Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe <Drive name for removable media>:\RECYGLER.{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}'
- [<HKLM>\SOFTWARE\Classes\htmfile\shell\open\command] '' = '"%PROGRAM_FILES%\Internet Explorer\iexplore.exe" "%1"'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Executes the following:
- %WINDIR%\regedit.exe /S <SYSTEM32>\msscp.reg
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000000'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Start Menu\Programs\МФ±¦ИИВфТ»ХЫЖр.htm
- %HOMEPATH%\Start Menu\Internet Explorer.html
- %HOMEPATH%\Start Menu\Programs\Internet Explorer.html
- %HOMEPATH%\Favorites\МФ±¦ИИВфТ»ХЫЖр.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.html
- %CommonProgramFiles%\System\taobao.ico
- <SYSTEM32>\msscp.reg
- %HOMEPATH%\Desktop\МФ±¦ИИВфТ»ХЫЖр.htm
- %HOMEPATH%\Start Menu\МФ±¦ИИВфТ»ХЫЖр.htm
- %HOMEPATH%\Desktop\Internet Explorer.html
Deletes the following files:
- <SYSTEM32>\msscp.reg
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
