Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\conme.exe 7gh'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\conme.exe'
Modifies file system :
Creates the following files:
- %TEMP%\iakfw.htm
- %WINDIR%\conme.exe
Sets the 'hidden' attribute to the following files:
- <Full path to virus>
Network activity:
Connects to:
- '1.##2sm.com':80
- 'localhost':1039
- '21#.#0.132.196':1106
TCP:
HTTP GET requests:
- http://1.##2sm.com/reques0.asp?ki##############################################
UDP:
- DNS ASK 1.##2sm.com
