Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,%PROGRAM_FILES%\ebaurodr\mhrhcrji.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe
Substitutes the following executable system files:
- <SYSTEM32>\dllcache\msdaenum.dll with <SYSTEM32>\dllcache\msdaenum.dll.new
- <SYSTEM32>\dllcache\msdadc.dll with <SYSTEM32>\dllcache\msdadc.dll.new
- <SYSTEM32>\dllcache\msdfmap.dll with <SYSTEM32>\dllcache\msdfmap.dll.new
- <SYSTEM32>\dllcache\msdaorar.dll with <SYSTEM32>\dllcache\msdaorar.dll.new
- <SYSTEM32>\dllcache\msdaora.dll with <SYSTEM32>\dllcache\msdaora.dll.new
- <SYSTEM32>\dllcache\msdaer.dll with <SYSTEM32>\dllcache\msdaer.dll.new
- <SYSTEM32>\dllcache\msdaremr.dll with <SYSTEM32>\dllcache\msdaremr.dll.new
- <SYSTEM32>\dllcache\msaddsr.dll with <SYSTEM32>\dllcache\msaddsr.dll.new
- <SYSTEM32>\dllcache\msadds.dll with <SYSTEM32>\dllcache\msadds.dll.new
- <SYSTEM32>\dllcache\msadcs.dll with <SYSTEM32>\dllcache\msadcs.dll.new
- <SYSTEM32>\dllcache\msdarem.dll with <SYSTEM32>\dllcache\msdarem.dll.new
- <SYSTEM32>\dllcache\msdaprst.dll with <SYSTEM32>\dllcache\msdaprst.dll.new
- <SYSTEM32>\dllcache\msdaprsr.dll with <SYSTEM32>\dllcache\msdaprsr.dll.new
- <SYSTEM32>\dllcache\msdaosp.dll with <SYSTEM32>\dllcache\msdaosp.dll.new
- <SYSTEM32>\dllcache\oledb32r.dll with <SYSTEM32>\dllcache\oledb32r.dll.new
- <SYSTEM32>\dllcache\oledb32.dll with <SYSTEM32>\dllcache\oledb32.dll.new
- <SYSTEM32>\dllcache\msxactps.dll with <SYSTEM32>\dllcache\msxactps.dll.new
- <SYSTEM32>\dllcache\wab32res.dll with <SYSTEM32>\dllcache\wab32res.dll.new
- <SYSTEM32>\dllcache\wab32.dll with <SYSTEM32>\dllcache\wab32.dll.new
- <SYSTEM32>\dllcache\sqlxmlx.dll with <SYSTEM32>\dllcache\sqlxmlx.dll.new
- <SYSTEM32>\dllcache\msdaurl.dll with <SYSTEM32>\dllcache\msdaurl.dll.new
- <SYSTEM32>\dllcache\msdasql.dll with <SYSTEM32>\dllcache\msdasql.dll.new
- <SYSTEM32>\dllcache\msdasc.dll with <SYSTEM32>\dllcache\msdasc.dll.new
- <SYSTEM32>\dllcache\msdaps.dll with <SYSTEM32>\dllcache\msdaps.dll.new
- <SYSTEM32>\dllcache\msdatt.dll with <SYSTEM32>\dllcache\msdatt.dll.new
- <SYSTEM32>\dllcache\msdatl3.dll with <SYSTEM32>\dllcache\msdatl3.dll.new
- <SYSTEM32>\dllcache\msdasqlr.dll with <SYSTEM32>\dllcache\msdasqlr.dll.new
- <SYSTEM32>\dllcache\mssoapr.dll with <SYSTEM32>\dllcache\mssoapr.dll.new
- <SYSTEM32>\dllcache\mssoap1.dll with <SYSTEM32>\dllcache\mssoap1.dll.new
- <SYSTEM32>\dllcache\fp4autl.dll with <SYSTEM32>\dllcache\fp4autl.dll.new
- <SYSTEM32>\dllcache\spttseng.dll with <SYSTEM32>\dllcache\spttseng.dll.new
- <SYSTEM32>\dllcache\spcommon.dll with <SYSTEM32>\dllcache\spcommon.dll.new
- <SYSTEM32>\dllcache\wisc10.dll with <SYSTEM32>\dllcache\wisc10.dll.new
- <SYSTEM32>\dllcache\vgx.dll with <SYSTEM32>\dllcache\vgx.dll.new
