Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'RthDv' = '"<Full path to file>"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\<File name>.lnk
Modifies file system:
Creates the following files:
- <Current directory>\uid.txt
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\<File name>.lnk
Network activity:
Connects to:
- '1.###ikos42.in':80
TCP:
HTTP GET requests:
- http://1.###ikos42.in/index.php?ui#############################
UDP:
- DNS ASK 1.###ikos42.in
Miscellaneous:
Executes the following:
- '<SYSTEM32>\cmd.exe' /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v RthDv /t REG_SZ /d "\"<Full path to file>\"" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v RthDv /t REG_SZ /d "\"<Full path to file>\"" /f
