Win32.HLLW.Autoruner.51833

Added to the Dr.Web virus database: 2011-06-16

Virus description added: 2020-06-29

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'Critical Core' = '%APPDATA%\winlogon.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'Critical Core' = '%APPDATA%\winlogon.exe'

Creates the following files on removable media

<Drive name for removable media>:\dfgdfjjjjdfjdfjgfdjturturutjjf\dfg-2352-26235-2322322-624621221-2622255\desktop.ini
<Drive name for removable media>:\dfgdfjjjjdfjdfjgfdjturturutjjf\dfg-2352-26235-2322322-624621221-2622255\explorer.exe
<Drive name for removable media>:\autorun.inf

Malicious functions

Injects code into

the following user processes:

Modifies file system

Creates the following files

Sets the 'hidden' attribute to the following files

%APPDATA%\winlogon.exe
<Drive name for removable media>:\dfgdfjjjjdfjdfjgfdjturturutjjf\dfg-2352-26235-2322322-624621221-2622255\explorer.exe

Network activity

UDP

Miscellaneous

Creates and executes the following