Technical Information
To ensure autorun and distribution:
Modifies master boot record (MBR).
Malicious functions:
Executes the following:
- '<SYSTEM32>\logonui.exe' /status /shutdown
- '%TEMP%\x2z8.exe'
Attempts to shut down the Windows operating system.
Modifies file system:
Creates the following files:
- %TEMP%\x2z8.exe
- %TEMP%\fpath.txt
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'StatusWindowClass' WindowName: ''
