Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Injects code into
the following user processes:
- notepad.exe
Modifies file system:
Creates the following files:
- %TEMP%\notepad.exe
- %TEMP%\FQijE
Deletes the following files:
- <Full path to file>
Miscellaneous:
Searches for the following windows:
- ClassName: 'Beasty' WindowName: ''
Creates and executes the following:
- '%TEMP%\notepad.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 3 & Del <Full path to file>
