Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\rddwzj06] 'Start' = '00000000'
Malicious functions:
Executes the following:
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\xpiztx.dll"
Modifies file system :
Creates the following files:
- <SYSTEM32>\rddwzj06.dll
- <DRIVERS>\rddwzj06.sys
- %TEMP%\tmp1.CAB
- %TEMP%\tmp2.CAB
Deletes the following files:
- %TEMP%\tmp2.CAB
- %TEMP%\tmp1.CAB
Moves the following files:
- from <SYSTEM32>\rddwzj06.dll to <SYSTEM32>\xpiztx.dll
