Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'avscan' = '%TEMP%\avscan.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'hfbgzz' = 'W_X_C.bat'
Creates the following files on removable media
- <Drive name for removable media>:\usb.exe
- <Drive name for removable media>:\rahasia_ku.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Modifies file system
Creates the following files
- %WINDIR%\w_x_c.vbs
- %WINDIR%\w_x_c.bat
- %TEMP%\avscan.exe
- %WINDIR%\hosts.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\avscan.exe
- <Drive name for removable media>:\usb.exe
- <Drive name for removable media>:\autorun.inf
Miscellaneous
Creates and executes the following
- '%TEMP%\avscan.exe'
- '%WINDIR%\hosts.exe'
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\W_X_C.vbs"
- '%WINDIR%\syswow64\reg.exe' DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f' (with hidden window)
- '%TEMP%\avscan.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\W_X_C.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\reg.exe' DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\W_X_C.bat
