Technical Information
Malicious functions:
Creates and executes the following:
- %TEMP%\install-part12.exe (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\attrib.exe -H -R "%TEMP%\mdmxa$$$$.bat"
- <SYSTEM32>\cmd.exe /c %TEMP%\mdmxa$$$$.bat
Modifies file system :
Creates the following files:
- %HOMEPATH%\Favorites\G마켓.url
- %HOMEPATH%\Favorites\gmarket.url
- %HOMEPATH%\Favorites\G마캣.url
- %HOMEPATH%\Favorites\CJON마트.url
- %HOMEPATH%\Favorites\지마켓.url
- %HOMEPATH%\Favorites\GSSHOP.url
- %HOMEPATH%\Favorites\gseshop.url
- %HOMEPATH%\Favorites\GS샵.url
- %HOMEPATH%\Favorites\gmaket.url
- %HOMEPATH%\Favorites\GS SHOP.url
- %HOMEPATH%\Favorites\CJON mart.url
- %HOMEPATH%\Favorites\지에스홈쇼핑.url
- %HOMEPATH%\Favorites\AK몰.url
- %HOMEPATH%\Favorites\지에스이숍.url
- %HOMEPATH%\Favorites\지에스숍.url
- %HOMEPATH%\Favorites\지에스이샵.url
- %HOMEPATH%\Favorites\CJmall.url
- %HOMEPATH%\Favorites\cjon.url
- %HOMEPATH%\Favorites\cj쇼핑.url
- %HOMEPATH%\Favorites\assacom.url
- %HOMEPATH%\Favorites\cj마트.url
- %HOMEPATH%\Favorites\Links\G마켓.url
- %WINDIR%\auction_favicon.ico
- %WINDIR%\gmarket_favicon.ico
- %HOMEPATH%\Favorites\filejo.url
- %HOMEPATH%\Favorites\파일조.url
- %TEMP%\install-part12.exe
- %TEMP%\mdmxa$$$$.bat
- %HOMEPATH%\Favorites\Links\11번가.url
- %HOMEPATH%\Favorites\Links\옥션.url
- %WINDIR%\11st_favicon.ico
- %HOMEPATH%\Favorites\rmfnvhs.url
- %HOMEPATH%\Favorites\NS이숍.url
- %HOMEPATH%\Favorites\wlakzpt.url
- %HOMEPATH%\Favorites\LG패션샵.url
- %HOMEPATH%\Favorites\H몰.url
- %HOMEPATH%\Favorites\Hmall.url
- %HOMEPATH%\Favorites\그루폰.url
- %HOMEPATH%\Favorites\groupon.url
- %HOMEPATH%\Favorites\티몬.url
- %HOMEPATH%\Favorites\플라이워치.url
- %HOMEPATH%\Favorites\티켓몬스터.url
- %HOMEPATH%\Favorites\지에스샵.url
- %HOMEPATH%\Favorites\롯데홈쇼핑.url
- %HOMEPATH%\Favorites\면세점.url
- %HOMEPATH%\Favorites\롯데인터넷면세점.url
- %HOMEPATH%\Favorites\롯데마트쇼핑몰.url
- %HOMEPATH%\Favorites\롯데마트인터넷쇼핑몰.url
- %HOMEPATH%\Favorites\신세계.url
- %HOMEPATH%\Favorites\신세계몰.url
- %HOMEPATH%\Favorites\신라인터넷면세점.url
- %HOMEPATH%\Favorites\명품관.url
- %HOMEPATH%\Favorites\신라면세점.url
- %HOMEPATH%\Favorites\롯데마트.url
- %HOMEPATH%\Favorites\1300k.url
- %HOMEPATH%\Favorites\가방팝.url
- %HOMEPATH%\Favorites\11st.url
- %HOMEPATH%\Favorites\11번가.url
- %HOMEPATH%\Favorites\11qjsrk.url
- %HOMEPATH%\Favorites\더페이스샵.url
- %HOMEPATH%\Favorites\디앤샵.url
- %HOMEPATH%\Favorites\대출.url
- %HOMEPATH%\Favorites\꽃배달.url
- %HOMEPATH%\Favorites\농수산홈쇼핑.url
- %HOMEPATH%\Favorites\우체국쇼핑.url
- %HOMEPATH%\Favorites\워커힐면세점.url
- %HOMEPATH%\Favorites\dhrtus.url
- %HOMEPATH%\Favorites\옥션.url
- %HOMEPATH%\Favorites\auction.url
- %HOMEPATH%\Favorites\이마트상품.url
- %HOMEPATH%\Favorites\이마트인터넷쇼핑몰.url
- %HOMEPATH%\Favorites\이마트.url
- %HOMEPATH%\Favorites\원어데이.url
- %HOMEPATH%\Favorites\웹하드.url
- %HOMEPATH%\Favorites\연예인디씨.url
- %HOMEPATH%\Favorites\씨제이오쇼핑.url
- %HOMEPATH%\Favorites\씨제이온마트.url
- %HOMEPATH%\Favorites\씨제이쇼핑.url
- %HOMEPATH%\Favorites\씨제이마트.url
- %HOMEPATH%\Favorites\씨제이몰.url
- %HOMEPATH%\Favorites\아이스타일24.url
- %HOMEPATH%\Favorites\엔조이뉴욕.url
- %HOMEPATH%\Favorites\아이스타일.url
