Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Updater' = 'C:\Microsoft Windows Update\Microsoft Windows Updater.exe'
Malicious functions:
Creates and executes the following:
- C:\Microsoft Windows Update\Microsoft Windows Updater.exe
Modifies file system :
Creates the following files:
- C:\Microsoft Windows Update\win_TT2011-11-14_extra.h
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\fin[1].txt
- C:\Microsoft Windows Update\kokochanel7194.ini
- %TEMP%\aut1.tmp
- C:\Microsoft Windows Update\Microsoft Windows Updater.exe
Deletes the following files:
- %TEMP%\aut1.tmp
Deletes itself.
Network activity:
Connects to:
- 'ft####so.free.fr':21
- 'go#####dkamas.free.fr':80
TCP:
HTTP GET requests:
- go#####dkamas.free.fr/fin.txt
UDP:
- DNS ASK ft####so.free.fr
- DNS ASK go#####dkamas.free.fr
- '<Private IP address>':1037
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
