Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\a456ce93742ee6037469f8fb99\update\update.exe'
- '<Full path to virus>'
- '<SYSTEM32>\system.exe'
Modifies file system :
Creates the following files:
- C:\a456ce93742ee6037469f8fb99\update\spcustom.dll
- C:\a456ce93742ee6037469f8fb99\update\update.exe
- C:\a456ce93742ee6037469f8fb99\usbuhci.sys
- C:\a456ce93742ee6037469f8fb99\update\kb822603.cat
- C:\a456ce93742ee6037469f8fb99\update\update.inf
- C:\a456ce93742ee6037469f8fb99\$shtdwn$.req
- %WINDIR%\KB822603.log
- C:\a456ce93742ee6037469f8fb99\update\eula.txt
- C:\a456ce93742ee6037469f8fb99\update\update.ver
- C:\a456ce93742ee6037469f8fb99\usbport.sys
- C:\a456ce93742ee6037469f8fb99\hccoin.dll
- C:\a456ce93742ee6037469f8fb99\spmsg.dll
- <SYSTEM32>\system.exe
- <Full path to virus>
- C:\a456ce93742ee6037469f8fb99\spuninst.exe
- C:\a456ce93742ee6037469f8fb99\usbhub.sys
- C:\a456ce93742ee6037469f8fb99\usbohci.sys
- C:\a456ce93742ee6037469f8fb99\usbccgp.sys
- C:\a456ce93742ee6037469f8fb99\usbehci.sys
Moves itself:
- from <Full path to virus> to <Full path to virus>t
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
