Short description
Win32/Wigon.NI is a trojan that installs
Win32/Wigon.KQ
malware.
Installation
The trojan copies itself in the following locations:
- %windir%system32reader_s.exe
- %userprofile%reader_s.exe
The files are then executed.
In order to be executed on every system start, the modifies the following Registry keys:
- [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion
Run]
"reader_s" = %windir%system32reader_s.exe"
- [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion
Run]
"reader_s" = "%userprofile%reader_s.exe"
Other information
The trojan creates and runs a new thread with its own program code within the following processes:
