Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Winini' = 'C:\Kon.exe'
Modifies file system :
Creates the following files:
- C:\Kon.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\n09230945[1].asp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\checkip.dyndns[1]
Sets the 'hidden' attribute to the following files:
- C:\Kon.exe
- <Full path to virus>
Network activity:
Connects to:
- 'www.my###ker.ugu.pl':80
- 'au######on.whatismyip.com':80
- 'ch####p.dyndns.org':80
TCP:
HTTP GET requests:
- www.my###ker.ugu.pl/wyslij.php?na#######################################################################################################################################################
- www.my###ker.ugu.pl/dane.php?na#######
- ch####p.dyndns.org/
- au######on.whatismyip.com/n09230945.asp
UDP:
- DNS ASK www.my###ker.ugu.pl
- DNS ASK www.go##le.pl
- DNS ASK ch####p.dyndns.org
- DNS ASK au######on.whatismyip.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
