Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\SMS] 'ImagePath' = '%TEMP%\stemp.tmp'
Modifies file system:
Creates the following files:
- <Current directory>\<File name>.ver
- %TEMP%\stemp.tmp
Deletes the following files:
- %TEMP%\.xX1.tmp
Moves the following files:
- from %TEMP%\stemp.tmp to %TEMP%\.xX1.tmp
Network activity:
Connects to:
- 'du##ns.tk':80
- 'localhost':1036
TCP:
HTTP GET requests:
- http://du##ns.tk/mu.xtr
UDP:
- DNS ASK du##ns.tk
Miscellaneous:
Searches for the following windows:
- ClassName: 'Qt5QWindowIcon' WindowName: ''
