Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\dbnmpntw.dll with %TEMP%\10.tmp
- <SYSTEM32>\cliconfg.exe with %TEMP%\E.tmp
- <SYSTEM32>\jgsd400.dll with %TEMP%\12.tmp
- <SYSTEM32>\liblwres.dll with %TEMP%\16.tmp
- <SYSTEM32>\libeay32.dll with %TEMP%\14.tmp
- <SYSTEM32>\mfc71.dll with %TEMP%\5.tmp
- <SYSTEM32>\msvcr71.dll with %TEMP%\3.tmp
- <SYSTEM32>\hypertrm.dll with %TEMP%\7.tmp
- <SYSTEM32>\jgpl400.dll with %TEMP%\B.tmp
- <SYSTEM32>\prntvpt.dll with %TEMP%\9.tmp
Modifies master boot record (MBR).
Malicious functions:
Creates and executes the following:
- %TEMP%\2.tmp \555x
- %TEMP%\1.tmp \888x
Modifies file system :
Creates the following files:
- %TEMP%\2.tmp
- %TEMP%\1.tmp
Deletes the following files:
- %TEMP%\11.tmp
- %TEMP%\F.tmp
- %TEMP%\13.tmp
- %TEMP%\17.tmp
- %TEMP%\15.tmp
- %TEMP%\D.tmp
- %TEMP%\6.tmp
- %TEMP%\4.tmp
- %TEMP%\8.tmp
- %TEMP%\C.tmp
- %TEMP%\A.tmp
Moves the following system files:
- from <SYSTEM32>\dbnmpntw.dll to %TEMP%\11.tmp
- from <SYSTEM32>\cliconfg.exe to %TEMP%\F.tmp
- from <SYSTEM32>\jgsd400.dll to %TEMP%\13.tmp
- from <SYSTEM32>\liblwres.dll to %TEMP%\17.tmp
- from <SYSTEM32>\libeay32.dll to %TEMP%\15.tmp
- from <SYSTEM32>\mfc71.dll to %TEMP%\6.tmp
- from <SYSTEM32>\msvcr71.dll to %TEMP%\4.tmp
- from <SYSTEM32>\hypertrm.dll to %TEMP%\8.tmp
- from <SYSTEM32>\jgpl400.dll to %TEMP%\C.tmp
- from <SYSTEM32>\prntvpt.dll to %TEMP%\A.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
