Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Audio Driver' = '"<SYSTEM32>\audiohd.exe"'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- <SYSTEM32>\audiohd.exe
- %CommonProgramFiles%\wudhost.exe
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\audiohd.exe
- %CommonProgramFiles%\wudhost.exe
Network activity
UDP
- DNS ASK fl###eoads.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\audiohd.exe'
- '%CommonProgramFiles%\wudhost.exe'
- '<SYSTEM32>\audiohd.exe' ' (with hidden window)
- '%CommonProgramFiles%\wudhost.exe' ' (with hidden window)
