Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\ole32_.dll with <SYSTEM32>\ole32.dll
Modifies file system:
Creates the following files:
- <SYSTEM32>\ole32.dll.new
- <SYSTEM32>\dllcache\ole32.dll.new
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\ole32.dll
Moves the following system files:
- from <SYSTEM32>\ole32.dll to <SYSTEM32>\ole32_.dll
Substitutes the following files:
- <SYSTEM32>\dllcache\ole32.dll.new
Network activity:
Connects to:
- '74.##5.232.51':443
UDP:
- DNS ASK sites.google.com
Miscellaneous:
Executes the following:
- '<SYSTEM32>\cmd.exe' /C takeown /f <SYSTEM32>\ole32.dll
- '<SYSTEM32>\cmd.exe' /C icacls <SYSTEM32>\ole32.dll /grant Administrators:F /T
