Technical Information
Malicious functions
Hooks functions
in browsers
- firefox.exe process, urlmon.dll module
- firefox.exe process, cryptsp.dll module
- firefox.exe process, netutils.dll module
- firefox.exe process, wininet.dll module
- firefox.exe process, mswsock.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\wlrmdr.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\0verl0ad.bat
- %TEMP%\ixp000.tmp\dds.vbs
- %TEMP%\ixp000.tmp\light.vbs
- %TEMP%\ixp000.tmp\spambox.vbs
- %TEMP%\ixp000.tmp\spambox2.vbs
- %TEMP%\ixp000.tmp\spambox3.vbs
- %TEMP%\ixp000.tmp\spambox4.vbs
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\IXP000.TMP\light.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\IXP000.TMP\spambox.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\IXP000.TMP\spambox2.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\IXP000.TMP\spambox3.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\IXP000.TMP\spambox4.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\IXP000.TMP\dds.vbs"
Executes the following
- '<SYSTEM32>\cmd.exe' /c 0VerL0AD.bat
- '<SYSTEM32>\shutdown.exe' -s -t 18 -c "Your computer has been fucked by the 0VerL0AD Virus!"
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\cmd.exe' /c 0VerL0AD.bat' (with hidden window)
Attempts to shut down the Windows operating system.
