Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'сtfmоn.exe' = '<SYSTEM32>\сtfmon.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'сtfmоn.exe' = '<SYSTEM32>\сtfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe <SYSTEM32>\АHTОMSYS19.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '<SYSTEM32>\DETER177\lsass.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\Flash.scr
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Creates and executes the following:
- '<SYSTEM32>\DETER177\smss.exe'
- '<SYSTEM32>\DETER177\svсhоst.exe'
Searches for windows to
bypass different anti-viruses:
- ClassName: 'AVP.SettingsWindow' WindowName: '(null)'
- ClassName: 'AVP.ReportWindow' WindowName: '(null)'
- ClassName: 'AVP.Product_Notification' WindowName: '(null)'
- ClassName: 'AVP.MessageDialog' WindowName: '(null)'
- ClassName: 'AVP.MainWindow' WindowName: '(null)'
Modifies settings of Windows Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] 'NoFolderOptions' = '00000001'
Modifies file system :
Creates the following files:
- <SYSTEM32>\sysrotdmo.sys
- <SYSTEM32>\сtfmon.exe
- <SYSTEM32>\рsаdоr18.dll
- <SYSTEM32>\DETER177\lsass.exe
- <SYSTEM32>\АHTОMSYS19.exe
- <SYSTEM32>\schmvi
- <SYSTEM32>\DETER177\svсhоst.exe
- <SYSTEM32>\DETER177\smss.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\sysrotdmo.sys
- <SYSTEM32>\сtfmon.exe
- <SYSTEM32>\рsаdоr18.dll
- <SYSTEM32>\DETER177\lsass.exe
- <SYSTEM32>\DETER177\smss.exe
- <SYSTEM32>\schmvi
- <SYSTEM32>\АHTОMSYS19.exe
- <SYSTEM32>\DETER177\svсhоst.exe
Deletes the following files:
- %TEMP%\~DF1ADA.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '???????? ???????'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: '(null)' WindowName: '????????? ???????'
- ClassName: '#32770' WindowName: '???????? ???? ??? ???????? ?? ????????????'
- ClassName: '(null)' WindowName: 'Agnitum Outpost Firewall - configuration.cfg'
- ClassName: '(null)' WindowName: '??????????? ?????? : ??????????'
- ClassName: '(null)' WindowName: '??????????? ?????? : ????????'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: '(null)' WindowName: '????? ??????? : ???????'
- ClassName: '(null)' WindowName: '??????????? ?????? : ???????'
- ClassName: '(null)' WindowName: '???????? ????????? : ???????'
- ClassName: '#32770' WindowName: 'NOD32 - ??????????????'
- ClassName: '#32770' WindowName: '?pe???pe??e??e'
- ClassName: '#32770' WindowName: '?????? NOD32 ?? ?????????? - [??????? ???????????? ????]'
- ClassName: '#32770' WindowName: 'NOD32 2.5 Control Center'
- ClassName: '#32770' WindowName: '?????? NOD32 ?? ?????????? - [??????? ?????? ?????????? - ????????]'
- ClassName: '(null)' WindowName: '???????? ???????????? NOD32 - [Untitled]'
- ClassName: '#32770' WindowName: '????????? ??????????'
- ClassName: '#32770' WindowName: '????????? ????????? ? ?????????? ?????????'
- ClassName: '#32770' WindowName: '????????'
- ClassName: '#32770' WindowName: '????????? ??????????? Personal'
- ClassName: '#32770' WindowName: '0% - ??????????? ????????...'
