Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Security Center
Creates and executes the following:
- '<Full path to file>'
Executes the following:
- '<SYSTEM32>\net.exe' stop SharedAccess
- '<SYSTEM32>\svchost.exe'
- '<SYSTEM32>\sc.exe' config wscsvc start= disabled
- '<SYSTEM32>\net1.exe' stop wscsvc
- '<SYSTEM32>\net1.exe' stop SharedAccess
- '<SYSTEM32>\net.exe' stop wscsvc
- '<SYSTEM32>\cmd.exe' /c sc config SharedAccess start= disabled
- '<SYSTEM32>\cmd.exe' /c net stop SharedAccess
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\sc.exe' config SharedAccess start= disabled
- '<SYSTEM32>\cmd.exe' /c sc config wscsvc start= disabled
- '<SYSTEM32>\cmd.exe' /c net stop wscsvc
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- %WINDIR%\explorer.exe
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\gate[1].htm
Deletes the following files:
- <Full path to file>
Network activity:
Connects to:
- 'ro###dibi.com':80
TCP:
HTTP POST requests:
- http://ro###dibi.com/h/gate.php
UDP:
- DNS ASK ro###dibi.com
