Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\<Auxiliary name>] 'Start' = '00000001'
Malicious functions:
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Modifies file system :
Creates the following files:
- <Current directory>\<Virus name>.log
- <Current directory>\<Virus name>\SSL\Salus CA.pvk
- <Current directory>\<Virus name>\SSL\Salus CA.cer
Deletes the following files:
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
Network activity:
Connects to:
- 'lo#.##ta-url.com':80
TCP:
HTTP GET requests:
- lo#.##ta-url.com/salus/log/settings.json
UDP:
- DNS ASK lo#.##ta-url.com
Miscellaneous:
Adds a root certificate
