Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Media' = '%HOMEPATH%\Templates\ScnCfg.exe'
Malicious functions:
Creates and executes the following:
- '%HOMEPATH%\Templates\ScnCfg.exe'
Modifies file system:
Creates the following files:
- %HOMEPATH%\Start Menu\Chrome.lnk
- %HOMEPATH%\Templates\vsodscpl.dll
- %HOMEPATH%\Templates\ScnCfg.exe
Deletes the following files:
- %HOMEPATH%\Start Menu\Chrome.lnk
Moves itself:
- from <Full path to file> to <Current directory>\~DF6DC0E07310E5D9BC.tmp
Network activity:
Connects to:
- '74.##5.232.51':80
- '74.##5.232.51':8001
TCP:
HTTP GET requests:
- http://www.google.com/7B6A2B7C736D76337F676011000101047000C209000000010000374236413242374337333644373633330043524E4A455546550000000000000000000000000000000000000000000057696E5850205370322078383...
UDP:
- DNS ASK www.google.com
