Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinUpdtr' = '%APPDATA%\WinUpdtr\firefox.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Update' = '%WINDIR%\NET\taskhost.exe'
Modifies file system
Creates the following files
- %TEMP%\avast antivirus 6.exe
- %TEMP%\_av_sfx.tm~a02876\ais_dll_ukr-95.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_vie-5c.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_res-13d.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_x64-21a.vpx
- %TEMP%\_av_sfx.tm~a02876\chrome-2.vpx
- %TEMP%\_av_sfx.tm~a02876\jollyroger.vpx
- %TEMP%\_av_sfx.tm~a02876\jrog-a7.vpx
- %TEMP%\_av_sfx.tm~a02876\jrog2-0.vpx
- %TEMP%\_av_sfx.tm~a02876\part-jrog-a7.vpx
- %TEMP%\_av_sfx.tm~a02876\part-jrog2-0.vpx
- %TEMP%\_av_sfx.tm~a02876\part-prg_ais-252.vpx
- %TEMP%\_av_sfx.tm~a02876\part-setup_ais-252.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_swe-ad.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_tur-5e.vpx
- %TEMP%\_av_sfx.tm~a02876\part-vps_win32-10071200.vpx
- %TEMP%\_av_sfx.tm~a02876\servers.def.vpx
- %TEMP%\_av_sfx.tm~a02876\setif_ais-252.vpx
- %TEMP%\_av_sfx.tm~a02876\setup_ais-252.vpx
- %TEMP%\_av_sfx.tm~a02876\vps_32-23a.vpx
- %TEMP%\_av_sfx.tm~a02876\vps_win32-24f.vpx
- %TEMP%\_av_sfx.tm~a02876\winsys-3.vpx
- %TEMP%\_av_sfx.tm~a02876\setupui.dll
- %TEMP%\vbc.exe
- %APPDATA%\winupdtr\firefox.exe
- %WINDIR%\net\taskhost.exe
- %TEMP%\user2.txt
- %APPDATA%\userv1.18.0 - trial versionlog.dat
- %TEMP%\_av_sfx.tm~a02876\prod-ais.vpx
- %TEMP%\_av_sfx.tm~a02876\servers.def
- %TEMP%\_av_sfx.tm~a02876\ais_dll_svk-91.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_slo-60.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_rus-1a3.vpx
- %TEMP%\_av_sfx.tm~a02876\setup.ovr
- %TEMP%\_av_sfx.tm~a02876\avast.setup
- %TEMP%\_av_sfx.tm~a02876\ais_core-1e4.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_ara-48.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_bel-12.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_blg-ad.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_cat-13.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_chs-1a4.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_cht-a6.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_cro-4e.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_cze-1a3.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_dut-71.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_eng-1cf.vpx
- %TEMP%\firefox.exe
- %TEMP%\_av_sfx.tm~a02876\ais_dll_esp-1a1.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_fin-69.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_fre-1a1.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_ger-1a1.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_gre-95.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_hun-bb.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_ita-19f.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_jpn-171.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_kor-c1.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_nor-69.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_pol-1a2.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_por-1a5.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_ptg-71.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_rom-5.vpx
- %TEMP%\_av_sfx.tm~a02876\ais_dll_est-ad.vpx
- %TEMP%\user7
- %TEMP%\user8
Sets the 'hidden' attribute to the following files
- %APPDATA%\winupdtr\firefox.exe
- %APPDATA%\userv1.18.0 - trial versionlog.dat
Deletes the following files
- %TEMP%\user2.txt
- %TEMP%\user8
- %TEMP%\user7
Substitutes the following files
- %TEMP%\user8
- %TEMP%\user7
Network activity
UDP
- DNS ASK co#######nsymantec.sytes.net
Miscellaneous
Creates and executes the following
- '%TEMP%\avast antivirus 6.exe'
- '%TEMP%\firefox.exe'
- '%TEMP%\_av_sfx.tm~a02876\avast.setup' /sfx /sfxstorage "%TEMP%\_av_sfx.tm~a02876" /srcpath "%LOCALAPPDATA%\Temp" /sfxname "setup_av_free"
- '%TEMP%\vbc.exe'
Executes the following
- '%ProgramFiles(x86)%\opera\launcher.exe'
