Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\vista.ini.lnk
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'TIdaWindow', WindowName: ''
- ClassName: 'FileMonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %APPDATA%\keygen.exe
- %APPDATA%\for.js
- %TEMP%\test.dat
- %TEMP%\ckawixzjlyiosahgfuec.dll
- %TEMP%\tqzqppuxjwdoikitsklp.dll
- %TEMP%\vxcjxsuwpa.dll
- %HOMEPATH%\appdata\vista.js
Deletes the following files
- %TEMP%\test.dat
Substitutes the following files
- %TEMP%\test.dat
Miscellaneous
Searches for the following windows
- ClassName: 'ID' WindowName: ''
- ClassName: '' WindowName: 'CHimpREC - ReCon Edition - (C) 2008 TiGa'
- ClassName: '' WindowName: ' Import REConstructor V1.6 Final MackT/uCF -- >> UnREal-RCE << --'
- ClassName: '' WindowName: 'Import REConstructor v1.6.1 FIXED FINAL (C) 2001-2003 MackT/uCF / 2006'
- ClassName: '' WindowName: 'Import REConstructor v1.6 FINAL (C) 2001-2003 MackT/uCF'
- ClassName: '' WindowName: 'RL!dePacker - Generic Unpacker'
- ClassName: '' WindowName: '[PeCompact 2.x Unpacker]'
- ClassName: '' WindowName: 'CDW\s PECompact 2.64/2.78a/2.79 (beta) Unpacker'
- ClassName: '' WindowName: 'QuickUnpack 2.2'
- ClassName: '' WindowName: 'PhantOm - [Professional Edition]'
- ClassName: '' WindowName: 'POISONÿBëÕ - [Professional Edition]'
- ClassName: '' WindowName: 'Rock Debugger - [Disassembly]'
- ClassName: '18467-41' WindowName: ''
- ClassName: 'IdaView' WindowName: ''
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: 'MYDEBUG' WindowName: ''
- ClassName: '' WindowName: 'RE-Pair 0.6: IDP ixed.'
- ClassName: '' WindowName: 'RE-Pair 0.6: IDP not ixed.'
Creates and executes the following
- '%APPDATA%\keygen.exe'
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\for.js"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit -e IAAgAHMAbABlAGUAcAAgADgAOwAgAFsAQQBwAHAARABvAG0AYQBpAG4AXQA6ADoAQwB1AHIAcgBlAG4AdABEAG8AbQBhAGkAbgAuAEwAbwBhAGQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBiAGEAcwBlADYANABTAHQAcgBpAG...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit -e IAAgAHMAbABlAGUAcAAgADgAOwAgAFsAQQBwAHAARABvAG0AYQBpAG4AXQA6ADoAQwB1AHIAcgBlAG4AdABEAG8AbQBhAGkAbgAuAEwAbwBhAGQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBiAGEAcwBlADYANABTAHQAcgBpAG...
