Technical Information
Malicious functions
Injects code into
the following user processes:
- setup.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'FileMonClass', WindowName: ''
- ClassName: 'RegMonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\vsp143\asycfilt.dll
- %TEMP%\vsp143\lang\pol_faq_pliki\image002.gif
- %TEMP%\vsp143\lang\pol_faq_pliki\image001.gif
- %TEMP%\vsp143\lang\pol_faq_pliki\filelist.xml
- %TEMP%\vsp143\lang\ita_faq_pliki\image002.gif
- %TEMP%\vsp143\lang\ita_faq_pliki\image001.gif
- %TEMP%\vsp143\lang\ita_faq_pliki\header.htm
- %TEMP%\vsp143\lang\ita_faq_pliki\filelist.xml
- %TEMP%\vsp143\lang\fra_faq_pliki\image002.gif
- %TEMP%\vsp143\lang\fra_faq_pliki\image001.gif
- %TEMP%\vsp143\lang\fra_faq_pliki\header.htm
- %TEMP%\vsp143\lang\esp_faq_pliki\image002.gif
- %TEMP%\vsp143\lang\rus_faq_pliki\image001.gif
- %TEMP%\vsp143\lang\esp_faq_pliki\image001.gif
- %TEMP%\vsp143\lang\esp_faq_pliki\filelist.xml
- %TEMP%\vsp143\lang\eng_faq_pliki\image002.gif
- %TEMP%\vsp143\lang\eng_faq_pliki\image001.gif
- %TEMP%\vsp143\lang\eng_faq_pliki\filelist.xml
- %TEMP%\vsp143\lang\deu_faq_pliki\image002.gif
- %TEMP%\vsp143\lang\deu_faq_pliki\image001.gif
- %TEMP%\vsp143\lang\deu_faq_pliki\filelist.xml
- %TEMP%\vsp143\lang\cze_faq_pliki\image002.gif
- %TEMP%\vsp143\lang\fra_faq_pliki\filelist.xml
- %TEMP%\vsp143\lang\ita_butt.bmp
- %TEMP%\vsp143\lang\rus_faq_pliki\image002.gif
- %TEMP%\vsp143\skin\default\standard.ini
- %TEMP%\vsp143\run\vb6stkit.dll
- %TEMP%\vsp143\run\update.exe
- %TEMP%\vsp143\run\uninstall.exe
- %TEMP%\vsp143\run\stdole2.tlb
- %TEMP%\vsp143\run\shelllnk.tlb
- %TEMP%\vsp143\run\olepro32.dll
- %TEMP%\vsp143\run\oleaut32.dll
- %TEMP%\vsp143\run\msvbvm60.dll
- %TEMP%\vsp143\run\msderun.dll
- %TEMP%\vsp143\lang\cze_faq_pliki\image001.gif
- %TEMP%\vsp143\lang\rus_faq_pliki\filelist.xml
- %TEMP%\vsp143\run\asycfilt.dll
- %TEMP%\vsp143\misc\window.bmp
- %TEMP%\vsp143\misc\tlomain.bmp
- %TEMP%\vsp143\misc\talia32.bmp
- %TEMP%\vsp143\misc\shuffl.wav
- %TEMP%\vsp143\misc\memo.res
- %TEMP%\vsp143\misc\draw.wav
- %TEMP%\vsp143\misc\dollars.wav
- %TEMP%\vsp143\misc\credits.bmp
- %TEMP%\vsp143\misc\click.wav
- %TEMP%\vsp143\run\comcat.dll
- %TEMP%\vsp143\misc\card.wav
- %TEMP%\vsp143\lang\cze_faq_pliki\filelist.xml
- %TEMP%\vsp143\lang\rus_umowa.txt
- %TEMP%\vsp143\lang\rus_help.txt
- %TEMP%\vsp143\lang\cze.lng
- %TEMP%\vsp143\lang\eng.lng
- %TEMP%\vsp143\lang\deu_umowa.txt
- %TEMP%\vsp143\lang\deu_help.txt
- %TEMP%\vsp143\lang\deu_faq.htm
- %TEMP%\vsp143\lang\deu_butt.bmp
- %TEMP%\vsp143\lang\deu.lng
- %TEMP%\vsp143\lang\cze_umowa.txt
- %TEMP%\vsp143\lang\cze_help.txt
- %TEMP%\vsp143\lang\cze_faq.htm
- %TEMP%\vsp143\skin\default\tloblit.bmp
- %TEMP%\vsp143\lang\eng_faq.htm
- %TEMP%\vsp143\vb6stkit.dll
- %TEMP%\vsp143\stdole2.tlb
- %TEMP%\vsp143\shelllnk.tlb
- %TEMP%\vsp143\setup.exe
- %TEMP%\vsp143\olepro32.dll
- %TEMP%\vsp143\oleaut32.dll
- %TEMP%\vsp143\msvbvm60.dll
- %TEMP%\vsp143\msderun.dll
- %TEMP%\vsp143\comcat.dll
- %TEMP%\vsp143\autorun.inf
- %TEMP%\vsp143\lang\cze_butt.bmp
- %TEMP%\vsp143\run\main.exe
- %TEMP%\vsp143\lang\eng_help.txt
- %TEMP%\vsp143\lang\esp_butt.bmp
- %TEMP%\vsp143\lang\eng_umowa.txt
- %TEMP%\vsp143\lang\rus_faq.htm
- %TEMP%\vsp143\lang\rus_butt.bmp
- %TEMP%\vsp143\lang\rus.lng
- %TEMP%\vsp143\lang\pol_umowa.txt
- %TEMP%\vsp143\lang\pol_help.txt
- %TEMP%\vsp143\lang\pol_faq.htm
- %TEMP%\vsp143\lang\pol_butt.bmp
- %TEMP%\vsp143\lang\pol.lng
- %TEMP%\vsp143\lang\ita_umowa.txt
- %TEMP%\vsp143\lang\esp.lng
- %TEMP%\vsp143\lang\ita_help.txt
- %TEMP%\vsp143\lang\eng_butt.bmp
- %TEMP%\vsp143\lang\ita.lng
- %TEMP%\vsp143\lang\fra_umowa.txt
- %TEMP%\vsp143\lang\fra_help.txt
- %TEMP%\vsp143\lang\fra_faq.htm
- %TEMP%\vsp143\lang\fra_butt.bmp
- %TEMP%\vsp143\lang\fra.lng
- %TEMP%\vsp143\lang\esp_umowa.txt
- %TEMP%\vsp143\lang\esp_help.txt
- %TEMP%\vsp143\lang\esp_faq.htm
- %TEMP%\vsp143\lang\ita_faq.htm
- %TEMP%\vsp143\skin\default\tlosel.bmp
Miscellaneous
Creates and executes the following
- '%TEMP%\vsp143\setup.exe'
