Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender' = '<DRIVERS>\winlogon.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- C:\documento\ms.doc
Substitutes the HOSTS file.
Network activity
TCP
HTTP GET requests
- http://www.bo###r.com.pl/cache/banner/Online/configuraciones
- http://www.ma###owteam.com/blog/banner/configuraciones
UDP
- DNS ASK co####dadjumper.org
- DNS ASK lo###ania.net
- DNS ASK bo###r.com.pl
- DNS ASK ma###owteam.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
