Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'googletalk' = '%APPDATA%\Google Talk\googletalk.exe /autostart'
Malicious functions:
Executes the following:
- <SYSTEM32>\systeminfo.exe
Modifies file system :
Creates the following files:
- %APPDATA%\Google Talk\googletalk.exe
- %APPDATA%\Microsoft\Sze\hqhmp
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: '56' WindowName: ' 29'
- ClassName: '8 653' WindowName: '9 '
- ClassName: ' 32290 ' WindowName: ' 32290 '
- ClassName: '31 ' WindowName: '33381 59'
- ClassName: '9 32' WindowName: '3 '
- ClassName: '06' WindowName: ' 1 1'
- ClassName: '2234 7' WindowName: '9 '
- ClassName: '59665 86' WindowName: '8 653'
- ClassName: '7 9 98 ' WindowName: '6 7678017'
- ClassName: ' 166' WindowName: '70516'
- ClassName: 'Indicator' WindowName: ''
- ClassName: '7 9 98 ' WindowName: '4'
- ClassName: ' 37 211' WindowName: ' 674 14'
- ClassName: '59665 86' WindowName: '59665 86'
- ClassName: '26761 0' WindowName: ' 37 211'
- ClassName: '0 5806' WindowName: '33381 59'
- ClassName: '6 7678017' WindowName: '913133'
- ClassName: '26761 0' WindowName: '59665 86'
- ClassName: ' 63373 2' WindowName: '0 '
- ClassName: '5' WindowName: '5'
- ClassName: ' 166' WindowName: ' 166'
- ClassName: '3 ' WindowName: '3 '
- ClassName: ' 9 ' WindowName: '63 '
- ClassName: '01 03604 ' WindowName: '01 03604 '
- ClassName: ' 4 ' WindowName: ' 4 '
- ClassName: ' 166' WindowName: '59665 86'
- ClassName: '546 57' WindowName: '492 9308 '
- ClassName: ' 166' WindowName: '59 5 8'
- ClassName: '69' WindowName: '69'
- ClassName: '1 807 ' WindowName: '78'
- ClassName: '6 7678017' WindowName: ' 8 6 442'
- ClassName: ' 399' WindowName: ' 399'
- ClassName: ' 83' WindowName: '8127'
