Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Autoupdate' = 'C:\Microsoft's\Malware Fighter.exe'
Malicious functions:
Executes the following:
- '<SYSTEM32>\attrib.exe' H:\+s +h *.*
- '<SYSTEM32>\cmd.exe' /c attrib I:\+s +h *.*
- '<SYSTEM32>\attrib.exe' I:\+s +h *.*
- '<SYSTEM32>\cmd.exe' /c attrib G:\+s +h *.*
- '<SYSTEM32>\attrib.exe' G:\+s +h *.*
- '<SYSTEM32>\cmd.exe' /c attrib H:\+s +h *.*
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system:
Creates the following files:
- C:\Virtual Hotty.exe
- <Current directory>\Windows Malware DataBase.ini
- C:\Microsoft's\Malware Fighter.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'WordPad'
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: '' WindowName: 'Book1 - Microsoft Excel'
- ClassName: '' WindowName: 'Paint'
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: 'WinZip'
- ClassName: '' WindowName: 'Calculator'
- ClassName: '' WindowName: 'Registry Editor'
- ClassName: '' WindowName: 'Windows Task Manager'
- ClassName: '' WindowName: 'Malware Fighter'
- ClassName: '' WindowName: 'Untitled - Notepad'
- ClassName: '' WindowName: 'Control Panel'
- ClassName: '' WindowName: 'Mozilla Firefox'
- ClassName: '' WindowName: 'VLC media Player'
