Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Nopqxyabcd] 'ImagePath' = '%ProgramFiles%\Windows NT\csrss.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Nopqxyabcd] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- %ProgramFiles%\Windows NT\csrss.exe
Moves the following files:
- from <Full path to file> to <SYSTEM32>\166281.bak
Network activity:
Connects to:
- 'localhost':1040
- 'eq###ion.mpc.cn':3957
- 'localhost':1036
- 'mi###gs.mpc.cn':580
UDP:
- DNS ASK Eq###ion.mpc.cn
- DNS ASK mi###gs.mpc.cn
Miscellaneous:
Creates and executes the following:
- '%ProgramFiles%\Windows NT\csrss.exe'
