Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\6to4] 'Start' = '00000002'
Substitutes the following executable system files:
- <DRIVERS>\beep.sys with %WINDIR%\Temp\release.tmp
- <SYSTEM32>\dllcache\beep.sys with <SYSTEM32>\dllcache\beep.sys.new
- <DRIVERS>\beep.sys with %TEMP%\release.tmp
- <DRIVERS>\usb20.sys with <DRIVERS>\beep.sys
Malicious functions:
Restores hooked functions in System Service Descriptor Table (SSDT).
Modifies file system :
Creates the following files:
- %TEMP%\196421_res.tmp
- %WINDIR%\Temp\release.tmp
- %TEMP%\195125_res.tmp
- %TEMP%\release.tmp
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\6to4xp.dll
- %TEMP%\195125_xp.tmp
Deletes the following files:
- <DRIVERS>\beep.sys
Moves the following system files:
- from <DRIVERS>\usb20.sys to <DRIVERS>\beep.sys
- from <DRIVERS>\beep.sys to <DRIVERS>\usb20.sys
Moves the following files:
- from %TEMP%\196421_res.tmp to <SYSTEM32>\6to4xp.dll
- from %TEMP%\195125_res.tmp to %TEMP%\195125_xp.tmp
Network activity:
Connects to:
- 'xw####8.vicp.net':7900
UDP:
- DNS ASK xw####8.vicp.net
