Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'zlibb' = '"%APPDATA%\Microsoft\sidebar.exe"'
- %HOMEPATH%\Start Menu\Programs\Startup\<Virus name>.exe
- '%APPDATA%\<Virus name>.exe'
- '<SYSTEM32>\wscript.exe' "%TEMP%\temp_MF.vbs"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe' "%APPDATA%\<Virus name>.il"
- %TEMP%\temp_MF.vbs
- %APPDATA%\Microsoft\IMG_3882.png
- %APPDATA%\Microsoft\<Virus name>.exe
- %APPDATA%\<Virus name>.il
- %APPDATA%\<Virus name>.pdb
- %APPDATA%\<Virus name>.exe
- %TEMP%\temp_MF.vbs
- %APPDATA%\<Virus name>.il
- %APPDATA%\<Virus name>.pdb
- 'sm##.gmail.com':587
- DNS ASK sm##.gmail.com
- ClassName: 'Indicator' WindowName: '(null)'