Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '<Current directory>\cnotedadhrsvh.exe'
Malicious functions:
Creates and executes the following:
- '<Current directory>\cnotedadhrsvh.exe'
Modifies file system :
Creates the following files:
- <Current directory>\c1.dat
- <Current directory>\c2.dat
- <Current directory>\cnotedadhrsvh.exe
- <Current directory>\cpath.ini
- <Current directory>\cnoteded.exe
Sets the 'hidden' attribute to the following files:
- <Current directory>\c2.dat
- <Current directory>\cpath.ini
- <Current directory>\cnotedadhrsvh.exe
- <Current directory>\c1.dat
Deletes itself.
Network activity:
Connects to:
- 'i3.##etuku.com':80
TCP:
HTTP GET requests:
- http://i3.##etuku.com/801db876cdcaa96c.png
- http://i3.##etuku.com/d95480b8cd6b954b.png
UDP:
- DNS ASK i3.##etuku.com
