Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\winnetupdate
Malicious functions
Patches code
in NTDLL dll
- fyitt.exe process, ntdll.dll module
Network activity
Connects to
- 'ap#.##pstore.name':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?be##############
Other
- 'ap#.##pstore.name':443
UDP
- DNS ASK ap#.##pstore.name
Miscellaneous
Executes the following
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
