Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\jgwADG.lnk
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /F /IM cmd.exe
- '<SYSTEM32>\taskkill.exe' /F /IM wscript.exe
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system:
Creates the following files:
- <Current directory>\qvcf.hM
- %APPDATA%\dllhost.exe
- %APPDATA%uoCN.exe
- %TEMP%\aut1.tmp
Deletes the following files:
- %TEMP%\aut1.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'AngarCl'
- ClassName: '' WindowName: ''
Creates and executes the following:
- '%APPDATA%\dllhost.exe'
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe'
