Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\.com] '' = 'txtfile-'
- [HKLM\Software\Classes\.bat] '' = 'txtfile-'
- [HKLM\Software\Classes\.cmd] '' = 'txtfile-'
- [HKLM\Software\Classes\.exe] '' = 'txtfile -'
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe
- '<SYSTEM32>\taskkill.exe' /f /im HipsTray.exe /t
- '<SYSTEM32>\taskkill.exe' /f /im 360Tray.exe /t
- '<SYSTEM32>\taskkill.exe' /f /im ZhuDongFangYu.exe /t
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\a931.tmp\a932.tmp\a933.bat
Moves the following files
- from <SYSTEM32>\catroot2\edbtmp.log to <SYSTEM32>\catroot2\edb.log
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\A931.tmp\A932.tmp\A933.bat <Full path to file>"
- '<SYSTEM32>\timeout.exe' 3
- '<SYSTEM32>\cmd.exe' /c "del /f /s /q <SYSTEM32>\config\*.*"
- '<SYSTEM32>\cmd.exe' /c "del /f /s /q <SYSTEM32>\*.*"
