Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'lpjqbhsz' = 'C:\oszjqxhovc\xkrbip.exe'
Modifies file system
Creates the following files
- %WINDIR%\synaptics.7z
- %WINDIR%\synaptics.rs
- C:\oszjqxhovc\xkrbip.exe
- <Current directory>\update.bat
Deletes itself.
Miscellaneous
Creates and executes the following
- 'C:\oszjqxhovc\xkrbip.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c <Current directory>\update.bat
- '%WINDIR%\syswow64\timeout.exe' /T 2
- '%WINDIR%\syswow64\timeout.exe' /T 3
