Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer1404991980.exe' = '%APPDATA%\Opera Software\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer1411675623.exe' = '%ProgramFiles%\fshelp\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer2016200094.exe' = '%APPDATA%\ICQ-Profile\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer1661715606.exe' = '%ProgramFiles%\pqpe9x\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer162323870.exe' = '%APPDATA%\ICQM\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer1422100370.exe' = '%ProgramFiles%\nod\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer32115368.exe' = '%APPDATA%\Identities\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer1615525258.exe' = '%ProgramFiles%\aswUpdSv\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer157056523.exe' = '%APPDATA%\Adobe\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer1853824264.exe' = '%ProgramFiles%\RunSetup\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer427389160.exe' = '%APPDATA%\Macromedia\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer1452385386.exe' = '%ProgramFiles%\avgemc\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer46851523.exe' = '%APPDATA%\Mra\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer137315469.exe' = '%ProgramFiles%\Drwebupw\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer1999265017.exe' = '%APPDATA%\ICQM\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer2134256697.exe' = '%ProgramFiles%\RAT\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer382864944.exe' = '%APPDATA%\Adobe\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer81711083.exe' = '%ProgramFiles%\fsfwwsch\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer1134133488.exe' = '%APPDATA%\GHISLER\iexplorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplorer1513147672.exe' = '%ProgramFiles%\Windows Sidebar\iexplorer.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\iexplorer.exe
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %APPDATA%\opera software\iexplorer.exe
- %APPDATA%\adobe\iexplorer.exe
- %APPDATA%\icqm\iexplorer.exe
- %APPDATA%\mra\iexplorer.exe
- %APPDATA%\macromedia\iexplorer.exe
- %APPDATA%\identities\iexplorer.exe
- %APPDATA%\icq-profile\iexplorer.exe
- %APPDATA%\ghisler\iexplorer.exe
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
Executes the following
- '%WINDIR%\explorer.exe'
