Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\Oxy.job
Malicious functions:
Creates and executes the following:
- '%TEMP%\<Virus name>.exe'
Searches for registry branches where third party applications store passwords:
- [<HKCU>\Software\Microsoft\MessengerService]
Modifies file system :
Creates the following files:
- %APPDATA%\Oxy\config.xml
- %APPDATA%\Oxy\Updater.exe
- %TEMP%\htmlayout.dll
- %TEMP%\<Virus name>.exe
- %TEMP%\<Virus name>_002892.log
Network activity:
Connects to:
- 'www.ma###soth.com':80
TCP:
HTTP GET requests:
- http://www.ma###soth.com/api/firstscreenshown/84461843006448f9ab2e66f9d4bb6165/1366000001
- http://www.ma###soth.com/api/keywordexecute/84461843006448f9ab2e66f9d4bb6165/1366000001/<Auxiliary name>
- http://www.ma###soth.com/api/cc
UDP:
- DNS ASK www.ma###soth.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
