Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'USBSERV' = '%APPDATA%\usbserv.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\rpcsrv.log
- %APPDATA%\usbserv.exe
Network activity:
Connects to:
- '88.##8.240.123':80
TCP:
HTTP GET requests:
- http://88.##8.240.123/modules/docs/index1.php?ve################################
- http://88.##8.240.123/modules/docs/upload/calc.exe
