Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'VirusName' = '%WINDIR%\VirusName.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'VirusName' = '%WINDIR%\VirusName.bat'
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\VirusName.bat
Malicious functions:
Executes the following:
- '<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v VirusName /t REG_SZ /d %WINDIR%\VirusName.bat /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v VirusName /t REG_SZ /d %WINDIR%\VirusName.bat /f
- '<SYSTEM32>\chcp.com' 1252
- '<SYSTEM32>\tskill.exe' def*
- '<SYSTEM32>\tskill.exe' ESAFE
- '<SYSTEM32>\tskill.exe' cle
- '<SYSTEM32>\tskill.exe' BLACKICE
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe
- '<SYSTEM32>\taskkill.exe' /f /im lsass.exe
- '<SYSTEM32>\tskill.exe' /pid=2704
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Kazaa\LocalContent" /v DownloadDir /t REG_SZ /d "%PROGRAM_FILES%\shared_folder" /f
- '<SYSTEM32>\net1.exe' share xxx
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Ole\ /v EnableDCOM /t REG_SZ /d Y /f
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v restrictanonymous /t REG_SZ /d 0 /f
- '<SYSTEM32>\tskill.exe' F-*
- '<SYSTEM32>\tskill.exe' anti*
- '<SYSTEM32>\tskill.exe' spy*
- '<SYSTEM32>\tskill.exe' bullguard
- '<SYSTEM32>\tskill.exe' fire*
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\KiLL-Tech.bat" "
- '<SYSTEM32>\tskill.exe' norton*
- '<SYSTEM32>\tskill.exe' av*
- '<SYSTEM32>\tskill.exe' OUTPOST
- '<SYSTEM32>\tskill.exe' nv*
- '<SYSTEM32>\tskill.exe' nav*
- '<SYSTEM32>\tskill.exe' SAFEWEB
- '<SYSTEM32>\tskill.exe' PersFw
- '<SYSTEM32>\tskill.exe' KAV*
- '<SYSTEM32>\tskill.exe' ZONEALARM
Injects code into
the following user processes:
- AVP32.EXE
- AVGCTRL.EXE
- avgcc.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\lsass.exe
- %WINDIR%\Explorer.EXE
the following user processes:
- firefox.exe
- AVSYNMGR.EXE
- AVPM.EXE
- NAVAPW32.EXE
- outpost.exe
- ZONEALARM.EXE
- AVPCC.EXE
- AVGCTRL.EXE
- AVGCC32.EXE
- avgcc.exe
- AVP32.EXE
- AVP.EXE
- AVP.COM
Modifies file system :
Creates the following files:
- C:\23342.bat
- C:\6031.bat
- C:\20798.bat
- C:\21162.bat
- C:\4767.bat
- C:\25439.bat
- C:\903.bat
- C:\1940.bat
- C:\7605.bat
- C:\29273.bat
- C:\19850.bat
- C:\30846.bat
- C:\31000.bat
- C:\31914.bat
- C:\7207.bat
- C:\13968.bat
- C:\1380.bat
- C:\19127.bat
- <Current directory>\irc.bat
- %TEMP%\1.tmp\KiLL-Tech.bat
- %WINDIR%\VirusName.bat
- %WINDIR%\ftppassword.bat
- C:\2842.bat
- C:\29739.bat
- C:\6317.bat
- C:\12287.bat
- C:\11674.bat
- C:\7004.bat
- C:\8194.bat
- C:\8431.bat
Deletes the following files:
- <Current directory>\irc.bat
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
