Technical Information
To ensure autorun and distribution:
Infects the following executable system files:
- <SYSTEM32>\ctfmon.exe
Malicious functions:
Creates and executes the following:
- %TEMP%\Temp\wuauclt2.exe
Executes the following:
- <SYSTEM32>\cmd.exe /c ""%TEMP%\Temp\wuauclt2.exe.bat" "
- <SYSTEM32>\cmd.exe /c ""%TEMP%\Temp\ТвМм¶аЧАГжЧЁјТ.exe.bat" "
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\ctfmon.exe
Modifies file system :
Creates the following files:
- %TEMP%\Temp\wuauclt2.exe.bat
- <SYSTEM32>\ctfmon..exe
- %TEMP%\Temp\ТвМм¶аЧАГжЧЁјТ.exe.bat
- %TEMP%\Temp\ТвМм¶аЧАГжЧЁјТ.exe
- %TEMP%\Temp\wuauclt2.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\ctfmon..exe
Network activity:
UDP:
- DNS ASK �I###
- DNS ASK ns.###3-domain.com
- 'ns.###3-domain.com':8000
- '<Private IP address>':1036
