Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' stop �Security Center�
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=disable
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- <Current directory>\temp.bat
- <Current directory>\windowswimn32.bat
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""<Current directory>\temp.bat""
- '<SYSTEM32>\tskill.exe' /A tmn*
- '<SYSTEM32>\tskill.exe' /A tmp*
- '<SYSTEM32>\tskill.exe' /A issvc
- '<SYSTEM32>\tskill.exe' /A nisum*
- '<SYSTEM32>\tskill.exe' /A loge*
- '<SYSTEM32>\tskill.exe' /A npfmn*
- '<SYSTEM32>\tskill.exe' /A ccc*
- '<SYSTEM32>\tskill.exe' /A norton au*
- '<SYSTEM32>\tskill.exe' /A Bitdefender
- '<SYSTEM32>\tskill.exe' /A Bkav
- '<SYSTEM32>\tskill.exe' /A BkavPro*
- '<SYSTEM32>\tskill.exe' /A BkavHome*
- '<SYSTEM32>\tskill.exe' /A norton*
- '<SYSTEM32>\tskill.exe' /A cc*
- '<SYSTEM32>\tskill.exe' /A minilog
- '<SYSTEM32>\tskill.exe' /A pcc*
- '<SYSTEM32>\tskill.exe' /A pop*
- '<SYSTEM32>\reg.exe' add hkey_current_usersoftwaremicrosoftwindowscurrentve rsionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
- '<SYSTEM32>\tskill.exe' /A pav*
- '<SYSTEM32>\reg.exe' add hkey_local_machinesoftwaremicrosoftwindowscurrentv ersionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
- '<SYSTEM32>\tskill.exe' /A offg*
- '<SYSTEM32>\tskill.exe' /A norm*
- '<SYSTEM32>\tskill.exe' /A avas*
- '<SYSTEM32>\tskill.exe' /A safe*
- '<SYSTEM32>\tskill.exe' /A ad-*
- '<SYSTEM32>\tskill.exe' /A scan*
- '<SYSTEM32>\tskill.exe' /A sweep*
- '<SYSTEM32>\tskill.exe' /A realm*cls
- '<SYSTEM32>\tskill.exe' /A virus*
- '<SYSTEM32>\tskill.exe' /A syman*
- '<SYSTEM32>\tskill.exe' /A sche*
- '<SYSTEM32>\tskill.exe' /A avsch*
- '<SYSTEM32>\tskill.exe' /A panda*
- '<SYSTEM32>\tskill.exe' /A padmincls
- '<SYSTEM32>\tskill.exe' /A zlclien*
- '<SYSTEM32>\tskill.exe' /A cpd*
- '<SYSTEM32>\tskill.exe' /A upd*
- '<SYSTEM32>\tskill.exe' /A F-*
- '<SYSTEM32>\tskill.exe' /A nv*
- '<SYSTEM32>\tskill.exe' /A OUTPOST
- '<SYSTEM32>\tskill.exe' /A SAFEWEB
- '<SYSTEM32>\tskill.exe' /A ZONEALARM
- '<SYSTEM32>\tskill.exe' /A KAV*
- '<SYSTEM32>\tskill.exe' /A PersFw
- '<SYSTEM32>\tskill.exe' /A bullguard
- '<SYSTEM32>\tskill.exe' /A spy*
- '<SYSTEM32>\tskill.exe' /A anti*
- '<SYSTEM32>\tskill.exe' /A fire*
- '<SYSTEM32>\tskill.exe' /A av*
- '<SYSTEM32>\net1.exe' stop �Security Center�
- '<SYSTEM32>\attrib.exe' +S /F /Q *
- '<SYSTEM32>\ipconfig.exe' /release6
- '<SYSTEM32>\ipconfig.exe' /release
- '<SYSTEM32>\tskill.exe' /A nav*
- '<SYSTEM32>\tskill.exe' /A ESAFE
- '<SYSTEM32>\tskill.exe' /A zap*cls
- '<SYSTEM32>\tskill.exe' /A cle
- '<SYSTEM32>\tskill.exe' /A isafe
- '<SYSTEM32>\tskill.exe' /A msiexec
- '<SYSTEM32>\tskill.exe' /A mghtml
- '<SYSTEM32>\tskill.exe' /A mcafe*
- '<SYSTEM32>\tskill.exe' /A msmp*
- '<SYSTEM32>\tskill.exe' /A gcasDt*
- '<SYSTEM32>\tskill.exe' /A guar*
- '<SYSTEM32>\tskill.exe' /A guard*
- '<SYSTEM32>\tskill.exe' /A ewid*
- '<SYSTEM32>\tskill.exe' /A aswupdsv
- '<SYSTEM32>\tskill.exe' /A ash*
- '<SYSTEM32>\tskill.exe' /A avg*
- '<SYSTEM32>\tskill.exe' /A kav
- '<SYSTEM32>\tskill.exe' /A def*
- '<SYSTEM32>\tskill.exe' /A BLACKICE
- '<SYSTEM32>\tskill.exe' /A zauinst
- '<SYSTEM32>\rundll32.exe' mouse, disable
