Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'jootete' = '%HOMEPATH%\Start Menu\Programs\pooMOON.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'jootete' = '%HOMEPATH%\Start Menu\Programs\pooMOON.exe'
Malicious functions:
Injects code into
the following user processes:
- pooMOON.exe
Modifies file system:
Creates the following files:
- %HOMEPATH%\Start Menu\Programs\pooMOON.exe:ZONE.identifier
- %HOMEPATH%\Start Menu\Programs\.Identifier
- <Full path to file>:ZONE.identifier
- %HOMEPATH%\Start Menu\Programs\pooMOON.exe
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\.Identifier
Network activity:
Connects to:
- 'we#####ou1.no-ip.biz':6063
- '18#.17.1.97':6063
UDP:
- DNS ASK we#####ou1.no-ip.biz
Miscellaneous:
Creates and executes the following:
- '%HOMEPATH%\Start Menu\Programs\pooMOON.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c echo [zoneTransfer]ZoneID = 2 > "%HOMEPATH%\Start Menu\Programs\pooMOON.exe":ZONE.identifier & exit
- '<SYSTEM32>\cmd.exe' /c echo [zoneTransfer]ZoneID = 2 > "<Full path to file>":ZONE.identifier & exit
