Piattaforma:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 Valutazione del rischio complessivo:
 Potenziale dannoso: :
 Potenziale di distribuzione: :
 Reported Infection:
 Informazioni esposizione: :
Basso
Medio
Alto
Critico

  • Tipo di minaccia informatica:
    Backdoor

  • Distruttivo?:
    No

  • Crittografato?:
     

  • In the wild::
    Sì

  Panoramica e descrizione

Canale infezione: Descargado de Internet, Eliminado por otro tipo de malware, Se propaga vía unidades extraíbles


  Dettagli tecnici

Residente in memoria: Sì
Carica distruttiva: Compromises system security, Steals information

Instalación

Crea las siguientes copias de sí mismo en el sistema afectado:

  • %Program Files%\Common Files\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe
  • %Program Files%\Common Files\Identities.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe

(Nota: %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

)

Otras modificaciones del sistema

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_CLASSES_ROOT\CLSID\{CLSID}

HKEY_CLASSES_ROOT\CLSID\{CLSID}\
0BAC02C7

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\TaskManager

HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB

HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1

HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CS1

HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CW1

HKEY_CURRENT_USER\Software\Win7zip

HKEY_LOCAL_MACHINE\SOFTWARE\Win7zip

Agrega las siguientes entradas de registro:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\TaskManager
Task Service ID = "{hex value}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
Flash Update Client = "%Program Files%\Common Files\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Flash Update Client = "%Program Files%\Common Files\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Flash Update Client = "%Program Files%\Common Files\Flash Update Client.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
2500 = "3"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\2
2500 = "3"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
2500 = "3"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\4
2500 = "3"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
{application}
Debugger = "{random characters}.exe"

HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
GLA = "{hex value}"

HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
LCT = "{hex value}"

HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
LSF = "{hex value}"

HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CG1
CF03 = "{hex value}"

HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CS1
SO3 = "{hex value}"

HKEY_CLASSES_ROOT\CLSID\{CLSID}\
1BE003AB\CW1
1480 = "{hex value}"

HKEY_CURRENT_USER\Software\Win7zip
Uuid = "{hex value}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Device Installer = "{malware path and file name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Device Installer = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Device Installer = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Win7zip
Uuid = "{hex value}"

HKEY_CURRENT_USER\Software\Win7zip
Uuid = "{hex value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
nvtrays = "%Program Files%\Common Files\Identities.{2227A280-3AEA-1069-A2DE-08002B30309D}\{random file name}.exe"

Modifica las siguientes entradas de registro:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\
Java Update\Policy
EnableJavaUpdate = "0"

(Note: The default value data of the said registry entry is "1".)