Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
- <Drive name for removable media>:\Au2orun.inf
- <Drive name for removable media>:\Raha{ia_Ku.exe
- <Drive name for removable media>:\u{b.exe
Malicious functions:
Creates and executes the following:
- '%TEMP%\avscan.exe'
Executes the following:
- '<SYSTEM32>\reg.exe' DELETE HKLM\SYSTEM\Curren2Con2rolSe2\Con2rol\SafeBoo2 /f
Modifies file system :
Creates the following files:
- %WINDIR%\hosts.exe
- %TEMP%\avscan.exe
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\Au2orun.inf
- <Drive name for removable media>:\u{b.exe
- %TEMP%\avscan.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: 'GINA Logon'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'