Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\DNF7.exe] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\DNF7.exe] 'ImagePath' = '%WINDIR%\fugugonglue.exe'
Creates the following services
- 'DNF7.exe' %WINDIR%\fugugonglue.exe
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\fugugonglue.exe
Modifies file system
Creates the following files
- %WINDIR%\fugugonglue.exe
Deletes itself.
Network activity
Connects to
- '11#.#2.139.169':81
TCP
Other
- '11#.#2.139.169':81
Miscellaneous
Creates and executes the following
- '%WINDIR%\fugugonglue.exe'
