Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{U511RTRK-AOR6-6BC8-QY7A-07Y0565RHC65}] 'StubPath' = '"<Current directory>\%tasks\.Install\scvhost.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer.exe' = '<Current directory>\%tasks\.Install\scvhost.exe'
Malicious functions:
Creates and executes the following:
- '<Current directory>\%tasks\.Install\scvhost.exe'
- '<Current directory>\%tasks\.Install\scvhost.exe' "<Full path to virus>"
Modifies file system:
Creates the following files:
- <Current directory>\%tasks\.Install\.Identifier
- <Current directory>\%tasks\.Install\scvhost.exe
Sets the 'hidden' attribute to the following files:
- <Current directory>\%tasks\.Install\.Identifier
Deletes the following files:
- <Current directory>\%tasks\.Install\scvhost.exe
Network activity:
Connects to:
- 'so####os.info.ve':4444
- 'so####os.info.ve':1883
- 'so####os.info.ve':3333
- 'localhost':3360
- 'so####os.info.ve':3360
UDP:
- DNS ASK so####os.info.ve
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
