Technical Information
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\Microsoft Security Adviser\mssadv.exe (downloaded from the Internet)
- %PROGRAM_FILES%\Microsoft Security Adviser\msctrl.exe (downloaded from the Internet)
- %PROGRAM_FILES%\Microsoft Security Adviser\dis.exe (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\route.exe -p add 81.95.149.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 81.95.148.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 81.95.151.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 81.95.150.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 81.29.241.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 72.232.195.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 72.232.194.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 80.77.113.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 72.232.202.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 85.12.60.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 69.50.3.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 69.50.2.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\regsvr32.exe -s -u <SYSTEM32>\shimgvw.dll
- <SYSTEM32>\route.exe -p add 85.255.0.0 MASK 255.255.0.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 69.50.1.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 89.253.244.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 88.85.66.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 90.156.149.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 90.156.148.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 208.72.173.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 208.72.172.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 208.72.175.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 208.72.174.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 208.72.171.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 208.72.168.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 206.51.238.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 208.72.170.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 208.72.169.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 209.44.98.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 69.10.39.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 67.19.85.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 72.21.46.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 69.31.45.181 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 64.28.184.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 216.255.188.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 209.67.217.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 64.28.178.0 MASK 255.255.255.0 192.168.193.140 metric 1
- <SYSTEM32>\route.exe -p add 58.65.239.0 MASK 255.255.255.0 192.168.193.140 metric 1
Modifies file system :
Creates the following files:
- %WINDIR%\msctrl.dll
- %WINDIR%\msavsc.dll
- %PROGRAM_FILES%\Microsoft Security Adviser\msiemon.exe
- %PROGRAM_FILES%\Microsoft Security Adviser\msfw.exe
- %WINDIR%\msscan.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\nua[1].php
- %TEMP%\RGI1.tmp
- %WINDIR%\msiemon.dll
- %WINDIR%\msfw.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\out[1].php
- %PROGRAM_FILES%\Microsoft Security Adviser\mssadv.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\out[1].php
- %PROGRAM_FILES%\Microsoft Security Adviser\msctrl.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\out[1].php
- %PROGRAM_FILES%\Microsoft Security Adviser\msavsc.exe
- %PROGRAM_FILES%\Microsoft Security Adviser\msscan.exe
- %PROGRAM_FILES%\Microsoft Security Adviser\dis.exe
- %WINDIR%\mssadv.dll
Deletes the following files:
- %TEMP%\RGI1.tmp
Network activity:
Connects to:
- 'lo#.##indall.com':80
- 'pi###unter.info':80
- 'localhost':1037
TCP:
HTTP GET requests:
- lo#.##indall.com/nua.php
- pi###unter.info/out.php?e=######
UDP:
- DNS ASK lo#.##indall.com
- DNS ASK pi###unter.info
