Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\microsoftmail
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dllhost.exe
Modifies file system
Creates the following files
- %ProgramFiles%\windows nt\arphadump64.exe
- %ProgramFiles%\windows nt\arphadump64.dll
- %ProgramFiles%\windows nt\arphadump64.bin
Deletes itself.
Network activity
Connects to
- 'ba##u.com':80
- '16.##2.75.133':80
- '16.##2.75.133':8080
UDP
- DNS ASK ba##u.com
- 'localhost':65237
- 'localhost':63381
- 'localhost':63383
Miscellaneous
Executes the following
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\svchost.exe' -k netsvcs' (with hidden window)
