Win32.HLLW.Autoruner.7317
Added to the Dr.Web virus database:
2009-07-28
Virus description added:
2013-10-11
Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\usbhelp.exe
Malicious functions:
Creates and executes the following:
- '%TEMP%\57812.exe'
- '%TEMP%\24175.exe'
- '%TEMP%\36187.exe'
- '%TEMP%\82180.exe'
- '%TEMP%\56133.exe'
- '%TEMP%\34041.exe'
- '%TEMP%\74654.exe'
- '%TEMP%\73562.exe'
- '%TEMP%\86745.exe'
- '%TEMP%\68304.exe'
- '%TEMP%\86242.exe'
- '%TEMP%\7772.exe'
- '%TEMP%\50768.exe'
- '%TEMP%\32207.exe'
- '%TEMP%\76787.exe'
- '%TEMP%\74654.exe' (downloaded from the Internet)
- '%TEMP%\86242.exe' (downloaded from the Internet)
- '%TEMP%\68304.exe' (downloaded from the Internet)
- '%TEMP%\34041.exe' (downloaded from the Internet)
- '%TEMP%\76787.exe' (downloaded from the Internet)
- '%TEMP%\73562.exe' (downloaded from the Internet)
- '%TEMP%\86745.exe' (downloaded from the Internet)
- '%TEMP%\56133.exe' (downloaded from the Internet)
- '%TEMP%\7772.exe' (downloaded from the Internet)
- '%TEMP%\50768.exe' (downloaded from the Internet)
- '%TEMP%\82180.exe' (downloaded from the Internet)
- '%TEMP%\32207.exe' (downloaded from the Internet)
- '%TEMP%\24175.exe' (downloaded from the Internet)
- '%TEMP%\36187.exe' (downloaded from the Internet)
- '%TEMP%\57812.exe' (downloaded from the Internet)
Injects code into
the following system processes:
Modifies file system :
Creates the following files:
- %TEMP%\24175.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\11[1].ico
- %TEMP%\86745.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\10[1].ico
- %TEMP%\36187.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\9[1].ico
- %TEMP%\57812.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\12[1].ico
- %TEMP%\34041.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\15[1].ico
- %TEMP%\74654.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\14[1].ico
- %TEMP%\68304.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\13[1].ico
- %TEMP%\73562.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\8[1].ico
- %TEMP%\86242.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\3[1].ico
- %TEMP%\32207.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\2[1].ico
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\usb[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1[1].ico
- %TEMP%\76787.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\4[1].ico
- %TEMP%\82180.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\7[1].ico
- %TEMP%\56133.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\6[1].ico
- %TEMP%\7772.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\5[1].ico
- %TEMP%\50768.exe
Network activity:
Connects to:
TCP:
HTTP GET requests:
- ma####rents.info/payloads/10.ico
- ma####rents.info/payloads/11.ico
- ma####rents.info/payloads/8.ico
- ma####rents.info/payloads/9.ico
- ma####rents.info/payloads/14.ico
- ma####rents.info/payloads/15.ico
- ma####rents.info/payloads/12.ico
- ma####rents.info/payloads/13.ico
- ma####rents.info/payloads/2.ico
- ma####rents.info/payloads/3.ico
- ma####rents.info/usb.php?ms#########################
- ma####rents.info/payloads/1.ico
- ma####rents.info/payloads/6.ico
- ma####rents.info/payloads/7.ico
- ma####rents.info/payloads/4.ico
- ma####rents.info/payloads/5.ico
UDP:
欢迎下载
Dr.Web for Android
-
免费3个月
-
可使用所有保护组件
-
可在AppGallery/Google Pay延期
继续使用此网站意味着您同意我们使用Cookie文件和其他用于收集网站访问统计信息的技术手段。详细信息