Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Services' = '%TEMP%\svchost.exe /k'
Malicious functions:
Searches for windows to
detect analytical utilities:
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: '(null)'
detect programs and games:
- ClassName: 'gdkWindowToplevel' WindowName: '(null)'
Modifies file system :
Creates the following files:
- %TEMP%\svchost.exe
Network activity:
Connects to:
- 'co##a.zz.mu':80
- 'localhost':1035
TCP:
HTTP GET requests:
- co##a.zz.mu/test.txt
UDP:
- DNS ASK co##a.zz.mu
Miscellaneous:
Searches for the following windows:
- ClassName: 'TLauncher' WindowName: '(null)'
- ClassName: 'TApplication' WindowName: '(null)'
- ClassName: 'TProcCleanMainForm' WindowName: '(null)'
- ClassName: 'PCHShell Window' WindowName: '(null)'
- ClassName: 'ProcessHacker' WindowName: '(null)'
- ClassName: 'regfromapp' WindowName: '(null)'
- ClassName: '18467-41' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'PROCEXPL' WindowName: '(null)'
- ClassName: 'TCPViewClass' WindowName: '(null)'
- ClassName: 'PortmonClass' WindowName: '(null)'
