Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'FileSystemChecking' = '"<LS_APPDATA>\bbbx.exe"'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe "<LS_APPDATA>\bbbx.exe"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\Micrоsоft Оffice.exe
Creates the following files on removable media:
- <Drive name for removable media>:\%USERNAME%.eXe
Malicious functions:
Creates and executes the following:
- <LS_APPDATA>\bbbx.exe /X
- <LS_APPDATA>\BigBadBagger.exe
- %HOMEPATH%\My Documents\temp.exe /BBB "<Virus name>"
Executes the following:
- <SYSTEM32>\notepad.exe "<Virus name>.txt"
Searches for windows to
bypass different anti-viruses:
- ClassName: 'AVP.AlertDialog' WindowName: ''
Modifies file system :
Creates the following files:
- <Current directory>\<Virus name>.txt
- <LS_APPDATA>\bbby.exe
- C:\%USERNAME%.eXe
- <LS_APPDATA>\bbbx.exe
- %HOMEPATH%\My Documents\temp.exe
- <LS_APPDATA>\GDIPFОNTCАCHЕV_2.dat
- <LS_APPDATA>\BigBadBagger.exe
Sets the 'hidden' attribute to the following files:
- <LS_APPDATA>\bbby.exe
- <LS_APPDATA>\bbbx.exe
- <LS_APPDATA>\GDIPFОNTCАCHЕV_2.dat
Deletes the following files:
- <LS_APPDATA>\bbby.exe
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'tBBB' WindowName: 'BigBadBagX'
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'tBBB' WindowName: 'BigBadBagY'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'PCHShell Window' WindowName: '?????????????? ???????'
