Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe' = '%WINDI...
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\installutil.exe" "installutil.exe" ENABLE
Network activity:
Connects to:
- 'sn####bay.ddns.net':36
UDP:
- DNS ASK sn####bay.ddns.net
Miscellaneous:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe' /logtoconsole=false /logfile= /u "<Full path to file>"
