Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lexpIorer' = '%WINDIR%\lexpIorer.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'io' = '%WINDIR%\io.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'dwqdqdqwdqwdqdwqwdf' = '%WINDIR%\dwqdqdqwdqwdqdwqwdf.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'iiiiiiiiiiiiiiiexplorer' = '%WINDIR%\iiiiiiiiiiiiiiiexplorer.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Executes the following:
- '<SYSTEM32>\shutdown.exe' -s -f -t 00
- '<SYSTEM32>\taskkill.exe' /F /IM lexpIorer.exe
- '%WINDIR%\iiiiiiiiiiiiiiiexplorer.exe'
- '%WINDIR%\io.exe'
- '<SYSTEM32>\taskkill.exe' /F /IM io.exe
- '%WINDIR%\lexpIorer.exe'
- '%WINDIR%\regedit.exe' /s "%WINDIR%\vdisableuac.reg"
- '<SYSTEM32>\notepad.exe' %WINDIR%\fonts\Tutorial.txt
- '%WINDIR%\Fonts\VistaTigabelas13LS.exe'
- '<SYSTEM32>\taskkill.exe' /F /IM iiiiiiiiiiiiiiiexplorer.exe
- '%WINDIR%\dwqdqdqwdqwdqdwqwdf.exe'
- '<SYSTEM32>\taskkill.exe' /F /IM dwqdqdqwdqwdqdwqwdf.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'PROCEXPL' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
Attempts to shut down the Windows operating system.
Modifies file system:
Creates the following files:
- <SYSTEM32>\COMCTL32.OCX
- <SYSTEM32>\MSCOMCTL.OCX
- <SYSTEM32>\MSINET.OCX
- <SYSTEM32>\COMDLG32.OCX
- %WINDIR%\lexpIorer.exe
- %WINDIR%\io.exe
- %WINDIR%\dwqdqdqwdqwdqdwqwdf.exe
- %WINDIR%\iiiiiiiiiiiiiiiexplorer.exe
- %WINDIR%\vdisableuac.reg
- %WINDIR%\Fonts\VistaTigabelas13LS.exe
- %WINDIR%\Fonts\COMCTL32.OCX
- %WINDIR%\Fonts\SYSINFO.OCX
- %WINDIR%\Fonts\Tutorial.txt
- %WINDIR%\Fonts\MSINET.OCX
- %TEMP%\~DFCE7C.tmp
- %WINDIR%\Fonts\COMDLG32.OCX
- %WINDIR%\Fonts\MSCOMCTL.OCX
Sets the 'hidden' attribute to the following files:
- %WINDIR%\dwqdqdqwdqwdqdwqwdf.exe
- %WINDIR%\vdisableuac.reg
- %WINDIR%\Fonts\MSINET.OCX
- %WINDIR%\io.exe
- %WINDIR%\lexpIorer.exe
- %WINDIR%\iiiiiiiiiiiiiiiexplorer.exe
- %WINDIR%\Fonts\VistaTigabelas13LS.exe
- %WINDIR%\Fonts\Tutorial.txt
- %WINDIR%\Fonts\SYSINFO.OCX
- %WINDIR%\Fonts\MSCOMCTL.OCX
- %WINDIR%\Fonts\COMDLG32.OCX
- %WINDIR%\Fonts\COMCTL32.OCX
Deletes the following files:
- <SYSTEM32>\MSCOMCTL.OCX
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Clean PC V17 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V18 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V15 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V16 by pekalongan'
- ClassName: '' WindowName: 'Clean PC12'
- ClassName: '' WindowName: 'Clean PC13'
- ClassName: '' WindowName: 'Clean PC V19 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V20 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V14 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V8 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V9 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V6 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V7 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V12 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V13 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V10 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V11 by pekalongan'
