Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '<Current directory>\taskhost.exe'
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im msconfig.exe
- '<SYSTEM32>\taskkill.exe' /f /im processexplorer64.exe
- '<SYSTEM32>\taskkill.exe' /f /im vitrualbox.exe
- '<SYSTEM32>\taskkill.exe' /f /im wireshark.exe
- '<SYSTEM32>\taskkill.exe' /f /im prochacker.exe
- '<SYSTEM32>\taskkill.exe' /f /im amigo.exe
- '<SYSTEM32>\taskkill.exe' /f /im browser.exe
- '<SYSTEM32>\taskkill.exe' /f /im processhacker.exe
- '<SYSTEM32>\taskkill.exe' /f /im processexplorer.exe
- '<SYSTEM32>\taskkill.exe' /f /im vmware.exe
- '<SYSTEM32>\taskkill.exe' /pid=4564
- '<SYSTEM32>\taskkill.exe' /pid=4472
- '<SYSTEM32>\taskkill.exe' /pid=4848
- '<SYSTEM32>\taskkill.exe' /pid=4800
- '<SYSTEM32>\taskkill.exe' /pid=4444
- '<SYSTEM32>\taskkill.exe' /pid=4156
- '<SYSTEM32>\taskkill.exe' /f /im avp.exe
- '<SYSTEM32>\taskkill.exe' /pid=4396
- '<SYSTEM32>\taskkill.exe' /pid=4544
- '<SYSTEM32>\taskkill.exe' /f /im icq.exe
- '<SYSTEM32>\taskkill.exe' /f /im skype.exe
- '<SYSTEM32>\taskkill.exe' /f /im skypePM.exe
- '<SYSTEM32>\taskkill.exe' /f /im qip.exe
- '<SYSTEM32>\taskkill.exe' /f /im ccleaner32.exe
- '<SYSTEM32>\taskkill.exe' /f /im opera.exe
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhost /t REG_SZ /d "<Current directory>\taskhost.exe
- '<SYSTEM32>\taskkill.exe' /f /im ccleaner64.exe
- '<SYSTEM32>\taskkill.exe' /f /im ccleaner.exe
- '<SYSTEM32>\taskkill.exe' /f /im l4d2.exe
- '<SYSTEM32>\taskkill.exe' /f /im cureit!.exe
- '<SYSTEM32>\taskkill.exe' /f /im taskmanager.exe
- '<SYSTEM32>\taskkill.exe' /f /im dota2 test.exe
- '<SYSTEM32>\taskkill.exe' /f /im dota2.exe
- '<SYSTEM32>\taskkill.exe' /f /im iexplore.exe
- '<SYSTEM32>\taskkill.exe' /f /im safari.exe
- '<SYSTEM32>\taskkill.exe' /f /im chrome.exe
- '<SYSTEM32>\taskkill.exe' /f /im regedit.exe
- '<SYSTEM32>\taskkill.exe' /f /im avz.exe
Injects code into
the following system processes:
- <SYSTEM32>\taskkill.exe
the following user processes:
- opera.exe
- chrome.exe
- qip.exe
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- safari.exe
- AVP.EXE
- iexplore.exe
- opera.exe
- skype.exe
- ICQ.exe
- qip.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
