Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\aloiguvd.exe'
- '<SYSTEM32>\coxxsfsg.exe'
- '<SYSTEM32>\cmbowcqu.exe'
- '<SYSTEM32>\rlkyvqps.exe'
- '<SYSTEM32>\zktunyzo.exe' /pid=3656
- '<SYSTEM32>\nthkecxc.exe'
- '<SYSTEM32>\fqgizpkl.exe'
- '<SYSTEM32>\lmxttlzw.exe'
- '<SYSTEM32>\tvibukwa.exe' /pid=3984
- '<SYSTEM32>\ldxpniwv.exe'
- '<SYSTEM32>\figjguch.exe'
- '<SYSTEM32>\uhycyywj.exe'
- '<SYSTEM32>\hwfbifcy.exe'
- '<SYSTEM32>\lfzdgddg.exe'
- '<SYSTEM32>\zktunyzo.exe'
- '<SYSTEM32>\akjxzhnh.exe'
- '<SYSTEM32>\jpywtcng.exe'
- '<SYSTEM32>\qctyfozy.exe'
- '<SYSTEM32>\tvibukwa.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\rlkyvqps.exe
- <SYSTEM32>\cmbowcqu.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\uolsn[5].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\uolsn[5].dll
- <SYSTEM32>\aloiguvd.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\uolsn[4].dll
- <SYSTEM32>\jpywtcng.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\uolsn[5].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\uolsn[4].dll
- <SYSTEM32>\ldxpniwv.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\uolsn[4].dll
- <SYSTEM32>\nthkecxc.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\uolsn[7].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\uolsn[6].dll
- <SYSTEM32>\fqgizpkl.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\uolsn[7].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\uolsn[6].dll
- <SYSTEM32>\coxxsfsg.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\uolsn[5].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\uolsn[6].dll
- <SYSTEM32>\lmxttlzw.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\uolsn[6].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\uolsn[2].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\uolsn[1].dll
- <SYSTEM32>\figjguch.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\uolsn[2].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\uolsn[2].dll
- <SYSTEM32>\lfzdgddg.exe
- <SYSTEM32>\uolsn.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\uolsn[1].dll
- <SYSTEM32>\hwfbifcy.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\uolsn[1].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\uolsn[1].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\uolsn[3].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\uolsn[3].dll
- <SYSTEM32>\tvibukwa.exe
- <SYSTEM32>\akjxzhnh.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\uolsn[4].dll
- <SYSTEM32>\qctyfozy.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\uolsn[2].dll
- <SYSTEM32>\uhycyywj.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\uolsn[3].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\uolsn[3].dll
- <SYSTEM32>\zktunyzo.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\rlkyvqps.exe
- <SYSTEM32>\aloiguvd.exe
- <SYSTEM32>\ldxpniwv.exe
- <SYSTEM32>\cmbowcqu.exe
- <SYSTEM32>\nthkecxc.exe
- <SYSTEM32>\fqgizpkl.exe
- <SYSTEM32>\coxxsfsg.exe
- <SYSTEM32>\lmxttlzw.exe
- <SYSTEM32>\jpywtcng.exe
- <SYSTEM32>\figjguch.exe
- <SYSTEM32>\uhycyywj.exe
- <SYSTEM32>\hwfbifcy.exe
- <SYSTEM32>\lfzdgddg.exe
- <SYSTEM32>\tvibukwa.exe
- <SYSTEM32>\akjxzhnh.exe
- <SYSTEM32>\zktunyzo.exe
- <SYSTEM32>\qctyfozy.exe
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\uolsn[4].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\uolsn[5].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\uolsn[7].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\uolsn[1].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\uolsn[3].dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\uolsn[4].dll
Network activity:
Connects to:
- 'localhost':1090
- 'localhost':1089
- 'localhost':1096
- 'localhost':1094
- 'localhost':1087
- 'localhost':1080
- 'localhost':1076
- 'localhost':1085
- 'localhost':1082
- 'localhost':1113
- 'localhost':1109
- 'localhost':1118
- 'localhost':1115
- 'localhost':1108
- 'localhost':1099
- 'localhost':1098
- 'localhost':1105
- 'localhost':1103
- 'localhost':1047
- 'localhost':1046
- 'localhost':1052
- 'localhost':1051
- 'localhost':1041
- 'ma######main.dothome.co.kr':80
- 'localhost':1036
- 'localhost':1040
- 'bl##.naver.com':80
- 'localhost':1071
- 'localhost':1068
- 'localhost':1075
- 'localhost':1072
- 'localhost':1066
- 'localhost':1058
- 'localhost':1056
- 'localhost':1062
- 'localhost':1061
TCP:
HTTP GET requests:
- bl##.naver.com/PostView.nhn?bl################################################################################################################################################################################################
- ma######main.dothome.co.kr/uolsn.dll
UDP:
- DNS ASK bl##.naver.com
- DNS ASK ma######main.dothome.co.kr
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
