Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AIUpdateService' = '"%ProgramFiles%\Microsoft Data\<Virus name>.exe" /reinstall=1'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'amigo' = ''
Malicious functions:
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- opera.exe
Modifies file system:
Creates the following files:
- %TEMP%\Folder_Data_RC_ADDS\xml\op_data.xml
- %TEMP%\Folder_Data_RC_ADDS\js\chr_pref.json
- %TEMP%\Folder_Data_RC_ADDS\xml\task.xml
- %APPDATA%\9659AA5949
- %TEMP%\Folder_Data_RC_ADDS\xml\op_wid.xml
- %TEMP%\Folder_Data_RC_ADDS\adds\addon.xpi
- %ProgramFiles%\Microsoft Data\<Virus name>.exe
- %TEMP%\Folder_Data_RC_ADDS\adds\addon.crx
- %TEMP%\Folder_Data_RC_ADDS\js\ff_set.json
- %TEMP%\Folder_Data_RC_ADDS\adds\addon.oex
Network activity:
Connects to:
- 'vb###wqhqq.ru':80
TCP:
HTTP GET requests:
- http://vb###wqhqq.ru/installLog.php?sc###########################################################################################################################################################...
UDP:
- DNS ASK vb###wqhqq.ru
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
