Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{0F23386A-901E-E17F-8484-6E9995430F42}] 'StubPath' = '<SYSTEM32>:msconfg.exe'
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- <SYSTEM32>:msconfg.exe
Deletes itself.
Network activity:
Connects to:
- '1j.#ww1.biz':80
- '1j.#ww1.biz':443
- '1j.#ww1.biz':53
UDP:
- DNS ASK 1j.#ww1.biz
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
