Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ucj2mmd5.ar4' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'bitzmley.20i' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'hv0sgp4y.ggd' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dglhvom0.vjt' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '3a10waly.wkj' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wtcul1fw.4om' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1qiwn2nr.233' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'bdli0ogn.ycg' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ewerpue4.tn5' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'phyv2q3o.v2s' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'hz1oht5s.fhx' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'uoyx4pxc.pni' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '2m4fypy0.4vq' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'kj3hjgxw.xzj' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'tdgnrvgn.snj' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'jyvr2lcb.yyv' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qatxjtrt.ybj' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'mkgkqqic.b5k' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'db5n4vqe.kae' = '<LS_APPDATA>\ExpIorer.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\$Recycle.Bin.scr
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Modifies file system :
Creates the following files:
- %APPDATA%\Thumbs.db
- %HOMEPATH%\Templates\Service.exe
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\autorun.inf
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
