Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Control Panel\Desktop\] 'SCRNSAVE.EXE' = '<SYSTEM32>\TELEMA~1.SCR'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'Depkominfo' = '%WINDIR%\WlNLOGON.EXE'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'Serviceuser' = '%HOMEPATH%\Local Settings\Application Data\WINDOWS\SERVICES.EXE'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'Logonuser' = '%HOMEPATH%\Local Settings\Application Data\WINDOWS\CSRSS.EXE'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'System Monitoring' = '%HOMEPATH%\Local Settings\Application Data\WINDOWS\SMSS.EXE'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe "<SYSTEM32>\Shell.exe"'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\Shell.exe'
- [<HKLM>\Software\Classes\exefile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\Software\Classes\lnkfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\Software\Classes\piffile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\Software\Classes\batfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\Software\Classes\comfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
Creates or modifies the following files
- %ALLUSERSPROFILE%\start menu\programs\startup\adobe gamma loader.pif
Creates the following files on removable media
- <Drive name for removable media>:\explorer\folder.htt
- <Drive name for removable media>:\explorer\index.htm
- <Drive name for removable media>:\desktop.ini
- <Drive name for removable media>:\depkominfo_didefaced.htm
- <Drive name for removable media>:\explorer\launch_u3.exe
- <Drive name for removable media>:\explorer\msvbvm60.dll
- <Drive name for removable media>:\launchu3user.exe
- <Drive name for removable media>:\explorer\roy.bmp
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
blocks the following features:
- System Restore (SR)
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %WINDIR%\msvbvm60.dll
- D:\explorer\msvbvm60.dll
- D:\explorer\launch_u3.exe
- D:\depkominfo_didefaced.htm
- D:\desktop.ini
- D:\explorer\index.htm
- D:\explorer\folder.htt
- C:\explorer\roy.bmp
- C:\launchu3user.exe
- C:\explorer\msvbvm60.dll
- C:\explorer\launch_u3.exe
- C:\depkominfo_didefaced.htm
- C:\desktop.ini
- C:\explorer\index.htm
- D:\launchu3user.exe
- C:\explorer\folder.htt
- %WINDIR%\120.0.0.1.htm
- %HOMEPATH%\local settings\application data\windows\smss.exe
- %HOMEPATH%\local settings\application data\windows\services.exe
- %HOMEPATH%\local settings\application data\windows\csrss.exe
- %WINDIR%\syswow64\telematika.scr
- %WINDIR%\syswow64\shell.exe
- C:\wlnlogon.exe
- %WINDIR%\wlnlogon.exe
- %HOMEPATH%\local settings\application data\services.exe
- %HOMEPATH%\local settings\application data\csrss.exe
- %HOMEPATH%\local settings\application data\smss.exe
- %WINDIR%\syswow64\oeminfo.ini
- %WINDIR%\syswow64\oemlogo.bmp
- %WINDIR%\desktop.ini
- D:\explorer\roy.bmp
Sets the 'hidden' attribute to the following files
- %WINDIR%\msvbvm60.dll
- <Drive name for removable media>:\launchu3user.exe
- <Drive name for removable media>:\depkominfo_didefaced.htm
- <Drive name for removable media>:\desktop.ini
- <Drive name for removable media>:\explorer\index.htm
- <Drive name for removable media>:\explorer\folder.htt
- D:\explorer\roy.bmp
- D:\launchu3user.exe
- D:\depkominfo_didefaced.htm
- D:\desktop.ini
- D:\explorer\index.htm
- D:\explorer\folder.htt
- C:\explorer\roy.bmp
- C:\launchu3user.exe
- C:\depkominfo_didefaced.htm
- C:\desktop.ini
- C:\explorer\index.htm
- C:\explorer\folder.htt
- %WINDIR%\desktop.ini
- %ALLUSERSPROFILE%\start menu\programs\startup\adobe gamma loader.pif
- %WINDIR%\wlnlogon.exe
- %HOMEPATH%\local settings\application data\windows\services.exe
- %HOMEPATH%\local settings\application data\windows\csrss.exe
- %HOMEPATH%\local settings\application data\windows\smss.exe
- <Drive name for removable media>:\explorer\roy.bmp
- C:\wlnlogon.exe
Deletes the following files
- %HOMEPATH%\local settings\application data\csrss.exe
- %HOMEPATH%\local settings\application data\smss.exe
Substitutes the following files
- %HOMEPATH%\local settings\application data\csrss.exe
- %HOMEPATH%\local settings\application data\smss.exe
Modifies the HOSTS file.
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: 'Registry Editor'
- ClassName: '' WindowName: 'Program Files'
- ClassName: '' WindowName: 'Local Settings'
- ClassName: '' WindowName: 'WINDOWS'
- ClassName: 'ExploreWClass' WindowName: ''
- ClassName: 'CabinetWClass' WindowName: ''
- ClassName: 'RebarWindow32' WindowName: ''
- ClassName: 'ComboBoxEx32' WindowName: ''
- ClassName: 'ComboBox' WindowName: ''
- ClassName: 'Edit' WindowName: ''
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%WINDIR%\wlnlogon.exe'
- '%WINDIR%\syswow64\shell.exe'
- '%HOMEPATH%\local settings\application data\windows\csrss.exe'
- '%HOMEPATH%\local settings\application data\windows\services.exe'
- '%HOMEPATH%\local settings\application data\windows\smss.exe'
- '%WINDIR%\wlnlogon.exe' ' (with hidden window)
- '%WINDIR%\syswow64\shell.exe' ' (with hidden window)
- '%HOMEPATH%\local settings\application data\windows\csrss.exe' ' (with hidden window)
- '%HOMEPATH%\local settings\application data\windows\services.exe' ' (with hidden window)
- '%HOMEPATH%\local settings\application data\windows\smss.exe' ' (with hidden window)
