Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] '{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}' = 'csiddll'
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c 375519961O57540.bat
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\dbgfg8.dll
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\qfzpvx.dll
Modifies file system:
Creates the following files:
- <Current directory>\375519961O57540.bat
- <Current directory>\57540.aqq
- <SYSTEM32>\dbgfg8.dll
- <SYSTEM32>\qfzpvx.dll
- %WINDIR%\Internet Explorer.lnk
Deletes the following files:
- <Current directory>\57540.aqq
Moves the following files:
- from %WINDIR%\Internet Explorer.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk to %APPDATA%\Microsoft\Internet Explorer\Windows Media Player.lnk
- from %WINDIR%\Internet Explorer.lnk to %HOMEPATH%\Desktop\Internet Explorer.lnk
Deletes itself.
