Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'klomst' = 'c:\reas.com'
Malicious functions
Searches for windows to
detect programs and games:
- ClassName: 'TibiaClient', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\tibiawikiquests.scr
- C:\reas.com
- %TEMP%\$mad$res$00000774$30250c$
Sets the 'hidden' attribute to the following files
- C:\reas.com
Deletes the following files
- %TEMP%\$mad$res$00000774$30250c$
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%TEMP%\tibiawikiquests.scr' /S
- 'C:\reas.com'
- 'C:\reas.com' ' (with hidden window)
