Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ur2yogop.ss2' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'nzdvtb35.f0q' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'coegx30v.j4c' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'x1mqtj2o.xqp' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ovv241ac.hxz' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'vvxgsfzj.0bu' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'tepaj5xh.yms' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'hyzw20ib.zth' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'xapxqyq0.tht' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'u2sp42bs.3au' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'aqjxyetd.hqq' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'lpa3dh5w.hue' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'uptp5chu.bk2' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '4nuw05nl.gik' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 's1bllpsh.ex0' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'evpmkt32.pcb' = '<LS_APPDATA>\ExpIorer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'tmsf5vew.lhy' = '<LS_APPDATA>\ExpIorer.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\private(my film, my music,birthday,khososi,arooosi,my picture,exe file.dlll.jpeg.jpg.exe
- <Drive name for removable media>:\autorun.inf
Modifies file system :
Creates the following files:
- <LS_APPDATA>\FONT.ttf
- <LS_APPDATA>\ExpIorer.exe
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\autorun.inf
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
