Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F580}] 'StubPath' = '%WINDIR%\csrss.exe'
Malicious functions:
Creates and executes the following:
- %WINDIR%\csrss.exe
Modifies file system :
Creates the following files:
- %WINDIR%\csrss.exe
Network activity:
Connects to:
- 'mo####5.3322.org':555
UDP:
- DNS ASK mo####5.3322.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
