Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Fant' = 'C:\Log\shfhc.vbs'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\Microsoft.lnk
Modifies file system:
Creates the following files:
- C:\Log\gin.reg
- C:\Log\cchq.bat
- C:\Log\update.exe
- C:\Log\build.exe
- C:\Log\bitcoin.bat
- C:\Log\run.vbs
- C:\Log\rar.exe
- C:\Log\ccwbw.bat
- C:\Log\shfhc.vbs
- C:\Log\db.rar
Deletes the following files:
- C:\Log\db.rar
- C:\Log\rar.exe
- C:\Log\run.vbs
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "C:\Log\shfhc.vbs"
- 'C:\Log\rar.exe' e -p7973 db.rar
- '<SYSTEM32>\wscript.exe' "C:\Log\run.vbs"
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""C:\Log\bitcoin.bat" "
- '<SYSTEM32>\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Fant" /t REG_SZ /d "C:\Log\shfhc.vbs" /f
- '<SYSTEM32>\powercfg.exe' -change -standby-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c ""C:\Log\ccwbw.bat" "
- '<SYSTEM32>\cmd.exe' /c ""C:\Log\cchq.bat" "
