Technical Information
Modifies file system
Creates the following files
- %WINDIR%\my.ini
- %CommonProgramFiles%\tk.reg
- %ProgramFiles%\winrar\ralwsdoeu.pumgl
- D:\program files\common\mgydevsvk.vbs
- C:\about blank.htm
- <Current directory>\killme.vbs
Sets the 'hidden' attribute to the following files
- %ProgramFiles%\winrar\ralwsdoeu.pumgl
- C:\about blank.htm
Deletes the following files
- %CommonProgramFiles%\tk.reg
Deletes itself.
Network activity
UDP
- DNS ASK up.##36688.com
- DNS ASK u.###6688.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' <Current directory>\Killme.vbs
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c regedit /s "%CommonProgramFiles%\tk.reg"
- '%WINDIR%\syswow64\regedit.exe' /s "%CommonProgramFiles%\tk.reg"
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %ProgramFiles%\winrar\ralwsdoeu.pumgl
- '%WINDIR%\syswow64\wscript.exe' "D:\Program Files\Common\mgydevsvk.vbs"
- '%WINDIR%\syswow64\cmd.exe' /c regedit /s "%CommonProgramFiles%\tk.reg"' (with hidden window)
