Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\.Net CLR] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\.Net CLR] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
- [<HKLM>\SYSTEM\ControlSet001\Services\.Net CLR\Parameters] 'ServiceDll' = '<SYSTEM32>\Server.dll'
Modifies file system:
Creates the following files:
- %TEMP%\128187_res.tmp
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\Server.dll
Deletes the following files:
- <Full path to file>
Moves the following files:
- from %TEMP%\128187_res.tmp to <SYSTEM32>\Server.dll
Network activity:
Connects to:
- 'localhost':1990
Miscellaneous:
Executes the following:
- '<SYSTEM32>\svchost.exe' -k netsvcs
