Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'False' = 'InjectorBySolex.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM explorer.exe
- '<SYSTEM32>\taskkill.exe' /F /IM smss.exe
- '<SYSTEM32>\taskkill.exe' /F /IM uninstall.exe
- '<SYSTEM32>\taskkill.exe' /F /IM uninst.exe
- '<SYSTEM32>\taskkill.exe' /F /IM winlogon.exe
- '<SYSTEM32>\taskkill.exe' /F /IM userinit.exe
- '<SYSTEM32>\taskkill.exe' /F /IM rundll32.exe
- '<SYSTEM32>\taskkill.exe' /F /IM rshx32.dll
- '<SYSTEM32>\taskkill.exe' /F /IM rthdcpl.exe
- '<SYSTEM32>\taskkill.exe' /F /IM issch.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ctfmon.exe
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe
- '<SYSTEM32>\taskkill.exe' /F /IM Safari.exe
- '<SYSTEM32>\taskkill.exe' /F /IM opera.exe
- '<SYSTEM32>\taskkill.exe' /F /IM firefox.exe
- '<SYSTEM32>\taskkill.exe' /F /IM lsm.exe
- '<SYSTEM32>\taskkill.exe' /f /im taskmgr.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\ctfmon.exe
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\pse11\8cc8980944a6043d5e22e0d75c9b6a6b\php.ini
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\grids.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\htmlview.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\imagelist.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\keyboard.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\localization.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\mci.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\menus.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\objects.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\web.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\osapi.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\registry.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\skins.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\standart.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\threads.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\timing.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\utils.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\graphics.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\messages.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\forms.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\files\file.php
- %TEMP%\pse11\php\php5ts.dll
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\config.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\debug\errors.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\design\buttonspanel.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\design\componentpanel.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\design\propcomponents.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\design\sizecontrol.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\files\ini.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\dfmreader.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\files\ini_ex.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\include.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\inits.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\additional.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\buttons.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\classes.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\constant.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b\main\dialogs.php
- %TEMP%\devels\8cc8980944a6043d5e22e0d75c9b6a6b.tmp
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM explorer.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM smss.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM uninstall.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM uninst.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM winlogon.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM userinit.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM rundll32.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM rshx32.dll
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM rthdcpl.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM issch.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM ctfmon.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM chrome.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM Safari.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM opera.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM firefox.exe
- '<SYSTEM32>\cmd.exe' /c TASKKILL /F /IM lsm.exe
- '<SYSTEM32>\cmd.exe' /c Taskkill /f /im taskmgr.exe