- ClassName: '' WindowName: 'Clean PC14'
- ClassName: '' WindowName: 'Tips Desain Rumah Minimalis - Mozilla Firefox'
- ClassName: '' WindowName: 'Tips Desain Pemilihan Mabel Rumah Minimalis | Tips Desain Rumah Minimalis - Google Chrome'
- ClassName: '' WindowName: 'Cheat Point Blank Terbaru 2016 - Mozilla Firefox'
- ClassName: '' WindowName: 'Tips Desain Rumah Minimalis - Google Chrome'
- ClassName: '' WindowName: 'LinkBucks.com - Get your share! - Mozilla Firefox'
- ClassName: '' WindowName: 'Form1'
- ClassName: '' WindowName: 'Tips Desain Pemilihan Mabel Rumah Minimalis | Tips Desain Rumah Minimalis - Mozilla Firefox'
- ClassName: '' WindowName: 'LinkBucks.com - Get your share! - Google Chrome'
- ClassName: '' WindowName: 'Cheat Point Blank Terbaru 2016 - Google Chrome'
- ClassName: '' WindowName: '- AdwCleaner - Terms of use -'
- ClassName: '' WindowName: '- AdwCleaner - v5.201 - ToolsLib -'
- ClassName: '' WindowName: 'Clean PC15'
- ClassName: '' WindowName: 'TeamViewer'
- ClassName: '' WindowName: 'ToolsLib - DOwnloads - AdwCleaner - Google Chrome'
- ClassName: '' WindowName: 'ToolsLib - DOwnloads - AdwCleaner - Mozilla Firefox'
- ClassName: '' WindowName: 'ToolsLib - Thank you for downloading AdwCleaner - Google Chrome'
- ClassName: '' WindowName: 'ToolsLib - Thank you for downloading AdwCleaner - Mozilla Firefox'
- ClassName: '' WindowName: 'BanCyberzHacks - Download Cheats And Software For Free - Google Chrome'
- ClassName: '' WindowName: 'Pekalongan Kommuniti - Google Chrome'
- ClassName: '' WindowName: 'Piriform CCleaner'
- ClassName: '' WindowName: 'Administrator: <SYSTEM32>\cmd.exe'
- ClassName: '' WindowName: 'Pekalongan Kommunity - Mozilla Firefox'
- ClassName: '' WindowName: 'Dukun Cit - Cheat Point Blank Free - Google Chrome'
- ClassName: '' WindowName: 'Pekalongan Kommuniti - Mozilla Firefox'
- ClassName: '' WindowName: 'Pekalongan Kommunity - Google Chrome'
- ClassName: '' WindowName: 'SysWOW64'
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Windows'
- ClassName: '' WindowName: 'System32'
- ClassName: 'ProcessHacker' WindowName: ''
- ClassName: '' WindowName: 'Windows Task Manager'
- ClassName: '' WindowName: 'Dukun Cit - Cheat Point Blank Free - Mozilla Firefox'
- ClassName: '' WindowName: 'Pekalongan'
- ClassName: '' WindowName: 'Clean PC V1 by pekalongan'
- ClassName: '' WindowName: 'PC'
- ClassName: '' WindowName: 'Clean PC'
- ClassName: '' WindowName: 'Clean PC V4 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V5 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V2 by pekalongan'
- ClassName: '' WindowName: 'Clean PC V3 by pekalongan'
- ClassName: '' WindowName: 'Clean'
- ClassName: '' WindowName: 'System Configuration'
- ClassName: '' WindowName: 'Registry Editor'
- ClassName: '' WindowName: 'WaW Jakarta Cheater - Google Chrome'
- ClassName: '' WindowName: 'WaW Jakarta Cheater - Mozilla Firefox'
- ClassName: '' WindowName: 'Cheat Point Blank Garena'
- ClassName: '' WindowName: 'Cheat Point Blank Garena Indonesia'
- ClassName: '' WindowName: 'Cheat Lost Saga'
- ClassName: '' WindowName: 'Cheat Point Blank'
