Technical Information
To ensure autorun and distribution:
Infects the following executable system files:
- <SYSTEM32>\appmgmts.dll
Malicious functions:
Executes the following:
- <SYSTEM32>\reg.exe import %TEMP%\r1ed66bf1.txt
- <SYSTEM32>\reg.exe export "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layouts" %TEMP%\r1ed66bf1.txt
Restores hooked functions in System Service Descriptor Table (SSDT).
Modifies file system :
Creates the following files:
- <SYSTEM32>\476005E8.tmp
- %TEMP%\r1ed66bf1.txt
- C:\Documents and Settings\Infotmp.txt
- %TEMP%\47602D1A.log
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'CicLoaderWndClass' WindowName: ''
