Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinTcpAutoProxySvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinTcpAutoProxySvc] 'ImagePath' = '%ALLUSERSPROFILE%\Application Data\WinTcpAutoProxySvc\sheft.exe'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\WinTcpAutoProxySvc\sheft.exe
Deletes the following files:
- <Full path to file>
Network activity:
Connects to:
- 'xm#.#2pool.com':13531
UDP:
- DNS ASK xm#.#2pool.com
Miscellaneous:
Creates and executes the following:
- '%ALLUSERSPROFILE%\Application Data\WinTcpAutoProxySvc\sheft.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c @ping -n 15 127.0.0.1&del <Full path to file> > nul
- '<SYSTEM32>\svchost.exe'
- '<SYSTEM32>\ping.exe' -n 15 127.0.0.1
