Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'SystemControler' = '%ProgramFiles%\net64n~1\cmss.exe'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "C:\PROGRA~2\NET64N~1\comres.exe" "comres.exe" ENABLE
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="comres.exe" dir=in action=allow program="C:\PROGRA~2\NET64N~1\comres.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="comres.exe" dir=in action=allow program="C:\PROGRA~2\NET64N~1\comres.exe" enable=yes profile=public
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "C:\PROGRA~2\NET64N~1\cmss.exe" "cmss.exe" ENABLE
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="cmss.exe" dir=in action=allow program="C:\PROGRA~2\NET64N~1\cmss.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="cmss.exe" dir=in action=allow program="C:\PROGRA~2\NET64N~1\cmss.exe" enable=yes profile=public
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "C:\PROGRA~2\NET64N~1\RDS.exe" "RDS.exe" ENABLE
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="RDS.exe" dir=in action=allow program="C:\PROGRA~2\NET64N~1\RDS.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="RDS.exe" dir=in action=allow program="C:\PROGRA~2\NET64N~1\RDS.exe" enable=yes profile=public
Modifies file system
Creates the following files
- %TEMP%\nse758d.tmp
- %TEMP%\compress0\type.dll
- %TEMP%\compress0\svers.dll
- %TEMP%\compress0\ssap.dll
- %TEMP%\compress0\sid2.dll
- %TEMP%\compress0\seekil.dll
- %TEMP%\compress0\seek.dll
- %TEMP%\compress0\scloc.dll
- %TEMP%\compress0\scint.dll
- %TEMP%\compress0\update.dll
- %TEMP%\compress0\scen.dll
- %TEMP%\compress0\scday.dll
- %TEMP%\compress0\sccle.dll
- %TEMP%\compress0\scan.dll
- %TEMP%\compress0\rwcs.dll
- %TEMP%\compress0\rwci.dll
- %TEMP%\compress0\scint2.dll
- %TEMP%\compress0\mailsc.dll
- %TEMP%\compress0\user.dll
- %ProgramFiles%\accessories\common\online_time.txt
- %ProgramFiles%\accessories\common\pc_active_time.txt
- %ProgramFiles%\accessories\common\chat_log.txt
- %ProgramFiles%\accessories\common\kb_log.txt
- %ProgramFiles%\accessories\common\desktop.ini
- C:\mswinsck.ocx
- %WINDIR%\hpvert.dll
- %TEMP%\compress0\rwce.dll
- %TEMP%\compress0\unin.dll
- %ProgramFiles%\net64n~1\rds.exe
- %ProgramFiles%\net64n~1\msmsgs.exe
- %ProgramFiles%\net64n~1\cmss.exe
- %ProgramFiles%\net64n~1\comres.exe
- %TEMP%\compress0\zipinfo.txt
- %TEMP%\compress0\winsyst32.exe
- %TEMP%\compress0\weben.dll
- %WINDIR%\svers.dll
- %TEMP%\compress0\ushost.dll
- %TEMP%\compress0\rvport.dll
- %TEMP%\compress0\rvhost.dll
- %TEMP%\compress0\rmdesk.dll
- %TEMP%\compress0\emfz.dll
- %TEMP%\compress0\ften.dll
- %TEMP%\compress0\ftde.dll
- %TEMP%\compress0\emoo.dll
- %TEMP%\compress0\emon.dll
- %TEMP%\compress0\eminu.dll
- %TEMP%\compress0\emine.dll
- %ProgramFiles%\accessories\common\websites_summary.txt
- %TEMP%\compress0\ftpa.dll
- %TEMP%\compress0\emdc.dll
- %TEMP%\compress0\dunin.dll
- %TEMP%\compress0\dete.dll
- %TEMP%\compress0\delkl.dll
- %TEMP%\compress0\comres.exe
- %TEMP%\compress0\ccsvchst.exe
- %TEMP%\compress0\ass.dll
- %TEMP%\compress0\emfzb.dll
- %WINDIR%\refsdm.dll
- %TEMP%\compress0\ftps.dll
- %TEMP%\compress0\ftus.dll
- %TEMP%\compress0\ftsv.dll
- %TEMP%\compress0\resu.dll
- %TEMP%\compress0\refsdm.dll
- %TEMP%\compress0\rds.exe
- %TEMP%\compress0\pwhost.dll
- %TEMP%\compress0\port.dll
- %TEMP%\compress0\oem.dll
- %TEMP%\compress0\fttx.dll
- %TEMP%\compress0\mswinsck.ocx
- %TEMP%\compress0\ftin.dll
- %TEMP%\compress0\mailkl.dll
- %TEMP%\compress0\mail.dll
- %TEMP%\compress0\inuser.dll
- %TEMP%\compress0\inter.dll
- %TEMP%\compress0\inmsg.dll
- %TEMP%\compress0\hpvert.dll
- %TEMP%\compress0\msmsgs.exe
- %ProgramFiles%\accessories\common\websites_detail.txt
Sets the 'hidden' attribute to the following files
- %WINDIR%\hpvert.dll
Network activity
Connects to
- '67.##5.111.54':37
- '17#.#38.173.178':17173
- '17#.#38.173.178':27171
- '17#.#38.173.178':17175
- '67.##5.111.54':14001
- '17#.#38.173.178':27181
Miscellaneous
Searches for the following windows
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
- ClassName: 'IEFrame' WindowName: ''
Creates and executes the following
- '%TEMP%\compress0\ccsvchst.exe'
- '%ProgramFiles%\net64n~1\cmss.exe'
- '%ProgramFiles%\net64n~1\msmsgs.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c echo y| CACLS C:\PROGRA~2\NET64N~1 /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c echo y| CACLS C:\PROGRA~1\ACCESS~1\Common /G Everyone:f
- '%WINDIR%\syswow64\cacls.exe' C:\PROGRA~1\ACCESS~1\Common /G Everyone:f
- '%WINDIR%\syswow64\cacls.exe' C:\PROGRA~2\NET64N~1 /G Everyone:f
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ProgramFiles(x86)%\net64ntfs\co...
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo y"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="comres.exe" dir=in action=allow program="C:\PROGRA~2\NET64N~1\comres.exe" enable=yes profile=public' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "C:\PROGRA~2\NET64N~1\cmss.exe" "cmss.exe" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="comres.exe" dir=in action=allow program="C:\PROGRA~2\NET64N~1\comres.exe" enable=yes' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="cmss.exe" dir=in action=allow program="C:\PROGRA~2\NET64N~1\cmss.exe" enable=yes profile=public' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="RDS.exe" dir=in action=allow program="C:\PROGRA~2\NET64N~1\RDS.exe" enable=yes profile=public' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="RDS.exe" dir=in action=allow program="C:\PROGRA~2\NET64N~1\RDS.exe" enable=yes' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "C:\PROGRA~2\NET64N~1\RDS.exe" "RDS.exe" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y| CACLS C:\PROGRA~2\NET64N~1 /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y| CACLS C:\PROGRA~1\ACCESS~1\Common /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "C:\PROGRA~2\NET64N~1\comres.exe" "comres.exe" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="cmss.exe" dir=in action=allow program="C:\PROGRA~2\NET64N~1\cmss.exe" enable=yes' (with hidden window)
