Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windowsupdate' = '%APPDATA%\Windowsupdate.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\windowsupdate.lnk
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
the following user processes:
- Windowsupdate.exe
Modifies file system:
Creates the following files:
- %TEMP%\xoFYEKgHD.txt
- %APPDATA%\Windowsupdate.exe
Network activity:
Connects to:
- 'ba#.###youfindme.xyz':333
UDP:
- DNS ASK ba#.###youfindme.xyz
Miscellaneous:
Creates and executes the following:
- '<Full path to file>'
- '%APPDATA%\Windowsupdate.exe'
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe'
