Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Lmnopxyab] 'ImagePath' = '%ProgramFiles%\Windows NT\csrss.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Lmnopxyab] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%ProgramFiles%\Windows NT\csrss.exe'
Modifies file system:
Creates the following files:
- %ProgramFiles%\Windows NT\csrss.exe
Moves itself:
- from <Full path to file> to <SYSTEM32>\192515.bak
Network activity:
Connects to:
- 'localhost':1042
- 'eq###ion.mpc.cn':3957
- 'localhost':1038
- 'mi###gs.mpc.cn':580
UDP:
- DNS ASK Eq###ion.mpc.cn
- DNS ASK mi###gs.mpc.cn
