Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
- <Drive name for removable media>:\Autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Executes the following:
- '<SYSTEM32>\attrib.exe' /pid=3068
- '<SYSTEM32>\attrib.exe' /pid=3092
- '<SYSTEM32>\attrib.exe' /pid=3052
- '<SYSTEM32>\attrib.exe' /pid=3020
- '<SYSTEM32>\attrib.exe' /pid=3028
- '<SYSTEM32>\attrib.exe' /pid=3236
- '<SYSTEM32>\attrib.exe' /pid=3248
- '<SYSTEM32>\attrib.exe' /pid=3856
- '<SYSTEM32>\attrib.exe' /pid=3408
- '<SYSTEM32>\attrib.exe' /pid=3424
- '<SYSTEM32>\attrib.exe' /pid=1148
- '<SYSTEM32>\attrib.exe' +r +a +s +h x:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h y:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h w:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h u:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h v:\ghandil.exe
- '<SYSTEM32>\attrib.exe' /pid=2932
- '<SYSTEM32>\attrib.exe' /pid=2956
- '<SYSTEM32>\attrib.exe' /pid=2920
- '<SYSTEM32>\attrib.exe' +r +a +s +h z:\ghandil.exe
- '<SYSTEM32>\attrib.exe' /pid=1728
- '<SYSTEM32>\attrib.exe' /pid=3268
- '<SYSTEM32>\attrib.exe' /pid=3656
- '<SYSTEM32>\attrib.exe' /pid=4056
- '<SYSTEM32>\attrib.exe' /pid=3760
- '<SYSTEM32>\attrib.exe' /pid=3172
- '<SYSTEM32>\attrib.exe' /pid=3852
- '<SYSTEM32>\attrib.exe' /pid=2468
- '<SYSTEM32>\attrib.exe' /pid=2492
- '<SYSTEM32>\attrib.exe' /pid=2452
- '<SYSTEM32>\attrib.exe' /pid=292
- '<SYSTEM32>\attrib.exe' /pid=288
- '<SYSTEM32>\attrib.exe' /pid=3140
- '<SYSTEM32>\attrib.exe' /pid=3984
- '<SYSTEM32>\attrib.exe' /pid=4024
- '<SYSTEM32>\attrib.exe' /pid=3888
- '<SYSTEM32>\attrib.exe' /pid=3324
- '<SYSTEM32>\attrib.exe' /pid=3352
- '<SYSTEM32>\attrib.exe' /pid=2996
- '<SYSTEM32>\attrib.exe' /pid=3116
- '<SYSTEM32>\attrib.exe' /pid=2696
- '<SYSTEM32>\attrib.exe' /pid=4032
- '<SYSTEM32>\attrib.exe' /pid=4048
- '<SYSTEM32>\attrib.exe' +r +a +s +h t:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h p:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h q:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h o:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h m:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h n:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h u:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h v:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h t:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h r:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h s:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h l:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h e:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h f:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h <Drive name for removable media>:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h b:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h c:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h j:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h k:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h i:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h g:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h h:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h w:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h m:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h n:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h l:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h j:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h k:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h r:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h s:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h q:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h o:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h p:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h i:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h b:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h c:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h z:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h x:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h y:\Autorun.inf
- '<SYSTEM32>\attrib.exe' +r +a +s +h g:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h h:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h f:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h <Drive name for removable media>:\ghandil.exe
- '<SYSTEM32>\attrib.exe' +r +a +s +h e:\ghandil.exe
Injects code into
the following system processes:
- <SYSTEM32>\attrib.exe
Modifies file system :
Creates the following files:
- C:\Autorun.inf
- <SYSTEM32>\Autorun.inf
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\Autorun.inf
- C:\Autorun.inf
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'System Configuration Utility'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'