Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '' = '<Full path to file>'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Executes the following:
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.wv
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.mp2
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.ogg
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.wav
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.png
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.raw
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.webp
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.jpg
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.m4r
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.flac
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.aac
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.wma
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.ape
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.amr
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.m4a
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.ac3
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.mmf
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.ico
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.psd
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.ai
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.rar
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.zip
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.dll
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.msi
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.ttf
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.exe
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.php
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.tif
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.pcx
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.bmp
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.gif
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.html
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.asp
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.iso
- '%WINDIR%\XXInstall\ps.exe' +s +h +a +r /d /s C:\*.htm
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.mp3
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.xltm
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.xlsb
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.xlsm
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.xltx
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.pptm
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.potx
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.xlam
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.pptx
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.xls
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.doc
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.docx
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.txt
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.dotm
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.xlsx
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.docm
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.dotx
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.potm
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.mpg
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.vob
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.wmv
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.mkv
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.swf
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.mpeg
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.mov
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.flv
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.3gp
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.ppsm
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.sldx
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.ppam
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.ppsx
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.mp4
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.avi
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.sldm
- '<SYSTEM32>\attrib.exe' +s +h +a +r /d /s C:\*.thmx
Injects code into
the following system processes:
- %WINDIR%\XXInstall\ps.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\Explorer.EXE
Network activity:
Connects to:
- 'wa####.truemoney.com':443
- 'localhost':1037
UDP:
- DNS ASK www.google.com
- DNS ASK wa####.truemoney.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'BaseBar' WindowName: 'ChanApp'
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Program Manager'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