- <SYSTEM32>\dllcache\spcplui.dll with <SYSTEM32>\dllcache\spcplui.dll.new
- <SYSTEM32>\dllcache\msinfo32.exe with <SYSTEM32>\dllcache\msinfo32.exe.new
- <SYSTEM32>\dllcache\dao360.dll with <SYSTEM32>\dllcache\dao360.dll.new
- <SYSTEM32>\dllcache\triedit.dll with <SYSTEM32>\dllcache\triedit.dll.new
- <SYSTEM32>\dllcache\sapisvr.exe with <SYSTEM32>\dllcache\sapisvr.exe.new
- <SYSTEM32>\dllcache\sapi.dll with <SYSTEM32>\dllcache\sapi.dll.new
- <SYSTEM32>\dllcache\msader15.dll with <SYSTEM32>\dllcache\msader15.dll.new
- <SYSTEM32>\dllcache\msadcf.dll with <SYSTEM32>\dllcache\msadcf.dll.new
- <SYSTEM32>\dllcache\msadcer.dll with <SYSTEM32>\dllcache\msadcer.dll.new
- <SYSTEM32>\dllcache\msadce.dll with <SYSTEM32>\dllcache\msadce.dll.new
- <SYSTEM32>\dllcache\msadcor.dll with <SYSTEM32>\dllcache\msadcor.dll.new
- <SYSTEM32>\dllcache\msadco.dll with <SYSTEM32>\dllcache\msadco.dll.new
- <SYSTEM32>\dllcache\msadcfr.dll with <SYSTEM32>\dllcache\msadcfr.dll.new
- <SYSTEM32>\dllcache\directdb.dll with <SYSTEM32>\dllcache\directdb.dll.new
- <SYSTEM32>\dllcache\msador15.dll with <SYSTEM32>\dllcache\msador15.dll.new
- <SYSTEM32>\dllcache\msadomd.dll with <SYSTEM32>\dllcache\msadomd.dll.new
- <SYSTEM32>\dllcache\msado15.dll with <SYSTEM32>\dllcache\msado15.dll.new
- <SYSTEM32>\dllcache\msjro.dll with <SYSTEM32>\dllcache\msjro.dll.new
- <SYSTEM32>\dllcache\msadrh15.dll with <SYSTEM32>\dllcache\msadrh15.dll.new
- <SYSTEM32>\dllcache\msadox.dll with <SYSTEM32>\dllcache\msadox.dll.new
Infects the following executable files:
- C:\Far2\Plugins\MacroView\MacroView.dll
- C:\Far2\Plugins\Network\Network.dll
- C:\Far2\Plugins\HlfViewer\HlfViewer.dll
- C:\Far2\Plugins\FarCmds\FARCmds.dll
- C:\Far2\Plugins\FTP\FarFtp.dll
- C:\Far2\Plugins\ProcList\Proclist.dll
- %CommonProgramFiles%\System\Ole DB\MSDAIPP.DLL
- %PROGRAM_FILES%\FireFox\AccessibleMarshal.dll
- %CommonProgramFiles%\Microsoft Shared\VC\msdia80.dll
- C:\Far2\Plugins\TmpPanel\TmpPanel.dll
- C:\Far2\Plugins\WinSCP\WinSCP.dll
- C:\Far2\Plugins\EMenu\EMenu.dll
- C:\Far2\FExcept\FExcept.dll
- C:\Far2\Plugins\7-Zip\7-ZipFar.dll
- C:\Far2\FExcept\ExcDump.dll
- C:\Far2\Far.exe
- C:\Far2\FExcept\demangle32.dll
- C:\Far2\Plugins\arclite\7z.dll
- C:\Far2\Plugins\Compare\Compare.dll
- C:\Far2\Plugins\DrawLine\DrawLine.dll
- C:\Far2\Plugins\Colorer\bin\colorer.dll
- C:\Far2\Plugins\arclite\arclite.dll
- C:\Far2\Plugins\Brackets\Brackets.dll
Malicious functions:
Creates and executes the following:
- '%TEMP%\empchqloliakgweu.exe'
Injects code into
the following system processes:
- <SYSTEM32>\alg.exe
- <SYSTEM32>\ctfmon.exe
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\services.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\svchost.exe
a large number of user processes.
