Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run\] 'svchost.exe' = '%HOMEPATH%\svchost.exe'
Malicious functions
Searches for windows to
detect programs and games:
- ClassName: 'TibiaClient', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\setup.exe
- %TEMP%\svchost.exe
- %HOMEPATH%\svchost.exe
- %TEMP%\is-5sf2g.tmp\setup.tmp
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\svchost.exe'
- '%TEMP%\setup.exe'
- '%TEMP%\is-5sf2g.tmp\setup.tmp' /SL5="$6024A,3619427,54272,%TEMP%\setup.exe"
