Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Control Panel\Desktop\] 'SCRNSAVE.EXE' = '<SYSTEM32>\HALLOE~1.SCR'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run\] 'Kleraz' = '%WINDIR%\Kl3r4z.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'SrvcStrtuser' = '%HOMEPATH%\Local Settings\WINDOWS\SYSTEM32\LSASS.EXE'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'SysServc' = '%HOMEPATH%\Local Settings\WINDOWS\SYSTEM32\SERVICE.EXE'
- [HKLM\Software\Classes\exefile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run\] 'MSMSGS' = '%HOMEPATH%\Local Settings\WINDOWS\SYSTEM32\LSASS.EXE'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run\] 'SettingsServiceuser' = '%HOMEPATH%\Local Settings\WINDOWS\SYSTEM32\SMSS.EXE'
- [HKLM\Software\Classes\lnkfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [HKLM\Software\Classes\piffile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [HKLM\Software\Classes\batfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [HKLM\Software\Classes\comfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [HKLM\Software\Classes\docfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [HKLM\Software\Classes\xlsfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
Creates or modifies the following files
- %ALLUSERSPROFILE%\start menu\programs\startup\adobe gamma .pif
Creates the following files on removable media
- <Drive name for removable media>:\top bugil.exe
- <Drive name for removable media>:\boot.exe
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\desktop.ini
- <Drive name for removable media>:\settings\folder.htt
- <Drive name for removable media>:\data penting\kumpulan password bank.exe
- <Drive name for removable media>:\data penting\kumpulan poto bugil.exe
- <Drive name for removable media>:\kumpulan puisi.exe
- <Drive name for removable media>:\kumpulan poto.exe
- <Drive name for removable media>:\system volume informations\folder.htt
- <Drive name for removable media>:\settings.ini
- <Drive name for removable media>:\system volume informations\kl3r4z.exe
- <Drive name for removable media>:\tools hacker.exe
- <Drive name for removable media>:\rahasiaku.exe
- <Drive name for removable media>:\antivirus terbaru.exe
- <Drive name for removable media>:\cerita keren.exe
- <Drive name for removable media>:\settings\root.exe
- <Drive name for removable media>:\data user.exe
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
blocks the following features:
- System Restore (SR)
modifies the following system settings:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\] 'NoFolderOptions' = '00000001'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\] 'NoFolderOptions' = '00000001'
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Internet Explorer\Main] 'Window Title' = ' :: SaNgKaboT #VM ComMuNiTy ::'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- C:\data penting\kumpulan poto bugil.exe
- %HOMEPATH%\local settings\windows\system32\smss.exe
- %HOMEPATH%\local settings\windows\system32\lsass.exe
- %WINDIR%\syswow64\expiorer.exe
- D:\data user.exe
- D:\settings\root.exe
- C:\data user.exe
- C:\settings\root.exe
- %WINDIR%\syswow64\halloewean.scr
- %WINDIR%\syswow64\shell.exe
- C:\kl3r4z.exe
- %HOMEPATH%\local settings\windows\system32\pesan kleraz.html
- %WINDIR%\kl3r4z.exe
- %HOMEPATH%\local settings\application data\lsass.exe
- %WINDIR%\patch_vista.zip .exe
- %HOMEPATH%\local settings\application data\smss.exe
- %WINDIR%\hjransav.bat
- C:\pesan kleraz.html
- D:\boot.exe
- D:\autorun.inf
- D:\desktop.ini
- D:\settings\folder.htt
- D:\data penting\kumpulan password bank.exe
- D:\data penting\kumpulan poto bugil.exe
- C:\boot.exe
- C:\autorun.inf
- C:\desktop.ini
- C:\settings\folder.htt
- C:\data penting\kumpulan password bank.exe
- C:\autoexec.bat
- %WINDIR%\msvbvm60.dll
Sets the 'hidden' attribute to the following files
- C:\settings\folder.htt
- %WINDIR%\patch_vista.zip .exe
- %HOMEPATH%\local settings\windows\system32\smss.exe
- %HOMEPATH%\local settings\windows\system32\lsass.exe
- C:\kl3r4z.exe
- <Drive name for removable media>:\autorun.inf
- D:\autorun.inf
- %WINDIR%\kl3r4z.exe
- C:\autorun.inf
- <Drive name for removable media>:\settings\folder.htt
- D:\desktop.ini
- D:\settings\folder.htt
- <Drive name for removable media>:\system volume informations\folder.htt
- <Drive name for removable media>:\settings.ini
- C:\desktop.ini
- <Drive name for removable media>:\desktop.ini
- %WINDIR%\msvbvm60.dll
Network activity
Connects to
- 'ya##o.com':80
UDP
- DNS ASK kl####.110mb.com
- DNS ASK ya##o.com
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: 'Registry Editor'
- ClassName: '' WindowName: 'Folder Options'
- ClassName: '' WindowName: 'Local Settings'
- ClassName: 'ExploreWClass' WindowName: ''
- ClassName: 'CabinetWClass' WindowName: ''
- ClassName: 'RebarWindow32' WindowName: ''
- ClassName: 'ComboBoxEx32' WindowName: ''
- ClassName: 'ComboBox' WindowName: ''
- ClassName: 'Edit' WindowName: ''
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%WINDIR%\kl3r4z.exe'
- '%WINDIR%\syswow64\shell.exe'
- '%WINDIR%\syswow64\expiorer.exe'
