Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\services.exe'
- '<SYSTEM32>\cmd.exe' del "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
- '%HOMEPATH%\Start Menu\Programs\windows.exe'
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe'
Injects code into
the following system processes:
- <SYSTEM32>\services.exe
- %WINDIR%\Explorer.EXE
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Modifies file system:
Creates the following files:
- %HOMEPATH%\Start Menu\Programs\windows.exe
Deletes the following files:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
