Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<Virus name>' = '%WINDIR%\<Virus name>.exe'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\<Virus name>.exe'
- '%WINDIR%\<Virus name>.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %WINDIR%\<Virus name>.exe
- %WINDIR%\decaptcher.dll
- <SYSTEM32>\mswinsck.ocx
Network activity:
Connects to:
- '1.###.66.143':80
TCP:
HTTP GET requests:
- 1.###.66.143/svchost.exe
- 1.###.66.143/decaptcher.dll
- 1.###.66.143/mswinsck.ocx
