Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'smss' = '%APPDATA%\smss.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Creates and executes the following:
- %WINDIR%\Temp\891286.exe (downloaded from the Internet)
- %WINDIR%\Temp\50695.exe (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t reg_dword /d "0" /f
- <SYSTEM32>\netsh.exe firewall set opmode disable
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "smss" /t reg_sz /d "%APPDATA%\smss.exe" /f
Modifies file system :
Creates the following files:
- %WINDIR%\Temp\891286.exe
- %WINDIR%\Temp\50695.exe
- %APPDATA%\readme.txt
Moves itself:
- from <Full path to virus> to %APPDATA%\smss.exe
Network activity:
Connects to:
- 'wi###vc.info':80
TCP:
HTTP GET requests:
- wi###vc.info/show/?up###########################
- wi###vc.info/show/?cl##########################
- wi###vc.info/show/?st###################
UDP:
- DNS ASK wi###vc.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
