Technical Information
Malicious functions:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe'
- '<SYSTEM32>\ping.exe' 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 && move C:\8klpw8klpw\8klpw.vbs "%HOMEPATH%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8klpw.vbs"
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Modifies file system:
Creates the following files:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\.Identifier
- C:\8klpw8klpw\8klpw.exe
- C:\8klpw8klpw\8klpw.vbs
Sets the 'hidden' attribute to the following files:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\.Identifier
Network activity:
UDP:
- DNS ASK sy####.duckdns.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WINHELP' WindowName: ''
