Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
Malicious functions:
Creates and executes the following:
- '%WINDIR%\Arurya.exe'
Modifies file system :
Creates the following files:
- %WINDIR%\Arurya.exe
Sets the 'hidden' attribute to the following files:
- %WINDIR%\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
Deletes the following files:
- %WINDIR%\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
Network activity:
Connects to:
- 'pl##van.com':80
- 'ne###ite.com':80
- 'ba##i.com':80
TCP:
HTTP POST requests:
- pl##van.com/1wave.php
- ne###ite.com/1wave.php
- ba##i.com/1wave.php
UDP:
- DNS ASK ne###ite.com
- DNS ASK pl##van.com
- DNS ASK ba##i.com
- DNS ASK if##g.com
- DNS ASK al##aba.com
Miscellaneous:
Searches for the following windows:
- ClassName: '1434452420' WindowName: '1721097947'
- ClassName: '1590631583' WindowName: '231887138'
