Technical Information
Malicious functions:
Creates and executes the following:
- '%APPDATA%\ok.exe'
Executes the following:
- '<SYSTEM32>\reg.exe' import <LS_APPDATA>\vljvydvkc.reg
- '<SYSTEM32>\reg.exe' import <LS_APPDATA>\puhgma.reg
Injects code into
the following user processes:
- ok.exe
Modifies file system:
Creates the following files:
- %APPDATA%\5217.png
- %APPDATA%\23202.png
- <LS_APPDATA>\vljvydvkc.reg
- <LS_APPDATA>\puhgma.reg
- %APPDATA%\ok.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\ok.exe
Network activity:
Connects to:
- 'sm##.live.com':587
UDP:
- DNS ASK sm##.live.com
