Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SkyNet' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Bkav2008' = '%WINDIR%\Bkav2008.exe'
Creates the following files on removable media
- <Drive name for removable media>:\bkav2008.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions
Patches code
in dll
- mfjgsyd.exe process, SHELL32.dll module
Modifies file system
Creates the following files
- %WINDIR%\bkav2008.exe
- %ProgramFiles%\bkav2008.exe
- %WINDIR%\syswow64\skynet.exe
- C:\bkav2008.exe
- C:\autorun.inf
- D:\bkav2008.exe
- D:\autorun.inf
Sets the 'hidden' attribute to the following files
- C:\autorun.inf
- C:\bkav2008.exe
- D:\autorun.inf
- D:\bkav2008.exe
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\bkav2008.exe
Deletes the following system files
- %WINDIR%\win.ini
- %WINDIR%\system.ini
Modifies the HOSTS file.
Network activity
UDP
- DNS ASK th####ubai.edu.vn
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKCR\exefile\shell\open\command /v Shell /t REG_SZ /d ###Drive:\Path\Name.exe### %1 %* /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Control Panel\International /v s1159 /t REG_S /d ###Letter/Symbol/Number### /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Control Panel\International /v s2359 /t REG_SZ /d ###Letter/Symbol/Number### /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Control Panel\International /v SLongDate /t REG_SZ /d ###Letter/Symbol/Number### /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Control Panel\International /v sShortDate /t REG_SZ /d ###Letter/Symbol/Number### /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Control Panel\International /v sTimeFormat /t REG_SZ /d ###Letter/Symbol/Number### /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Control Panel\International /v sNativeDigits /t REG_SZ /d ###Letter/Symbol/Number### /f
- '%WINDIR%\syswow64\cmd.exe' /C net view > C:\plog.tmp
- '%WINDIR%\syswow64\net.exe' view
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKCR\exefile\shell\open\command /v Shell /t REG_SZ /d ###Drive:\Path\Name.exe### %1 %* /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKLM\Control Panel\International /v s1159 /t REG_S /d ###Letter/Symbol/Number### /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKLM\Control Panel\International /v s2359 /t REG_SZ /d ###Letter/Symbol/Number### /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKLM\Control Panel\International /v SLongDate /t REG_SZ /d ###Letter/Symbol/Number### /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKLM\Control Panel\International /v sShortDate /t REG_SZ /d ###Letter/Symbol/Number### /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKLM\Control Panel\International /v sTimeFormat /t REG_SZ /d ###Letter/Symbol/Number### /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKLM\Control Panel\International /v sNativeDigits /t REG_SZ /d ###Letter/Symbol/Number### /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C net view > C:\plog.tmp' (with hidden window)
