Overview
Characteristics
File: Install.exe
Hash: b99dea7ecf6304eaeac4a98bc71ec846
Upon execution connects to [removed].881515.net and downloads executable files from it.
Creates files listed below under %system32% folder.
File: gewow.exe
Hash: 19e6e767dcace9965914cc7b972534<WBR>17
File: logo_1.exe
Hash: 8659b18cc9a6f3edbe5cfb40a9b388<WBR>07
Creates files shown below in %temp% folder.
File: 2211.dll
Hash: 541e4edf3977a13072fc0acfaf23ff<WBR>c7
File: 10185.dll
Hash: bda998a48d59b5ecf4ff579c5153ad<WBR>0c
Creates following run registry values in order to get executed each reboot.
- HKEY_LOCAL_MACHINE\SOFTWARE<WBR>\Microsoft\Windows\CurrentVersi<WBR>on\Run "logg"
Data: c:\windows\system32\logo_1.exe - HKEY_LOCAL_MACHINE\SOFTWARE<WBR>\Microsoft\Windows\CurrentVersi<WBR>on\Run "wow"
Data: C:\WINDOWS\system32\gewow.exe
Symptoms
Presence of files and registry keys listed above confirms the attack.
Method of Infection
N/A. Downloaders are not viruses, and as such do not themselves contain any method to replicate. However they may themselves be downloaded by other viruses and/or Trojans to be installed on the user's system.
Removal
A combination of the latest DATs and the Engine will be able to detect and remove this threat. AVERT recommends users not to trust seemingly familiar or safe file icons, particularly when received via P2P clients, IRC, email or other media where users can share files.
Variants