Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinApp' = '%APPDATA%\Windows\WinApp.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Update' = '<SYSTEM32>\helpar windos\winapp.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Update' = '<SYSTEM32>\helpar windos\winapp.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Creates and executes the following:
- '<SYSTEM32>\helpar windos\winapp.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\Imminent\Logs\02-12-2017
- %APPDATA%\Windows\WinApp.exe
- <SYSTEM32>\helpar windos\winapp.exe
Network activity:
Connects to:
- 'cr###.viewdns.net':9000
UDP:
- DNS ASK cr###.viewdns.net
