Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'luqajfokt' = '%APPDATA%\kpyuenir\bwgc.exe "%TEMP%\gibnjj.exe" %TEMP%\fj�'
Malicious functions
Injects code into
the following user processes:
- gibnjj.exe
Modifies file system
Creates the following files
- %TEMP%\nsude7d.tmp
- %TEMP%\coshsll.t
- %TEMP%\fjndab.mi
- %TEMP%\gibnjj.exe
- %APPDATA%\kpyuenir\bwgc.exe
Miscellaneous
Creates and executes the following
- '%TEMP%\gibnjj.exe' %TEMP%\fjndab.mi
- '%TEMP%\gibnjj.exe'
