Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'l3desktop' = '<Full path to virus> /update'
- <SYSTEM32>\cmd.exe /c ""<Current directory>\selfdel.bat" "
- <Full path to virus>_
- <Current directory>\selfdel.bat
- <Current directory>\ad.png_
- <Current directory>\L3ver.ini
- <Current directory>\deskcfg.ini_
- from <Current directory>\ad.png_ to <Current directory>\ad.png
- from <Current directory>\deskcfg.ini_ to <Current directory>\deskcfg.ini
- from <Full path to virus> to <Full path to virus>b
- 'pc###e.co.kr':80
- pc###e.co.kr/down/desktop/L3/ad.png
- pc###e.co.kr/down/desktop/L3/updaterun.exe
- pc###e.co.kr/down/desktop/L3/L3ver.ini
- pc###e.co.kr/down/desktop/L3/deskcfg.ini
- DNS ASK pc###e.co.kr