Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msp' = '<Full path to file>'
Modifies file system:
Creates the following files:
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\3310a4fa6cb9c60504498d7eea986fc2_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\Microsoft\Protect\CREDHIST
- <Current directory>\CV.ini
Deletes the following files:
- <Current directory>\CV.ini
Substitutes the following files:
- <Current directory>\CV.ini
Network activity:
Connects to:
- '10#.#1.15.173':10004
- 'we###l.uy.to':80
UDP:
- DNS ASK we###l.uy.to
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'ЗЗёБ 7ЖчДї ЕдіКёХЖ®'
- ClassName: '' WindowName: '???? 7???? ????????'
- ClassName: '' WindowName: 'іЭё¶єн 7ЖчДї'
- ClassName: '' WindowName: 'іЭё¶єн ґєЖчДї'
- ClassName: '' WindowName: 'іЭё¶єн ·Оїм№ЩµПАМ'
- ClassName: '' WindowName: '???? ??????????'
- ClassName: '' WindowName: 'ЗЗёБ ЗПАМ·Оїм'
- ClassName: '' WindowName: 'ЗЗёБ ·Оїм№ЩµПАМ'
- ClassName: '' WindowName: 'ЗЗёБ ИЗ¶у'
- ClassName: '' WindowName: '???? ????'
- ClassName: '' WindowName: 'А®°ФАУ'
- ClassName: '' WindowName: '??????'
- ClassName: '' WindowName: '№ЩµПАМ'
- ClassName: '' WindowName: 'Vanilla'
- ClassName: '' WindowName: 'GameClient V1.0'
- ClassName: '' WindowName: 'іЭё¶єн ИЗ¶у'
- ClassName: '' WindowName: 'іЭё¶єн ЗПАМ·Оїм'
- ClassName: '' WindowName: '°ФАУ Е¬¶уАМѕрЖ®'
- ClassName: '' WindowName: '№ЩµПАМ°ФАУ'
- ClassName: '' WindowName: '??????????'
- ClassName: '' WindowName: '???? ????????'
- ClassName: '' WindowName: '?????? ??????????'
- ClassName: '' WindowName: 'ЗПАМ·Оїм2'
- ClassName: '' WindowName: 'ЗС°ФАУ ·Оїм№ЩµПАМ'
- ClassName: '' WindowName: 'ЗС°ФАУ ЖДЖјИЗ¶у'
- ClassName: '' WindowName: '?????? ????????'
- ClassName: '' WindowName: 'ЗС°ФАУ 7ЖчДї'
- ClassName: '' WindowName: '?????? 7????'
- ClassName: '' WindowName: '?????? ?????????? ????'
- ClassName: '' WindowName: '????????2'
- ClassName: '' WindowName: 'ЗС°ФАУ ¶уЅєєЈ°ЎЅє ЖчДї'
- ClassName: '' WindowName: '???? 5????'
- ClassName: '' WindowName: 'ЗЗёБ 7ЖчДї'
- ClassName: '' WindowName: 'ЗЗёБ 5ЖчДї'
- ClassName: '' WindowName: 'ЗЗёБ ґєЖчДї'
- ClassName: '' WindowName: '???? ??????'
- ClassName: '' WindowName: 'ЗС°ФАУ ёВЖчДї'
- ClassName: '' WindowName: '?????? ??????'
- ClassName: '' WindowName: '?????? ????'
- ClassName: '' WindowName: '???? 7????'
- ClassName: '' WindowName: 'ЗС°ФАУ ЗС°'
