Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AMD Athlon 17.34.553' = '%CommonProgramFiles%\Media\winlogon.exe'
Malicious functions:
Creates and executes the following:
- %CommonProgramFiles%\Media\winlogon.exe
Executes the following:
- <SYSTEM32>\attrib.exe +h +s /d /s "%CommonProgramFiles%\Media"
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\Media\file.txt
- %CommonProgramFiles%\Media\winlogon.exe
