Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Services' = '%ALLUSERSPROFILE%\Application Data\<File name>.exe'
Modifies file system:
Moves itself:
- from <Full path to file> to %ALLUSERSPROFILE%\Application Data\<File name>.exe
Network activity:
Connects to:
- '19#.#54.229.64':80
TCP:
HTTP POST requests:
- http://19#.#54.229.64/panel_buh_admin/includes/tasks.php
