Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dashborder_120.bmp
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe
Modifies file system
Creates the following files
- %TEMP%\ccakusat.txt
- %TEMP%\vbc3361.tmp
- %TEMP%\res3362.tmp
- C:\far2.exe
- %TEMP%\xwngnmyk.0.vb
- %TEMP%\xwngnmyk.cmdline
- %TEMP%\xwngnmyk.out
- %TEMP%\res39da.tmp
- C:\$recycle.bin.exe
- %APPDATA%\discord.exe
- C:\msocache.exe
- %TEMP%\gngi-k6u.0.vb
- %TEMP%\gngi-k6u.cmdline
- %TEMP%\gngi-k6u.out
- %TEMP%\vbc4301.tmp
- %TEMP%\lesmauy7.out
- %TEMP%\lesmauy7.cmdline
- %TEMP%\lesmauy7.0.vb
- C:\documents and settings.exe
- %TEMP%\res2cda.tmp
- %TEMP%\vbc2cd9.tmp
- %TEMP%\hkfwj-uy.out
- %TEMP%\hkfwj-uy.cmdline
- %TEMP%\hkfwj-uy.0.vb
- %TEMP%\vbc39ca.tmp
- %TEMP%\res271e.tmp
- %TEMP%\vbc271d.tmp
- %TEMP%\b-z3ullx.out
- %TEMP%\b-z3ullx.cmdline
- %TEMP%\b-z3ullx.0.vb
- %PROGRAMDATA%\discord\axjeexv.ico
- C:\discord\discord.exe
- %TEMP%\res4302.tmp
- C:\perflogs.exe
Sets the 'hidden' attribute to the following files
- C:\discord\discord.exe
Deletes the following files
- %TEMP%\res271e.tmp
- %TEMP%\gngi-k6u.cmdline
- %TEMP%\xwngnmyk.out
- %TEMP%\xwngnmyk.cmdline
- %TEMP%\xwngnmyk.0.vb
- %TEMP%\vbc39ca.tmp
- %TEMP%\res39da.tmp
- %TEMP%\lesmauy7.0.vb
- %TEMP%\lesmauy7.out
- %TEMP%\lesmauy7.cmdline
- %TEMP%\res4302.tmp
- %TEMP%\vbc3361.tmp
- %TEMP%\hkfwj-uy.cmdline
- %TEMP%\hkfwj-uy.0.vb
- %TEMP%\hkfwj-uy.out
- %TEMP%\vbc2cd9.tmp
- %TEMP%\res2cda.tmp
- %TEMP%\b-z3ullx.out
- %TEMP%\b-z3ullx.cmdline
- %TEMP%\b-z3ullx.0.vb
- %TEMP%\vbc271d.tmp
- %TEMP%\res3362.tmp
- %TEMP%\vbc4301.tmp
Network activity
Connects to
- 'Ub#######sLV-46838.portmap.host':57073
UDP
- DNS ASK Ub#######sLV-46838.portmap.host
Miscellaneous
Creates and executes the following
- '%APPDATA%\discord.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\b-z3ullx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF8C5.tmp" "%TEMP%\vbcF8C4.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ljsvtcpn.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF5D7.tmp" "%TEMP%\vbcF5D6.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1lf9g47z.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF2DA.tmp" "%TEMP%\vbcF2C9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kwhd81dy.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEB77.tmp" "%TEMP%\vbcEB76.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kdnlj60e.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE8D7.tmp" "%TEMP%\vbcE8D6.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fmyxzulp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE6E3.tmp" "%TEMP%\vbcE6E2.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jpyxlmw0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE4C0.tmp" "%TEMP%\vbcE4BF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\n2nqsdna.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4302.tmp" "%TEMP%\vbc4301.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gngi-k6u.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES39DA.tmp" "%TEMP%\vbc39CA.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xwngnmyk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3362.tmp" "%TEMP%\vbc3361.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lesmauy7.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2CDA.tmp" "%TEMP%\vbc2CD9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hkfwj-uy.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES271E.tmp" "%TEMP%\vbc271D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uskc96cl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFE63.tmp" "%TEMP%\vbcFE62.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF8C5.tmp" "%TEMP%\vbcF8C4.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ljsvtcpn.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF5D7.tmp" "%TEMP%\vbcF5D6.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\1lf9g47z.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF2DA.tmp" "%TEMP%\vbcF2C9.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kwhd81dy.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEB77.tmp" "%TEMP%\vbcEB76.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kdnlj60e.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE8D7.tmp" "%TEMP%\vbcE8D6.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fmyxzulp.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE6E3.tmp" "%TEMP%\vbcE6E2.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\uskc96cl.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jpyxlmw0.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\n2nqsdna.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4302.tmp" "%TEMP%\vbc4301.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\gngi-k6u.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES39DA.tmp" "%TEMP%\vbc39CA.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xwngnmyk.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3362.tmp" "%TEMP%\vbc3361.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\lesmauy7.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2CDA.tmp" "%TEMP%\vbc2CD9.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hkfwj-uy.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES271E.tmp" "%TEMP%\vbc271D.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\b-z3ullx.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE4C0.tmp" "%TEMP%\vbcE4BF.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFE63.tmp" "%TEMP%\vbcFE62.tmp"