Searches for registry branches where third party applications store passwords:
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKLM>\Software\FlashFXP]
- [<HKCU>\Software\BPFTP]
- [<HKCU>\Software\FlashFXP]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
- [<HKCU>\Software\Ghisler\Windows Commander]
- [<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]
Modifies settings of Windows Internet Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'
Modifies file system :
Creates the following files:
- %TEMP%\~TM6.tmp
- %TEMP%\~TM5.tmp
- %TEMP%\tssofofu.sys
- %WINDIR%\Temp\7fffffb1
- %WINDIR%\Temp\6decd52f
- %TEMP%\~TM4.tmp
- %TEMP%\~TM2.tmp
- %TEMP%\~TM1.tmp
- %TEMP%\empchqloliakgweu.exe
- %PROGRAM_FILES%\ebaurodr\mhrhcrji.exe
- <LS_APPDATA>\niuydqre.log
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe
Deletes the following files:
- %TEMP%\~TM5.tmp
- %TEMP%\~TM6.tmp
- %TEMP%\tssofofu.sys
- %TEMP%\~TM1.tmp
- %TEMP%\~TM2.tmp
- %TEMP%\~TM4.tmp
Network activity:
Connects to:
- '74.##5.232.51':80
UDP:
- DNS ASK lm####enskxs.com
- DNS ASK ui###xytj.com
- DNS ASK fi#####tyqixemglomx.com
- DNS ASK vv###iteuy.com
- DNS ASK sg####rmsiopg.com
- DNS ASK hd###dvla.com
- DNS ASK he#####dkgrymjrq.com
- DNS ASK hq###vnty.com
- DNS ASK xk####himumw.com
- DNS ASK ot####llcsbltf.com
- DNS ASK li#####fvircwvtijkh.com
- DNS ASK as###bwpms.com
- DNS ASK ck####ryyfbjew.com
- DNS ASK bx####qujsgq.com
- DNS ASK ba####pkvhohj.com
- DNS ASK gb###wqacn.com
- DNS ASK it#####iceydiploubs.com
- DNS ASK lw###iwoe.com
- DNS ASK iu###utgmv.com
- DNS ASK fh#####axrfptgifkw.com
- DNS ASK ka###pobu.com
- DNS ASK rr#####kpfjyoqmutl.com
- DNS ASK bo#####ylfapinygm.com
- DNS ASK it####dlmqlfi.com
- DNS ASK mp###pgi.com
- DNS ASK qc####yghmdqvwg.com
- DNS ASK gu#####iekcjtbolscm.com
- DNS ASK ft####savmbpulv.com
- DNS ASK ya##o.com
- DNS ASK ke###gaxlkx.com
- DNS ASK yc#####fkalqeksvbdd.com
- DNS ASK ql####saavjqugh.com
- DNS ASK ou###jxapd.com
- DNS ASK ic###fanne.com
- DNS ASK xy###apyp.com
- DNS ASK ln#####ivuiwiymt.com
- DNS ASK gu####ndwwdcjn.com
- DNS ASK ym####wjcutoy.com
- DNS ASK up#####altqvuelscol.com
- DNS ASK ys####placlurpr.com
- DNS ASK hj####tmbvql.com
- DNS ASK iu#####ffgbxbcijdeb.com
- DNS ASK jm#####rpxffppwyqj.com
- DNS ASK lw#####mrdvncihd.com
