Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{C401D108-ABC0-0200-F000-87AD4F14FF}' = '"%APPDATA%\{C401D108-ABC0-0200-F000-87AD4F14FF}\jkpqvwchin.exe"'
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\microsoft[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\forumpost[1].htm
- %APPDATA%\{C401D108-ABC0-0200-F000-87AD4F14FF}\UK9MS7KC.dat
- %APPDATA%\{C401D108-ABC0-0200-F000-87AD4F14FF}\6ld6NH64.dat
- %APPDATA%\{C401D108-ABC0-0200-F000-87AD4F14FF}\4phRbvVV
Deletes itself.
Network activity:
Connects to:
- 'de###xnvis.site':80
- '20#.#6.232.182':80
TCP:
HTTP GET requests:
- http://microsoft.com/ via 20#.#6.232.182
HTTP POST requests:
- http://de###xnvis.site/wordpress/forumpost.php
UDP:
- DNS ASK de###xnvis.site
- DNS ASK microsoft.com
