Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\jgsd400.dll with %TEMP%\C.tmp
- <SYSTEM32>\vfp9t.dll with %TEMP%\A.tmp
- <SYSTEM32>\jgsh400.dll with %TEMP%\10.tmp
- <SYSTEM32>\libisc.dll with %TEMP%\E.tmp
- <SYSTEM32>\libxml2.dll with %TEMP%\4.tmp
- <SYSTEM32>\mapistub.dll with %TEMP%\2.tmp
- <SYSTEM32>\xpsshhdr.dll with %TEMP%\8.tmp
- <SYSTEM32>\ir41_qcx.dll with %TEMP%\6.tmp
Modifies master boot record (MBR).
Malicious functions:
Creates and executes the following:
- %TEMP%\WLXPL.exe \444x
Modifies file system :
Creates the following files:
- %TEMP%\WLXPL.exe
- %WINDIR%\udeqp.bcx
- %TEMP%\WLXPhotoLibraryMain.dll
Deletes the following files:
- %TEMP%\D.tmp
- %TEMP%\B.tmp
- %TEMP%\11.tmp
- %TEMP%\F.tmp
- %TEMP%\5.tmp
- %TEMP%\3.tmp
- %TEMP%\9.tmp
- %TEMP%\7.tmp
Moves the following system files:
- from <SYSTEM32>\jgsd400.dll to %TEMP%\D.tmp
- from <SYSTEM32>\vfp9t.dll to %TEMP%\B.tmp
- from <SYSTEM32>\jgsh400.dll to %TEMP%\11.tmp
- from <SYSTEM32>\libisc.dll to %TEMP%\F.tmp
- from <SYSTEM32>\libxml2.dll to %TEMP%\5.tmp
- from <SYSTEM32>\mapistub.dll to %TEMP%\3.tmp
- from <SYSTEM32>\xpsshhdr.dll to %TEMP%\9.tmp
- from <SYSTEM32>\ir41_qcx.dll to %TEMP%\7.tmp
Moves itself:
- from <Full path to virus> to %TEMP%\1.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'ajfngaajf' WindowName: 'k'
