Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'atlas2.0' = '%ALLUSERSPROFILE%\AtlasFiles2.0\rekeywiz.exe'
Malicious functions
Creates and executes the following (exploit)
- '%ALLUSERSPROFILE%\atlasfiles2.0\rekeywiz.exe'
Modifies file system
Creates the following files
- %TEMP%\1.a
- %ALLUSERSPROFILE%\atlasfiles2.0\rekeywiz.exe
- %ALLUSERSPROFILE%\atlasfiles2.0\duser.dll
- %ALLUSERSPROFILE%\atlasfiles2.0\mobhqo8.tmp
- %ALLUSERSPROFILE%\atlasfiles2.0\rekeywiz.exe.config
Deletes the following files
- %TEMP%\1.a
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
