Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\fatsvc.org.url
Malicious functions:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe'
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
Modifies file system:
Creates the following files:
- %APPDATA%\23EF5514-3059-436F-A4A7-4CEFAAB20EB1\run.dat
- %ALLUSERSPROFILE%\Application Data\Windows\fatsvc.exe
Network activity:
Connects to:
- 'or#####angue.no-ip.org':49689
UDP:
- DNS ASK or#####angue.no-ip.org