- DNS ASK vx###grau.com
- DNS ASK hf####dycdwti.com
- DNS ASK kj###wnxbk.com
- DNS ASK xk####rnedplpte.com
- DNS ASK pl###qynxj.com
- DNS ASK go#####unccajymh.com
- DNS ASK jn####hekqoipte.com
- DNS ASK nu###cgghxu.com
- DNS ASK fh####mcifit.com
- DNS ASK cn###wkwr.com
- DNS ASK uh####xaiusx.com
- DNS ASK en#####evthmcmojixr.com
- DNS ASK bg#####kpchokesy.com
- DNS ASK io####qeraxic.com
- DNS ASK xs####idceqdbr.com
- DNS ASK ub###xembk.com
- DNS ASK as###ifg.com
- DNS ASK xt###dvpk.com
- DNS ASK ov###ngejmo.com
- DNS ASK ym####nulihl.com
- DNS ASK qw#####kdppgqeha.com
- DNS ASK ys#####bqfkvkojv.com
- DNS ASK lu###txaymj.com
- DNS ASK fw#####rvkuqjclvy.com
- DNS ASK fm#####irxxgbupuxq.com
- DNS ASK hq####mvtush.com
- DNS ASK af###gwn.com
- DNS ASK eg###jyeasr.com
- DNS ASK rh####rmnacbg.com
- DNS ASK xe###vlmob.com
- DNS ASK pl###qjfynt.com
- DNS ASK bv###xcfobr.com
- DNS ASK ky###xbydck.com
- DNS ASK uu####xvihatsr.com
- DNS ASK cn#####axkredxnk.com
- DNS ASK bp###gre.com
- DNS ASK it####ufaixmin.com
- DNS ASK tt#####nivtsybduyb.com
- DNS ASK fj####uyyppsei.com
- DNS ASK google.com
- DNS ASK jr#####kvhgsiyknhw.com
- DNS ASK cm####kxqgxxtbk.com
- DNS ASK jy###ogwr.com
- DNS ASK nt###vejb.com
- DNS ASK wa#####ygowhbdfn.com
- DNS ASK lh#####bwenxtyae.com
- DNS ASK la###dbqqr.com
- DNS ASK as####nbyioy.com
- DNS ASK mw###rlf.com
- DNS ASK lc####tgdgqoba.com
- DNS ASK bing.com
- DNS ASK my#####nhuxplwifpo.com
- DNS ASK dd####srdhtprae.com
- DNS ASK bj###tlg.com
- DNS ASK tr####kctoktsl.com
- DNS ASK oh####mnlsyjwpp.com
- DNS ASK ce###xswsg.com
- DNS ASK dj#####rljlrkdqr.com
- DNS ASK wp###lsc.com
- DNS ASK ui#####frpoafrpjxd.com
- DNS ASK xm####hkgjiif.com
- DNS ASK dl###ung.com
- DNS ASK bo###eqadbm.com
- DNS ASK ry####ioyrcsu.com
- DNS ASK md####svdqbxp.com
- DNS ASK vw#####rpuurtusi.com
- DNS ASK hk###mpjeg.com
- DNS ASK ka#####paanwnuopbj.com
- DNS ASK lm####mkmpayyu.com
- DNS ASK gv#####sdmjqufbfgdg.com
- DNS ASK si####rsxdqmvq.com
- DNS ASK yp####matxojboh.com
- DNS ASK nt#####fxonbvkqed.com
- DNS ASK bo###svsvt.com
- DNS ASK rm####lnycyft.com
- DNS ASK qa####dglsnraye.com
- DNS ASK ei####sddpwxl.com
- DNS ASK ru#####qxveivksuvi.com
- DNS ASK xw####gjrikdwy.com
- DNS ASK wh####fgvpyr.com
- DNS ASK dh###btnxja.com
