Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\334fa474da84010659a26ee6ab499ef8.exe
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ALLUSERSPROFILE%\Lightshot.exe' = '%ALLUSERSPROFILE%\Lightshot.exe:*:...
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%ALLUSERSPROFILE%\Lightshot.exe" "Lightshot.exe" ENABLE
- '%ALLUSERSPROFILE%\Lightshot.exe'
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Lightshot.exe
Network activity:
Connects to:
- 'dj####ey.hopto.org':1177
UDP:
- DNS ASK dj####ey.hopto.org
