Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'win32' = '%APPDATA%\Microsoft\Windows\win32\AmirReza.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\Microsoft\Windows\win32\AmirReza.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Microsoft\Windows\win32\AmirReza.exe
Network activity:
Connects to:
- 'vi######0.persiangig.com':80
- 'ni##uzz.com':5222
- 'wp#d':80
- 'me######di.persiangig.com':80
TCP:
HTTP GET requests:
- vi######0.persiangig.com/update.txt
- me######di.persiangig.com/amirreza-ids.htm
- wp#d/wpad.dat
- me######di.persiangig.com/amirreza-host.htm
UDP:
- DNS ASK _x#######ent._tcp.nimbuzz.com
- DNS ASK ni##uzz.com
- DNS ASK vi######0.persiangig.com
- DNS ASK wp#d
- DNS ASK me######di.persiangig.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
