Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Edy] 'ImagePath' = '%TEMP%\Edy.sys'
Creates the following services
- 'Edy' %TEMP%\Edy.sys
Modifies file system
Creates the following files
- %TEMP%\edy.sys
Sets the 'hidden' attribute to the following files
- %TEMP%\edy.sys
Moves the following files
- from %TEMP%\edy.sys to %TEMP%\ltq570417\....\temporaryfile
Moves itself
- from <Full path to file> to %TEMP%\fdfs\....\nrgst
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p Everyone:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs /e /t /p Administrator:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p user:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs /e /t /p ËùÓÐÊÜÏÞÖƵÄÓ¦ÓóÌÐò°ü:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p ËùÓÐÊÜÏÞÖƵÄÓ¦ÓóÌÐò°ü:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs /e /t /p Users:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p Users:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p Administrators:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p Administrator:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs /e /t /p system:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p system:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs /e /t /p Everyone:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p Everyone:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p authenticated users:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs /e /t /p user:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p Administrators:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs /e /t /p Administrators:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs\DVONX\NRGst /e /t /p user:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p authenticated users:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p ËùÓÐÊÜÏÞÖƵÄÓ¦ÓóÌÐò°ü:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs\DVONX\NRGst /e /t /p ËùÓÐÊÜÏÞÖƵÄÓ¦ÓóÌÐò°ü:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs\DVONX\NRGst /e /t /p Users:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs /e /t /p authenticated users:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs\DVONX\NRGst /e /t /p Administrator:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p user:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p Users:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs\DVONX\NRGst /e /t /p system:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p system:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs\DVONX\NRGst /e /t /p Everyone:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p Administrator:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs\DVONX\NRGst /e /t /p authenticated users:N
- '%WINDIR%\syswow64\cacls.exe' %TEMP%\fDfs\DVONX\NRGst /e /t /p Administrators:N
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p system:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p ËùÓÐÊÜÏÞÖƵÄÓ¦ÓóÌÐò°ü:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p Everyone:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p user:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p ËùÓÐÊÜÏÞÖƵÄÓ¦ÓóÌÐò°ü:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p system:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p Users:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p Administrators:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p Administrators:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p Administrator:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p Everyone:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p Administrator:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p Users:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p authenticated users:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs /e /t /p authenticated users:N' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe %TEMP%\fDfs\DVONX\NRGst /e /t /p user:N' (with hidden window)
