Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'iexplorer' = '<SYSTEM32>\iexplorerr32.exe'
- [HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'explorer64bt' = '<SYSTEM32>\svchostrun32.exe'
- [HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'hotsendd' = '<SYSTEM32>\wordpadd2.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
