Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
Modifies file system :
Moves itself:
- from <Full path to virus> to %WINDIR%\1043942993\acrotray.exe
Deletes itself.
Network activity:
Connects to:
- 'un###lapi.com':80
TCP:
HTTP POST requests:
- un###lapi.com/panel/gate.php
UDP:
- DNS ASK un###lapi.com
- DNS ASK up####.microsoft.com
Miscellaneous:
Searches for the following windows:
- ClassName: '#32770' WindowName: 'Windows Task Manager'
