Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\bitf8c0.tmp
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
Modifies file system
Creates the following files
- %TEMP%\ba114754
- %APPDATA%\installdebug_ye_v3\bitede7.tmp
- %TEMP%\qgip
- %TEMP%\fdyamimugyurf
Sets the 'hidden' attribute to the following files
- %APPDATA%\installdebug_ye_v3\bitede7.tmp
- %APPDATA%\microsoft\windows\start menu\programs\startup\bitf8c0.tmp
Moves the following files
- from %APPDATA%\installdebug_ye_v3\bitede7.tmp to %APPDATA%\installdebug_ye_v3\fmplugin.exe
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
