Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\srvmopop] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\MOpop\srvmopop.exe' i
- '%APPDATA%\MOpop\mopopws.exe'
- '%APPDATA%\MOpop\mopopset.exe'
- '%APPDATA%\MOpop\mopop.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\MOpop\mopopws.exe
- %APPDATA%\MOpop\srvmopop.exe
- %TEMP%\nss2.tmp\System.dll
- %APPDATA%\MOpop\mopop.bat
- %APPDATA%\MOpop\uninst.exe
- %APPDATA%\MOpop\mopopset.exe
- %APPDATA%\MOpop\mopop.exe
- %APPDATA%\MOpop\mopopunset.exe
- %APPDATA%\MOpop\mopopm.exe
- %APPDATA%\MOpop\mopopup.exe
Deletes the following files:
- %TEMP%\nss2.tmp\System.dll
Deletes itself.
Network activity:
Connects to:
- 'www.mi####penpop.com':80
TCP:
HTTP GET requests:
- www.mi####penpop.com/xml/mupope.txt
- www.mi####penpop.com/xml/mopop4.html
- www.mi####penpop.com/com/tact.php?ma########################
- www.mi####penpop.com/com/tinst.php?ma###############################
- www.mi####penpop.com/app/mopop.bat
UDP:
- DNS ASK www.mi####penpop.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
