Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '0'
Modifies file system:
Creates the following files:
- %WINDIR%\CKC9ZZe9qS.dll
Network activity:
Connects to:
- 'gu##oxyz.tk':80
- 'localhost':1038
TCP:
HTTP GET requests:
- http://gu##oxyz.tk/guprodownloadz/dllpbfree96454/GuProPBFREE.vmp.dll
UDP:
- DNS ASK gu##oxyz.tk
Miscellaneous:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c COLOR A
- '<SYSTEM32>\cmd.exe' /c CLS
