Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{BB2316B4-09D4-7EFD-8A78-0B7877E71194}] 'stubpath' = '<SYSTEM32>\vmtoolsd.exe'
Malicious functions:
Searches for windows to
detect analytical utilities:
- ClassName: 'FileMonClass', WindowName: ''
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system:
Creates the following files:
- <SYSTEM32>\vmtoolsd.exe
Deletes the following files:
- <Full path to file>
Network activity:
Connects to:
- 'is###jeju.com':80
TCP:
HTTP GET requests:
- http://www.is###jeju.com/rss/rss.txt via is###jeju.com
UDP:
- DNS ASK www.is###jeju.com
Miscellaneous:
Searches for the following windows:
- ClassName: '18467-41' WindowName: ''
Executes the following:
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components\{BB2316B4-09D4-7EFD-8A78-0B7877E71194}" /f
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> > nul
