When first run Mitglieder.GB copies itself to %WINDIR%\system32\hloader_exe.exe and drops the file hleader_dll.dll to the same directory (also detected as Mitglieder.GB). Then it injects the file hleader_dll.dll into explorer.exe. It adds the value:
"auto__hloader__key"="%WINDIR%\system32\hloader_exe.exe"
to the keys:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
When all this is done the process terminates and only the dll component continues running in explorer's namespace.
The dll component runs in an endless loop checking if the infected computer is connected to the internet and if so, tries to download a file named w.php from multiple URLs. It creates directory %WINDIR%\exefld and downloads the file there under a random name. If it manages to download then it's executed.
|
