Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '{4D4DB474-8435-4FA1-8D91-512C0CE1E931}' = '"%WINDIR%\sysragfchqs2.exe"'
Malicious functions:
Creates and executes the following:
- %WINDIR%\sysragfchqs2.exe
Executes the following:
- %WINDIR%\regedit.exe -s "regAR2.reg"
- <SYSTEM32>\reg.exe IMPORT "regAR2.reg"
- <SYSTEM32>\cmd.exe /c <Current directory>\ad.cmd
- <SYSTEM32>\cmd.exe /c regAX2.bat
Modifies file system :
Creates the following files:
- <Current directory>\regAX2.bat
- %WINDIR%\mywallpaper.bmp
- %WINDIR%\sysragfchqs2.exe.dat
- <Current directory>\regAR2.reg
- %WINDIR%\sysragfchqs2.exe
- %WINDIR%\config.ini
- <Current directory>\ad.cmd
Deletes the following files:
- <Current directory>\regAR2.reg
- <Current directory>\ad.cmd
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'progman' WindowName: 'program manager'
- ClassName: 'Shell_TrayWnd' WindowName: ''
