Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\explorer.lnk
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "C:\System\Go.vbs"
- '<SYSTEM32>\wscript.exe' "C:\System\Hide.vbs"
- '%TEMP%\RarSFX0\File.exe' -pfgdgdfgfdgdfgdfgdfgd7843
Executes the following:
- '<SYSTEM32>\cmd.exe' /c tasklist /NH /FI "IMAGENAME eq Taskmgr.exe"
- '<SYSTEM32>\tasklist.exe' /NH /FI "IMAGENAME eq Taskmgr.exe"
- '<SYSTEM32>\cmd.exe' /c ""C:\System\Go.bat" "
- '<SYSTEM32>\cmd.exe' /c ""C:\System\Hide.bat" "
- '<SYSTEM32>\attrib.exe' C:\System +H /S /D
Modifies file system:
Creates the following files:
- C:\System\1.vbs
- C:\System\1.bat
- C:\System\Go.vbs
- C:\System\Go.bat
- C:\System\srvan.exe
- C:\System\Hide.bat
- %TEMP%\RarSFX0\File.exe
- C:\System\msvcr120.dll
- C:\System\Hide.vbs
Sets the 'hidden' attribute to the following files:
- C:\System\1.vbs
- C:\System\Go.vbs
- C:\System\Hide.bat
- C:\System\Hide.vbs
Deletes the following files:
- %TEMP%\RarSFX0\File.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
