Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Supdater] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Supdater\Supdater.exe' = '%PROGRAM_FILES%\Supdater\Supdater.exe:*:Enabled:Supdater'
Creates and executes the following:
- '%PROGRAM_FILES%\Supdater\Supdater.exe'
- '%PROGRAM_FILES%\Supdater\Supdater.exe' --install
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\sc.exe' failure "Supdater" reset= 2 actions= restart/10000
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\Supdater\Supdater.exe" Supdater ENABLE
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Supdater\Supdater.InstallLog
- %PROGRAM_FILES%\Supdater\Supdater.InstallState
- %PROGRAM_FILES%\Supdater\Supdater.exe
- %PROGRAM_FILES%\Supdater\Uninstall.exe
Deletes the following files:
- %PROGRAM_FILES%\Supdater\Supdater.InstallState
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- %PROGRAM_FILES%\Supdater\Supdater.InstallLog
Network activity:
Connects to:
- 'su###ter.com':443
- 'wp#d':80
TCP:
HTTP GET requests:
- wp#d/wpad.dat
UDP:
- DNS ASK su###ter.com
- DNS ASK wp#d
