Technical Information
To ensure autorun and distribution
Infects the following executable files
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe
- %CommonProgramFiles(x86)%\microsoft shared\help\dexplore.exe
- %ProgramFiles(x86)%\winamp\winamp.exe
Creates the following files on removable media
- <Drive name for removable media>:\1.taz
- <Drive name for removable media>:\zpharaoh.exe
- <Drive name for removable media>:\rcx50f.tmp
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- C:\documents and settings\tazebama.dll
- C:\documents and settings\hook.dl_
- C:\documents and settings\tazebama.dl_
- D:\1.taz
- D:\zpharaoh.exe
- D:\rcx52f.tmp
- C:\1.taz
- C:\zpharaoh.exe
- C:\rcx54f.tmp
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\zpharaoh.exe
- <Drive name for removable media>:\autorun.inf
- D:\zpharaoh.exe
- D:\autorun.inf
- C:\zpharaoh.exe
- C:\autorun.inf
Moves the following files
- from D:\rcx52f.tmp to D:\zpharaoh.exe
- from D:\1.taz to D:\autorun.inf
- from C:\rcx54f.tmp to C:\zpharaoh.exe
- from C:\1.taz to C:\autorun.inf
Network activity
Connects to
- '11#.#45.229.85':80
Miscellaneous
Creates and executes the following
- 'C:\documents and settings\tazebama.dl_'
- 'C:\documents and settings\tazebama.dl_' ' (with hidden window)
