Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\<File name>.exe
Modifies file system:
Creates the following files:
- %APPDATA%\<File name>.pdb
- %APPDATA%\<File name>.exe
- %TEMP%\Update.txt
- %APPDATA%\<File name>.il
Deletes the following files:
- %APPDATA%\<File name>.pdb
- %APPDATA%\<File name>.il
Substitutes the following files:
- %APPDATA%\<File name>.pdb
- %APPDATA%\<File name>.il
Network activity:
Connects to:
- 'ma##.##ran-argemi.com':587
UDP:
- DNS ASK ma##.##ran-argemi.com
Miscellaneous:
Creates and executes the following:
- '%APPDATA%\<File name>.exe'
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe' "%APPDATA%\<File name>.il"
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "%TEMP%\Update.txt" | cmd"
- '<SYSTEM32>\cmd.exe'
