Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'softblow' = '"%PROGRAM_FILES%\softblow\softblow_m.exe"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Network Security Service] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\softblow service] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\softblow\softblow_d.exe'
- '%PROGRAM_FILES%\softblow\softblow_i.exe'
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\softblow\softblow_i.exe
- %PROGRAM_FILES%\softblow\softblow_d.exe
- %PROGRAM_FILES%\softblow\softblow_m.exe
- %PROGRAM_FILES%\softblow\softblow_u.exe
- %PROGRAM_FILES%\softblow\softblow_s.exe
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- <SYSTEM32>\msvcr110.dll
- %WINDIR%\netsecurity.exe
- %WINDIR%\netclient.dll
Deletes the following files:
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
Network activity:
Connects to:
- 'www.se####click.co.kr':80
TCP:
HTTP POST requests:
- www.se####click.co.kr/app/demonConfigUrl
- www.se####click.co.kr/app/appModule
UDP:
- DNS ASK www.se####click.co.kr
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
