Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemuyrsm.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjvipt.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemldaxm.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemscmtd.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqembgmzd.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfntua.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemprioq.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemegmnj.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemmbrzb.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtfppt.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemxtdld.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemzwinz.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemqtvcs.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemitawj.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemrxwla.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjqwvo.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemtleht.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemirqza.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemjtvwr.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemyzhfz.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemfalhh.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Sysqemarirg.exe'
Modifies file system
Creates the following files
- %TEMP%\qpath.ini
- %TEMP%\sysqemjvipt.exe
- %TEMP%\sysqemldaxm.exe
- %TEMP%\sysqemscmtd.exe
- %TEMP%\sysqembgmzd.exe
- %TEMP%\sysqemfntua.exe
- %TEMP%\sysqemprioq.exe
- %TEMP%\sysqemegmnj.exe
- %TEMP%\sysqemmbrzb.exe
- %TEMP%\sysqemtfppt.exe
- %TEMP%\sysqemxtdld.exe
- %TEMP%\sysqemzwinz.exe
- %TEMP%\sysqemqtvcs.exe
- %TEMP%\sysqemitawj.exe
- %TEMP%\sysqemrxwla.exe
- %TEMP%\sysqemjqwvo.exe
- %TEMP%\sysqemtleht.exe
- %TEMP%\sysqemirqza.exe
- %TEMP%\sysqemjtvwr.exe
- %TEMP%\sysqemyzhfz.exe
- %TEMP%\sysqemuyrsm.exe
- %TEMP%\sysqamqqvaqqd.exe
- %TEMP%\sysqemfalhh.exe
- %TEMP%\sysqemarirg.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\sysqemuyrsm.exe
- %TEMP%\sysqemjvipt.exe
- %TEMP%\sysqemldaxm.exe
- %TEMP%\sysqemscmtd.exe
- %TEMP%\sysqembgmzd.exe
- %TEMP%\sysqemfntua.exe
- %TEMP%\sysqemprioq.exe
- %TEMP%\sysqemegmnj.exe
- %TEMP%\sysqemmbrzb.exe
- %TEMP%\sysqemtfppt.exe
- %TEMP%\sysqemfalhh.exe
- %TEMP%\sysqemxtdld.exe
- %TEMP%\sysqemqtvcs.exe
- %TEMP%\sysqemitawj.exe
- %TEMP%\sysqemrxwla.exe
- %TEMP%\sysqemjqwvo.exe
- %TEMP%\sysqemtleht.exe
- %TEMP%\sysqemirqza.exe
- %TEMP%\sysqemjtvwr.exe
- %TEMP%\sysqemyzhfz.exe
- %TEMP%\sysqamqqvaqqd.exe
- %TEMP%\sysqemzwinz.exe
- %TEMP%\sysqemarirg.exe
Miscellaneous
Creates and executes the following
- '%TEMP%\sysqemuyrsm.exe'
- '%TEMP%\sysqemjvipt.exe'
- '%TEMP%\sysqemldaxm.exe'
- '%TEMP%\sysqemscmtd.exe'
- '%TEMP%\sysqembgmzd.exe'
- '%TEMP%\sysqemfntua.exe'
- '%TEMP%\sysqemprioq.exe'
- '%TEMP%\sysqemegmnj.exe'
- '%TEMP%\sysqemmbrzb.exe'
- '%TEMP%\sysqemtfppt.exe'
- '%TEMP%\sysqemxtdld.exe'
- '%TEMP%\sysqemzwinz.exe'
- '%TEMP%\sysqemqtvcs.exe'
- '%TEMP%\sysqemitawj.exe'
- '%TEMP%\sysqemrxwla.exe'
- '%TEMP%\sysqemjqwvo.exe'
- '%TEMP%\sysqemtleht.exe'
- '%TEMP%\sysqemirqza.exe'
- '%TEMP%\sysqemjtvwr.exe'
- '%TEMP%\sysqemyzhfz.exe'
- '%TEMP%\sysqemfalhh.exe'
- '%TEMP%\sysqemarirg.exe'
