Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'YDZ1QVAGOJ' = '<Full path to virus>'
Creates or modifies the following files:
- %WINDIR%\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
Modifies file system :
Sets the 'hidden' attribute to the following files:
- %WINDIR%\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
Network activity:
Connects to:
- 'ze###net.com':80
TCP:
HTTP POST requests:
- ze###net.com/borders.php
UDP:
- DNS ASK go##le.cl
- DNS ASK ze###net.com
- DNS ASK ne##ux.com
- DNS ASK so###nic.com
Miscellaneous:
Searches for the following windows:
- ClassName: '1768199177' WindowName: '1536953393'
- ClassName: '302846401' WindowName: '829759175'
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '142113321' WindowName: '1789397713'
- ClassName: '544573893' WindowName: '998623454'
- ClassName: '1857210391' WindowName: '1567525498'
- ClassName: '1246708686' WindowName: '1761283850'
- ClassName: '1111066335' WindowName: '732635744'
- ClassName: '214514740' WindowName: '211910921'
