Technical Information
To ensure autorun and distribution:
Modifies master boot record (MBR).
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Moves itself:
- from <Full path to virus> to <Current directory>\ymsee.txt
Network activity:
Connects to:
- 'localhost':1040
- 'pb##.#dvstis.com':88
- 'www.xz##.com':80
- 'im#.#sers.51.la':80
TCP:
HTTP GET requests:
- http://im#.#sers.51.la/18648298.asp
- http://im#.#sers.51.la/18648299.asp
- http://www.xz##.com/upys/hqd1.db
- http://im#.#sers.51.la/18648296.asp
UDP:
- DNS ASK pb##.#dvstis.com
- DNS ASK im#.#sers.51.la
- DNS ASK www.xz##.com
