Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe %WINDIR%\dxdiag.exe'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{BTT9AE78-87RT-11dW-2944-FF034297}] 'StubPath' = '<SYSTEM32>\_dxdiag.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'Microsoft DirectX Diagnostic Tool' = '%WINDIR%\dxdiag.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Creates and executes the following:
- '%WINDIR%\_msn.exe'
- '<SYSTEM32>\_pnc.exe'
- '<SYSTEM32>\_mps.exe' /STEXT _mps.dat
- '%WINDIR%\dxdiag.exe' -OK
- '<SYSTEM32>\_fps.exe' /STEXT _fps.dat
Executes the following:
- '<SYSTEM32>\net1.exe' STOP SharedAccess
- '<SYSTEM32>\net1.exe' STOP wscsvc
- '<SYSTEM32>\net1.exe' STOP srservice
- '<SYSTEM32>\net.exe' STOP wscsvc
- '<SYSTEM32>\net.exe' STOP SharedAccess
- '<SYSTEM32>\net.exe' STOP srservice
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: <SYSTEM32>\_key.dll
Searches for registry branches where third party applications store passwords:
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\Ghisler\Windows Commander]
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKLM>\SOFTWARE\Miranda]
- [<HKCU>\software\Mirabilis\ICQ\NewOwners]
- [<HKCU>\Software\Far\Plugins\FTP\Hosts]
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian]
Searches for windows to
detect analytical utilities:
- ClassName: 'RegMonClass' WindowName: ''
- ClassName: 'FileMonClass' WindowName: ''
Modifies file system :
Creates the following files:
- %WINDIR%\_msn.exe
- <SYSTEM32>\_icq.dll
- <SYSTEM32>\_mps.dat
- <SYSTEM32>\_pnc.dat
- <SYSTEM32>\_pnc.exe
- %WINDIR%\_pnc.dat
- <SYSTEM32>\_mps.exe
- %TEMP%\B715412D.TMP
- <SYSTEM32>\_dxdiag.exe
- %WINDIR%\dxdiag.exe
- <SYSTEM32>\_fps.dat
- <SYSTEM32>\_fps.exe
- <SYSTEM32>\_key.dll
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\_dxdiag.exe
- %WINDIR%\dxdiag.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
