Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ample' = '"%APPDATA%\Microsoft\ample.exe"'
- %HOMEPATH%\Start Menu\Programs\Startup\<Virus name>.exe
- '%APPDATA%\<Virus name>.exe'
- '<SYSTEM32>\wscript.exe' "%TEMP%\temp_MF.vbs"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe' "%APPDATA%\<Virus name>.il"
- %TEMP%\temp_MF.vbs
- %APPDATA%\Microsoft\<Virus name>.exe
- %APPDATA%\Microsoft\IMG_1337.png
- %APPDATA%\<Virus name>.exe
- %TEMP%\e3822689-af0e-4e88-ad9f-084b7e177e3b\CliSecureRT.dll
- %APPDATA%\<Virus name>.il
- %APPDATA%\<Virus name>.pdb
- %TEMP%\temp_MF.vbs
- %APPDATA%\<Virus name>.pdb
- %APPDATA%\<Virus name>.il
- 'sm##.#avabit.com':587
- DNS ASK sm##.#avabit.com
- ClassName: 'Indicator' WindowName: ''