Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\ampa] 'ImagePath' = '<SYSTEM32>\ampa.sys'
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\2gpt_bcd
- %TEMP%\7zipsfx.000\native\w2k\x86\fre\ampa.sys
- %TEMP%\7zipsfx.000\native\w2k\x86\fre\ampa.exe
- %TEMP%\7zipsfx.000\msvcr80.dll
- %TEMP%\7zipsfx.000\msvcp80.dll
- %TEMP%\7zipsfx.000\msvcm80.dll
- %TEMP%\7zipsfx.000\mfcm80u.dll
- %TEMP%\7zipsfx.000\mfcm80.dll
- %TEMP%\7zipsfx.000\mfc80u.dll
- %TEMP%\7zipsfx.000\mfc80.dll
- %TEMP%\7zipsfx.000\loaddrv_x64.exe
- %TEMP%\7zipsfx.000\loaddrv_win32.exe
- %TEMP%\7zipsfx.000\loaddrv,1.exe
- %TEMP%\7zipsfx.000\libxml2-2.dll
- %TEMP%\7zipsfx.000\libwim-15.dll
- %TEMP%\7zipsfx.000\iconv.dll
- %TEMP%\7zipsfx.000\native\wlh\amd64\fre\ampa.sys
- %TEMP%\7zipsfx.000\help.exe
- %TEMP%\7zipsfx.000\gptbcd.dll
- %TEMP%\7zipsfx.000\garunonce.exe
- %TEMP%\7zipsfx.000\exfat.dll
- %TEMP%\7zipsfx.000\epw.exe
- %TEMP%\7zipsfx.000\dyndiskconverter.exe
- %TEMP%\7zipsfx.000\callbackctrl.dll
- %TEMP%\7zipsfx.000\botva2.dll
- %TEMP%\7zipsfx.000\bcdboot.exe
- %TEMP%\7zipsfx.000\ambooter.exe
- %TEMP%\7zipsfx.000\7z.exe
- %TEMP%\7zipsfx.000\7z.dll
- %TEMP%\7zipsfx.000\wnd.ini
- %TEMP%\7zipsfx.000\libgcc_s_sjlj-1.dll
- %TEMP%\7zipsfx.000\doc\support.html
- %TEMP%\7zipsfx.000\native\wlh\x86\fre\ampa.exe
- <SYSTEM32>\ampa.sys
- %WINDIR%\syswow64\ampa.sys
- %WINDIR%\ampa.exe
- %TEMP%\7zipsfx.000\log\ampa0.log
- %WINDIR%\ga_of.dat
- %PROGRAMDATA%\aomeibr\comn.ini
- %TEMP%\7zipsfx.000\wintogo.exe
- %TEMP%\7zipsfx.000\winchk.exe
- %TEMP%\7zipsfx.000\wimmgr.dll
- %TEMP%\7zipsfx.000\wimlib-imagex.exe
- %TEMP%\7zipsfx.000\wimgapi.dll
- %TEMP%\7zipsfx.000\webctrl.dll
- %TEMP%\7zipsfx.000\vhdmgr.dll
- %TEMP%\7zipsfx.000\version.dll
- %TEMP%\7zipsfx.000\winpeshl.ini
- %TEMP%\7zipsfx.000\native\wlh\amd64\fre\ampa.exe
- %TEMP%\7zipsfx.000\ssdsecurityerase.dll
- %TEMP%\7zipsfx.000\setupgreen64.exe
- %TEMP%\7zipsfx.000\setupgreen32.exe
- %TEMP%\7zipsfx.000\scanpartition.dll
- %TEMP%\7zipsfx.000\pthreadgc2.dll
- %TEMP%\7zipsfx.000\peloaddrv.exe
- %TEMP%\7zipsfx.000\pe\driver\i386\msahci.sys
- %TEMP%\7zipsfx.000\pe\driver\amd64\msahci.sys
- %TEMP%\7zipsfx.000\pe.dll
- %TEMP%\7zipsfx.000\pathformat.dll
- %TEMP%\7zipsfx.000\partassist.exe
- %TEMP%\7zipsfx.000\ntfs2fat32.exe
- %TEMP%\7zipsfx.000\native\wnet\amd64\fre\ampa.sys
- %TEMP%\7zipsfx.000\native\wnet\amd64\fre\ampa.exe
- %TEMP%\7zipsfx.000\uninstallab.dll
- %TEMP%\7zipsfx.000\native\wlh\x86\fre\ampa.sys
- %TEMP%\7zipsfx.000\upgrade.ini
- %TEMP%\7zipsfx.000\uninstall.bat
- %TEMP%\7zipsfx.000\readme.rtf
- %TEMP%\7zipsfx.000\doc\copypart.html
- %TEMP%\7zipsfx.000\doc\integratetorecoveryenv.html
- %TEMP%\7zipsfx.000\doc\initdisk.html
- %TEMP%\7zipsfx.000\doc\index.html
- %TEMP%\7zipsfx.000\doc\images\headfill.png
- %TEMP%\7zipsfx.000\doc\hide.html
- %TEMP%\7zipsfx.000\doc\helptree.html
- %TEMP%\7zipsfx.000\doc\gptmbr.html
- %TEMP%\7zipsfx.000\doc\format.html
