Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'AVPMY' = '<SYSTEM32>\AVPMY.exe'
Malicious functions
Searches for windows to
bypass different anti-viruses:
- ClassName: 'AVP.AlertDialog', WindowName: ''
- ClassName: 'AVP.Product_Notification', WindowName: ''
- ClassName: 'AVP.TrafficMonConnectionTerm', WindowName: ''
Modifies file system
Creates the following files
- %WINDIR%\syswow64\avpmy.exe
Deletes the following files
- %WINDIR%\syswow64\avpmy.exe
Deletes itself.
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: 'ÈðÐÇ×¢²á±ГВјГ ВїГГЊГЎГЉВѕ'
- ClassName: '#32770' WindowName: 'IE Ö´Ðб£»¤'
- ClassName: '#32770' WindowName: 'ÈðÐÇ¿¨¿¨ÉÏÍø°²È«ÖúÊÖ - IE·À©ǽ'
Creates and executes the following
- '%WINDIR%\syswow64\avpmy.exe'
- '%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del "%WINDIR%\SysWOW64\AVPMY.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c del "%WINDIR%\SysWOW64\AVPMY.exe"