- %HOMEPATH%\Favorites\씨제이.url
- %HOMEPATH%\Favorites\아싸컴.url
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Favorites\CJmall.url
- %HOMEPATH%\Favorites\cjon.url
- %HOMEPATH%\Favorites\cj마트.url
- %HOMEPATH%\Favorites\cj쇼핑.url
- %HOMEPATH%\Favorites\CJON mart.url
- %HOMEPATH%\Favorites\G마켓.url
- %HOMEPATH%\Favorites\gmarket.url
- %HOMEPATH%\Favorites\CJON마트.url
- %HOMEPATH%\Favorites\G마캣.url
- %HOMEPATH%\Favorites\지에스샵.url
- %HOMEPATH%\Favorites\지에스숍.url
- %HOMEPATH%\Favorites\이마트상품.url
- %HOMEPATH%\Favorites\이마트인터넷쇼핑몰.url
- %HOMEPATH%\Favorites\지에스이샵.url
- %HOMEPATH%\Favorites\AK몰.url
- %HOMEPATH%\Favorites\assacom.url
- %HOMEPATH%\Favorites\지에스이숍.url
- %HOMEPATH%\Favorites\지에스홈쇼핑.url
- %HOMEPATH%\Favorites\gmaket.url
- %HOMEPATH%\Favorites\티몬.url
- %HOMEPATH%\Favorites\그루폰.url
- %HOMEPATH%\Favorites\플라이워치.url
- %HOMEPATH%\Favorites\티켓몬스터.url
- %HOMEPATH%\Favorites\groupon.url
- %HOMEPATH%\Favorites\파일조.url
- %TEMP%\mdmxa$$$$.bat
- %HOMEPATH%\Favorites\rmfnvhs.url
- %HOMEPATH%\Favorites\filejo.url
- %HOMEPATH%\Favorites\GSSHOP.url
- %HOMEPATH%\Favorites\gseshop.url
- %HOMEPATH%\Favorites\GS SHOP.url
- %HOMEPATH%\Favorites\GS샵.url
- %HOMEPATH%\Favorites\H몰.url
- %HOMEPATH%\Favorites\NS이숍.url
- %HOMEPATH%\Favorites\wlakzpt.url
- %HOMEPATH%\Favorites\Hmall.url
- %HOMEPATH%\Favorites\LG패션샵.url
- %HOMEPATH%\Favorites\이마트.url
- %HOMEPATH%\Favorites\롯데마트인터넷쇼핑몰.url
- %HOMEPATH%\Favorites\롯데인터넷면세점.url
- %HOMEPATH%\Favorites\롯데마트.url
- %HOMEPATH%\Favorites\롯데마트쇼핑몰.url
- %HOMEPATH%\Favorites\롯데홈쇼핑.url
- %HOMEPATH%\Favorites\신라면세점.url
- %HOMEPATH%\Favorites\신라인터넷면세점.url
- %HOMEPATH%\Favorites\면세점.url
- %HOMEPATH%\Favorites\명품관.url
- %HOMEPATH%\Favorites\1300k.url
- %HOMEPATH%\Favorites\가방팝.url
- %HOMEPATH%\Favorites\11qjsrk.url
- %HOMEPATH%\Favorites\11st.url
- %HOMEPATH%\Favorites\꽃배달.url
- %HOMEPATH%\Favorites\더페이스샵.url
- %HOMEPATH%\Favorites\디앤샵.url
- %HOMEPATH%\Favorites\농수산홈쇼핑.url
- %HOMEPATH%\Favorites\대출.url
- %HOMEPATH%\Favorites\신세계.url
- %HOMEPATH%\Favorites\연예인디씨.url
- %HOMEPATH%\Favorites\auction.url
- %HOMEPATH%\Favorites\아이스타일24.url
- %HOMEPATH%\Favorites\엔조이뉴욕.url
- %HOMEPATH%\Favorites\dhrtus.url
- %HOMEPATH%\Favorites\원어데이.url
- %HOMEPATH%\Favorites\웹하드.url
- %HOMEPATH%\Favorites\우체국쇼핑.url
- %HOMEPATH%\Favorites\워커힐면세점.url
- %HOMEPATH%\Favorites\씨제이몰.url
- %HOMEPATH%\Favorites\씨제이쇼핑.url
- %HOMEPATH%\Favorites\신세계몰.url
- %HOMEPATH%\Favorites\씨제이마트.url
- %HOMEPATH%\Favorites\씨제이오쇼핑.url
- %HOMEPATH%\Favorites\아싸컴.url
- %HOMEPATH%\Favorites\아이스타일.url
- %HOMEPATH%\Favorites\씨제이온마트.url
- %HOMEPATH%\Favorites\씨제이.url
Deletes the following files:
- %TEMP%\install-part12.exe
Deletes itself.
Network activity:
Connects to:
- 'do##.#ne-step.pe.kr':80
- 'www.go###va.co.kr':80
TCP:
HTTP GET requests:
- do##.#ne-step.pe.kr/install/one/install-part12.exe
HTTP POST requests:
- www.go###va.co.kr/pops/logs.v/set/end.php
- www.go###va.co.kr/pops/logs.v/set/begin.php
UDP:
- DNS ASK do##.#ne-step.pe.kr
- DNS ASK www.go###va.co.kr
- '<Private IP address>':1037
