PE_VIRUX.R-1

This file infector hooks certain APIs so that when these APIs are called, the virus code is executed which then infects files. It does not infect files with certain characteristics. It returns execution to the host file's original code after execution.

It may also connect to randomly generated domains for its C&C (command and control) server using a randomizing function, which is computed based on the system's current date and time. The generated domain is {6 random characters}.com.

It connects to the mentioned servers using 8-randomly generated character for its NICK and 1-randomly generated character for its USER. Once connected to the IRC server, it joins a certain channel to receive and execute commands on the affected system.

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It infects by appending its code to target host files.

Arrival Details

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This file infector injects threads into the following normal process(es):

• winlogon.exe

Other System Modifications

This file infector adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
\??\%System%\winlogon.exe = "\??\%System\winlogon.exe:*:enabled:@shell32.dll,-1"

File Infection

This file infector infects the following file types:

• EXE
• SCR

It infects by appending its code to target host files.

It avoids infecting files that contain the following strings in their names:

• OTSP
• WC32
• WCUN
• WINC

It avoids infecting the following files:

• .DLL files
• PE Files with _win section name
• Files with infection marker

Propagation

This file infector drops the following copy(ies) of itself in all removable drives:

• game.exe

Backdoor Routine

This file infector connects to any of the following IRC server(s):

• {BLOCKED}nz.pl
• {BLOCKED}nz.pl

NOTES:

It hooks the following APIs so that when these APIs are called, the virus code is executed which then infects files:

• NtCreateFile
• NtCreateProcess
• NtCreateProcessEx
• NtDeviceIoControlFile
• NtOpenFile
• NtQueryInformationProcess

It returns execution to the host file's original code after execution.

It may also connect to randomly generated domains for its C&C (command and control) server using a randomizing function, which is computed based on the system's current date and time. The generated domain is {6 random characters}.com.

It connects to the mentioned servers using 8-randomly generated character for its NICK and 1-randomly generated character for its USER. Once connected to the IRC server, it joins a certain channel to receive and execute commands on the affected system.

It creates a shortcut link that points to its dropped copy in all removable drives.