Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ISU] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\isu\isus.exe'
- '%PROGRAM_FILES%\isu\isus.exe' "-i" "isu_red" "isu_red03"
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\isu\isu.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\isu[1].exe
- %HOMEPATH%\DesktopАОЕНіЭ ї¬°б °ьё®АЪ
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\ismupdate[1].php
- %APPDATA%\Microsoft\Internet Explorer\Quick LaunchАОЕНіЭ ї¬°б °ьё®АЪ
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ismupdate[1].php
- %TEMP%\nsg2.tmp\SimpleSC.dll
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\Processes.dll
- %PROGRAM_FILES%\isu\Uninstall.exe
- %PROGRAM_FILES%\isu\isus.exe
Deletes the following files:
- %TEMP%\nsg2.tmp\System.dll
- %TEMP%\nsg2.tmp\SimpleSC.dll
- %TEMP%\nsg2.tmp\Processes.dll
Network activity:
Connects to:
- 'vo######te.windowsnas.co.kr':80
TCP:
HTTP GET requests:
- vo######te.windowsnas.co.kr/ism/isu.exe
- vo######te.windowsnas.co.kr/ismupdate.php
UDP:
- DNS ASK vo######te.windowsnas.co.kr
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
