Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\msupdate] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\msupdate] 'ImagePath' = '<SYSTEM32>\servm32.exe'
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Restores hooked functions in System Service Descriptor Table (SSDT).
Hides the following processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\users[1].htm
- <SYSTEM32>\servm32.exe
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\users[1].htm
Deletes itself.
Network activity:
Connects to:
- 'mu###an.info':80
TCP:
HTTP POST requests:
- mu###an.info/includes/users.php
UDP:
- DNS ASK mu###an.info
