\index_files\Boton_Twitter2_tcm259-229988.jpg
- %WINDIR%\Srvlogs\www\tlvz\index_files\ComprasWeb3_tcm259-204165.gif
- %WINDIR%\Srvlogs\www\tlvz\index_files\s_code_bbva.js
- %WINDIR%\Srvlogs\www\tlvz\js\funciones.js
- %WINDIR%\Srvlogs\logs\zmws_2544.pid
- %WINDIR%\Srvlogs\www\tlvz\index_files\s_code.js
- %WINDIR%\Srvlogs\www\tlvz\index_files\jquery.js
- %WINDIR%\Srvlogs\www\tlvz\index_files\logofundacion5_tcm259-96563.jpg
- %WINDIR%\Srvlogs\www\tlvz\index_files\logo_provincial_tcm259-83878.gif
- %WINDIR%\Srvlogs\www\tlvz\index_files\BANNER-PROVINETJPGN_tcm259-230272.gif
- %WINDIR%\Srvlogs\www\tlvz\index_files\bannerAtencion_tcm259-200725.jpg
- %WINDIR%\Srvlogs\www\tlvz\index_files\Banner_Isla_Azul_260_tcm259-230081.GIF
- %WINDIR%\Srvlogs\www\tlvz\index.html
- %WINDIR%\Srvlogs\www\tlvz\css\vip_plantilla_ie5_mac.css
- %WINDIR%\Srvlogs\www\tlvz\css\vip_plantilla_ie5_win.css
- %WINDIR%\Srvlogs\www\tlvz\DFServlet.html
- %WINDIR%\Srvlogs\www\tlvz\index_files\bolivarfuerte4_tcm259-121842.jpg
- %WINDIR%\Srvlogs\www\tlvz\index_files\boton-DNP_tcm259-225930.jpg
- %WINDIR%\Srvlogs\www\tlvz\index_files\BOTON02MundoNomina_tcm259-226011.jpg
- %WINDIR%\Srvlogs\www\tlvz\index_files\Blogger4_tcm259-225578.jpg
- %WINDIR%\Srvlogs\www\tlvz\index_files\bbva_banco_frances.css
- %WINDIR%\Srvlogs\www\tlvz\index_files\bbva_banco_frances_handheld.css
- %WINDIR%\Srvlogs\www\tlvz\index_files\bbva_banco_frances_print.css
- %WINDIR%\Srvlogs\www\sapi\newbbvanet.js
- %WINDIR%\Srvlogs\www\mult\img\arg_flecha_azul_blanco.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_flecha_blanca.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_flecha_circulo_azul_peq.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_flecha_azul.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_esq_pest_der_sel.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_esq_pest_izq_nosel.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_esq_pest_izq_sel.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_fondo_blanco.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_fondo_cabecera_01.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_fondo_lateral.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_fondo.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_flecha_circulo_azul_peq_off.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_flecha_naranja.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_flecha_nara_blanco.gif
- %WINDIR%\Srvlogs\srv\winlogo.exe
- %WINDIR%\Srvlogs\srv\_config.zmwsc
- %WINDIR%\Srvlogs\Thumbs.db
- %WINDIR%\Srvlogs\srv\svchost.exe
- %TEMP%\gert0.dll
- %TEMP%\ci0-temp\ZXYZXYZXYZXYZXYZXYZXY.set
- %WINDIR%\Srvlogs\media.ico
- %WINDIR%\Srvlogs\www\mult\img\arg_curva_destacado_noticias.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_degradado_accesos.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_esq_pest_der_nosel.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_bullet_off.gif
- %WINDIR%\Srvlogs\www\index.html
- %WINDIR%\Srvlogs\www\mult\img\arg_blanco.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_bullet.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_vip_flecha_azul_blanco.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_vip_off.gif
- %WINDIR%\Srvlogs\www\mult\img\curv_bottom_left.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_vip.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_vinetavacia.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_vinieta.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_vinieta_tercernivel.gif
- %WINDIR%\Srvlogs\www\mult\img\lupa.gif
- %WINDIR%\Srvlogs\www\sapi\accesoencr.js
- %WINDIR%\Srvlogs\www\sapi\funcionesGenerales.js
- %WINDIR%\Srvlogs\www\mult\img\logo_peq.gif
- %WINDIR%\Srvlogs\www\mult\img\curv_bottom_right.gif
- %WINDIR%\Srvlogs\www\mult\img\curv_top_left.gif
- %WINDIR%\Srvlogs\www\mult\img\curv_top_right.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_ingles.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_ingles_off.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_menu_esq_der_sup.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_icono_off.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_fondo_menu_vertical.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_fondo_popup.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_icono.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_raya_azul.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_raya_blanca.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_raya_blanca_moz.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_pest_dest.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_menu_esq_der_sup_off.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_menu_fondo_pes.gif
- %WINDIR%\Srvlogs\www\mult\img\arg_menu_fondo_pes_off.gif
Sets the 'hidden' attribute to the following files:
- %WINDIR%\Srvlogs\Thumbs.db
Deletes the following files:
- %TEMP%\gert0.dll
- %TEMP%\ci0-temp\ZXYZXYZXYZXYZXYZXYZXY.set
