Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Msn' = '%WINDIR%\msnmsgsr.exe'
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\avg.exe
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\avenger.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\cmd.exe' /c "avenger.exe /nogui C:\systemm.txt"
Modifies file system:
Creates the following files:
- <SYSTEM32>\avenger.jpg
- C:\systemm.txt
- %WINDIR%\msnmsgsr.exe
Moves the following files:
- from <SYSTEM32>\avenger.jpg to <SYSTEM32>\avenger.exe
Network activity:
Connects to:
- '64.##1.42.69':80
- 'localhost':1039
TCP:
HTTP GET requests:
- http://64.##1.42.69/up/upload/avenger.exe
HTTP POST requests:
- http://64.##1.42.69/venda/index.php
Miscellaneous:
Searches for the following windows:
- ClassName: 'TabWindowClass' WindowName: ''
- ClassName: 'Internet Explorer_Server' WindowName: ''
- ClassName: 'Shell DocObject View' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
