Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\dsound.dll with <SYSTEM32>\dsound.dll.mod
- <SYSTEM32>\mshtml.dll with <SYSTEM32>\mshtml.dll.mod
Malicious functions:
Creates and executes the following:
- %WINDIR%\nFjLMUy.exe
Executes the following:
- <SYSTEM32>\cmd.exe /c """%TEMP%\delself.bat"" "
Modifies file system :
Creates the following files:
- <SYSTEM32>\CEjhI.VDq
- %TEMP%\CEjhI.VDq
- %TEMP%\ComB.tmp
- %TEMP%\delself.bat
- <SYSTEM32>\dsound.dll.mod
- <SYSTEM32>\mshtml.dll.mod
- %TEMP%\ЅвіэЅы±Х.exe
- %TEMP%\$filenumber.txt
- %TEMP%\$filenumbere.txt
- %WINDIR%\nFjLMUy.exe
- %TEMP%\ComA.tmp
- %TEMP%\DNFёЁЦъОДјю.exe
Deletes the following files:
- %TEMP%\DNFёЁЦъОДјю.exe
- %TEMP%\$filenumber.txt
- %TEMP%\$filenumbere.txt
Moves the following system files:
- from <SYSTEM32>\dsound.dll to <SYSTEM32>\dsound.dlluxLnv
- from <SYSTEM32>\mshtml.dll to <SYSTEM32>\mshtml.dllqWSwt
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: '12345'
- ClassName: 'TWINCONTROL' WindowName: '????????????'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '54321' WindowName: '12345'
