Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\23] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\RemoteAbc.exe'
- '%PROGRAM_FILES%\1.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c %TEMP%\DNKIEO.bat
Modifies file system :
Creates the following files:
- %WINDIR%\RemoteAbc.exe
- %TEMP%\DNKIEO.bat
- %PROGRAM_FILES%\2.gif
- %PROGRAM_FILES%\1.exe
Deletes the following files:
- %PROGRAM_FILES%\1.exe
Network activity:
Connects to:
- '35###.rhelper.com':8000
UDP:
- DNS ASK 35###.rhelper.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
