Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'مستودعReg' = '"<Full path to file>"'
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Modifies file system:
Creates the following files:
- %APPDATA%\مستودعfile\مستودعAdobe.EXE
- %APPDATA%\23EF5514-3059-436F-A4A7-4CEFAAB20EB1\run.dat
Deletes the following files:
- %APPDATA%\مستودعfile\مستودعAdobe.EXE
Substitutes the following files:
- %APPDATA%\مستودعfile\مستودعAdobe.EXE
Network activity:
Connects to:
- 'wp#d':80
- 'cr#.##obalsign.net':80
- 'ba####n45.pdns.cz':4003
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://cr#.##obalsign.net/Root.crl
- http://cr#.##obalsign.net/primobject.crl
- http://cr#.##obalsign.net/ObjectSign.crl
UDP:
- DNS ASK wp#d
- DNS ASK cr#.##obalsign.net
- DNS ASK ba####n45.pdns.cz
- DNS ASK ba##zam.xyz
Miscellaneous:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe' /logtoconsole=false /logfile= /u "<Full path to file>"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe'