- %TEMP%\7zipsfx.000\doc\faq.html
- %TEMP%\7zipsfx.000\doc\extend.html
- %TEMP%\7zipsfx.000\doc\delete.html
- %TEMP%\7zipsfx.000\doc\ddc.html
- %TEMP%\7zipsfx.000\doc\create.html
- C:\amtag.bin
- %TEMP%\7zipsfx.000\doc\letter.html
- %TEMP%\7zipsfx.000\doc\copydiskwizard.html
- %TEMP%\7zipsfx.000\doc\copydisk.html
- %TEMP%\7zipsfx.000\doc\convert.html
- %TEMP%\7zipsfx.000\doc\configuration.html
- %TEMP%\7zipsfx.000\doc\cmd.html
- %TEMP%\7zipsfx.000\doc\clear.html
- %TEMP%\7zipsfx.000\doc\check.html
- %TEMP%\7zipsfx.000\doc\bootcd.html
- %TEMP%\7zipsfx.000\doc\allocate.html
- %TEMP%\7zipsfx.000\doc\active.html
- %TEMP%\7zipsfx.000\doc\about.html
- %TEMP%\7zipsfx.000\cfg.ini
- %TEMP%\7zipsfx.000\cfg.i
- %TEMP%\7zipsfx.000\2mbr_bcd
- %TEMP%\7zipsfx.000\doc\copypartwizard.html
- %TEMP%\7zipsfx.000\upgradeshow.dll
- %TEMP%\7zipsfx.000\doc\main.html
- %TEMP%\7zipsfx.000\doc\n2f.html
- %TEMP%\7zipsfx.000\doc\merge.html
- %TEMP%\7zipsfx.000\pacfg.ini
- %TEMP%\7zipsfx.000\other.ini
- %TEMP%\7zipsfx.000\microsoft.vc80.mfc.manifest
- %TEMP%\7zipsfx.000\microsoft.vc80.crt.manifest
- %TEMP%\7zipsfx.000\manual.pdf
- %TEMP%\7zipsfx.000\license.rtf
- %TEMP%\7zipsfx.000\language.ini
- %TEMP%\7zipsfx.000\lang\ko.txt
- %TEMP%\7zipsfx.000\install.bat
- %TEMP%\7zipsfx.000\doc\wtg.html
- %TEMP%\7zipsfx.000\doc\wipepart.html
- %TEMP%\7zipsfx.000\doc\wipedisk.html
- %TEMP%\7zipsfx.000\doc\wipe.html
- %TEMP%\7zipsfx.000\doc\migrate.html
- %TEMP%\7zipsfx.000\doc\typeid.html
- %TEMP%\7zipsfx.000\doc\label.html
- %TEMP%\7zipsfx.000\doc\style.css
- %TEMP%\7zipsfx.000\doc\ssdsecureerase.html
- %TEMP%\7zipsfx.000\doc\split.html
- %TEMP%\7zipsfx.000\doc\serial.html
- %TEMP%\7zipsfx.000\doc\resize.html
- %TEMP%\7zipsfx.000\doc\rebuildmbr.html
- %TEMP%\7zipsfx.000\doc\rebootmode.html
- %TEMP%\7zipsfx.000\doc\quick-partition.html
- %TEMP%\7zipsfx.000\doc\properties.html
- %TEMP%\7zipsfx.000\doc\prilog.html
- %TEMP%\7zipsfx.000\doc\password.html
- %TEMP%\7zipsfx.000\doc\partrecovery.html
- %TEMP%\7zipsfx.000\doc\partalign.html
- %TEMP%\7zipsfx.000\doc\surface.html
- %WINDIR%\temp\udd95ba.tmp
Sets the 'hidden' attribute to the following files
- C:\amtag.bin
Deletes the following files
- %WINDIR%\ampa.exe
- %WINDIR%\syswow64\ampa.sys
- %WINDIR%\temp\udd95ba.tmp
Substitutes the following files
- %WINDIR%\ampa.exe
- %WINDIR%\syswow64\ampa.sys
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\partassist.exe'
- '%TEMP%\7zipsfx.000\setupgreen64.exe' -u
- '%TEMP%\7zipsfx.000\loaddrv_x64.exe' -u
- '%TEMP%\7zipsfx.000\setupgreen64.exe'
- '%TEMP%\7zipsfx.000\loaddrv_x64.exe'
- '%TEMP%\7zipsfx.000\partassist.exe' ' (with hidden window)
- '%TEMP%\7zipsfx.000\setupgreen64.exe' -u' (with hidden window)
- '%TEMP%\7zipsfx.000\loaddrv_x64.exe' -u' (with hidden window)
- '%TEMP%\7zipsfx.000\setupgreen64.exe' ' (with hidden window)
- '%TEMP%\7zipsfx.000\loaddrv_x64.exe' ' (with hidden window)
