Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%WINDIR%\test\svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{88RT8-U084T6Q-B9Q96-PDG1KN-1CKWCELQV}] 'StubPath' = '%WINDIR%\test\svchost.exe Restart'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'msnmsgsr' = '%WINDIR%\test\svchost.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\sr] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\srservice] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Creates and executes the following:
- %WINDIR%\test\svchost.exe
Executes the following:
- <SYSTEM32>\ping.exe 127.0.0.1 -n 10
- <SYSTEM32>\cmd.exe /c ""<SYSTEM32>\_dcsc_.bat" "
- <SYSTEM32>\wscript.exe "<SYSTEM32>\Script.vbs"
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1275210071-117609710-1801674531-500
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-1275210071-117609710-1801674531-500
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- %TEMP%\WININIT
- %TEMP%\USEPASS
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\rp.log
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\Y!SUPRA.EXE
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\change.log
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\RestorePointSize
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\A0000001.vbs
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\domain.txt
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_MACHINE_SAM
- <SYSTEM32>\_dcsc_.bat
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\_driver.cfg
- %TEMP%\HKNAME
- %TEMP%\GENCODE
- %TEMP%\FULLPATH
- %TEMP%\HKT
- %TEMP%\ISACTIVX
- %TEMP%\IMIN
- %TEMP%\IMAX
- %TEMP%\FILEATTRIB
- <SYSTEM32>\Script.vbs
- %TEMP%\gg.ico
- C:\www.google.com.htm
- %WINDIR%\test\svchost.exe
- %TEMP%\DVCLAL
- %TEMP%\DIRATTRIB
- %TEMP%\ACTIVXNAME
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\drivetable.txt
- <SYSTEM32>\Restore\MachineGuid.txt
- %TEMP%\PASS
- %TEMP%\PREFIXTYPE
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\_filelst.cfg
- %TEMP%\USEMUTEX
- %TEMP%\SERVERID
- %TEMP%\PACKAGEINFO
- %TEMP%\KEYLOGGER
- %TEMP%\ISHK
- %TEMP%\ISBIND
- %TEMP%\M3
- %TEMP%\NETDATA
- %TEMP%\MUTEXNAME
- %TEMP%\MELT
Sets the 'hidden' attribute to the following files:
- %WINDIR%\test\svchost.exe
- C:\www.google.com.htm
Deletes the following files:
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\_driver.cfg
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\_filelst.cfg
- <SYSTEM32>\Restore\MachineGuid.txt
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1275210071-117609710-1801674531-500
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-1275210071-117609710-1801674531-500
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\rp.log
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\domain.txt
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\RestorePointSize
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\drivetable.txt
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\A0000001.vbs
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\change.log.1
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E9F1FFFA-7940-4ABA-BEC6-8E56211F48E2}\RP1\snapshot\Repository\FS\MAPPING.VER
Deletes itself.
Network activity:
Connects to:
- 'ys##ra.net':80
- 'sh####r1.no-ip.biz':1604
TCP:
HTTP GET requests:
- ys##ra.net/ysupra_update/version.php?ve##############
UDP:
- DNS ASK ys##ra.net
- DNS ASK sh####r1.no-ip.biz
Miscellaneous:
Searches for the following windows:
- ClassName: 'winamp v1.x' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
