Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '№¤ѕЯ.exe' = 'ЎѕУгУҐѕь¶УЎїZHX.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '№¤ѕЯ.exe' = 'C:\Users\Administrator\Desktop\ЎѕУгУҐѕь¶УЎїZHX.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
modifies the following system settings:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFileMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = 'FFFFFFFF'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = 'FFFFFFFF'
Executes the following:
- '<SYSTEM32>\net1.exe' localgroup Administrators Forbidden /add
- '<SYSTEM32>\syskey.exe'
- '<SYSTEM32>\net1.exe' user Administrator /active:no
- '<SYSTEM32>\iexpress.exe'
- '<SYSTEM32>\net.exe' user Administrator /active:no
- '<SYSTEM32>\net1.exe' start Server
- '<SYSTEM32>\net1.exe' user Forbidden /active:yes
- '<SYSTEM32>\shutdown.exe' -s -t 3600
- '<SYSTEM32>\nslookup.exe'
- '<SYSTEM32>\net1.exe' password
- '<SYSTEM32>\net1.exe' stop
- '<SYSTEM32>\net1.exe' user guest 5197
- '<SYSTEM32>\net1.exe' share c$ /del
- '<SYSTEM32>\net.exe' stop
- '<SYSTEM32>\net.exe' share c$ /del
- '<SYSTEM32>\net.exe' password
- '<SYSTEM32>\net.exe' user guest 5197
- '<SYSTEM32>\net.exe' localgroup Administrators Forbidden /add
- '<SYSTEM32>\taskkill.exe' /f /im VsTskMgr.exe
- '<SYSTEM32>\taskkill.exe' /f /im Mcshield.exe
- '<SYSTEM32>\net.exe' share houmen$=c:\
- '<SYSTEM32>\taskkill.exe' /f /im 360tray.exe
- '<SYSTEM32>\taskkill.exe' /f /im KVXP.kxp
- '<SYSTEM32>\taskkill.exe' /f /im kavsvc.exe
- '<SYSTEM32>\taskkill.exe' /f /im Ravmon.exe
- '<SYSTEM32>\taskkill.exe' /f /im Rav.exe
- '<SYSTEM32>\net.exe' share houmen2$=d:\
- '<SYSTEM32>\net.exe' user Forbidden /active:yes
- '<SYSTEM32>\net.exe' user ЎѕУгУҐѕь¶УЎї 969675 /add
- '<SYSTEM32>\net1.exe' user ЎѕУгУҐѕь¶УЎї 969675 /add
- '<SYSTEM32>\net1.exe' start telnet
- '<SYSTEM32>\net.exe' start telnet
- '<SYSTEM32>\net1.exe' share houmen$=c:\
- '<SYSTEM32>\net1.exe' share houmen2$=d:\
- '<SYSTEM32>\net.exe' start Server
Terminates or attempts to terminate
the following user processes:
- 360tray.exe
Network activity:
Connects to:
- '<L####NET_GATEWAY>':53
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
