Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\dxdiag.exe
Modifies file system
Creates the following files
- C:\zip.dll
Sets the 'hidden' attribute to the following files
- C:\zip.dll
Moves the following files
- from <Full path to file> to %TEMP%\_@ea8c.tmp
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to <Full path to file>.bak
Deletes itself.
Miscellaneous
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\dxdiag.exe'
