Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\services\syshost32] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\Installer\{B5FFA751-2DC1-C6E3-7DD0-37333EB79DD1}\syshost.exe' /service
Executes the following:
- '<SYSTEM32>\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=in new action=allow enable=yes profile=any
Modifies file system :
Creates the following files:
- %WINDIR%\Temp\95caeab8-8b62-6126-1b32-38c3f7f8105e.tmp
- %WINDIR%\Installer\{B5FFA751-2DC1-C6E3-7DD0-37333EB79DD1}\syshost.exe
Moves itself:
- from <Full path to virus> to %TEMP%\2c502d6e.tmp
Deletes itself.
Network activity:
UDP:
- DNS ASK dn#.##ftncsi.com
- DNS ASK microsoft.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
