Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\comres.dll with <SYSTEM32>\comres.dll
Infects the following executable files:
- <SYSTEM32>\comres.dll
Malicious functions:
Executes the following:
- '<SYSTEM32>\GTH02576.exe' %WINDIR%\fOnTS\comresx.ttf dns <Full path to virus>
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %WINDIR%\fOnTS\comresx.ttf
Modifies file system:
Creates the following files:
- %WINDIR%\Fonts\GTH02576.fOn
- <SYSTEM32>\GTH02576.exe
- %WINDIR%\Fonts\GTH02576.tTf
- <SYSTEM32>\muksfv1.dll
- %WINDIR%\Fonts\comresx.ttf
Moves the following system files:
- from <SYSTEM32>\comres.dll to <SYSTEM32>\sysGTH.dll
Deletes itself.
