Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Adobe Updater' = '<SYSTEM32>\updater.exe'
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '<SYSTEM32>\updater.exe "%1" %*'
- [<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '<SYSTEM32>\updater.exe "%1" %*'
Creates the following files on removable media:
- <Drive name for removable media>:\autoprompt.exe
- <Drive name for removable media>:\autorun.inf
Modifies file system:
Creates the following files:
- <SYSTEM32>\updater.exe
- <DRIVERS>\etc\HOSTS.MVP
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\autoprompt.exe
- <Drive name for removable media>:\autorun.inf
Modifies the HOSTS file.
Network activity:
Connects to:
- '13#.#49.8.88':4444
- '90.##0.153.96':4444
- '16#.#3.84.181':4444
- '23#.#97.40.168':4444
- '62.##0.226.253':4444
- '69.##8.238.88':4444
- '14#.#41.170.175':4444
- '21#.#.124.162':4444
- '41.##7.57.247':4444
- '11#.#7.11.234':4444
- '18#.#0.197.66':4444
- '74.#3.72.49':4444
- '83.##8.84.138':4444
- '16#.#08.28.58':4444
- '73.##.130.172':4444
- '17#.#44.38.146':4444
- '18#.#79.50.237':4444
- '7.###.236.69':4444
- '14#.#74.111.52':4444
- '15#.#10.124.141':4444
- '16#.#47.136.229':4444
- '24#.#00.67.61':4444
- '25#.#35.79.149':4444
- '3.##.90.238':4444
- '81.##6.21.70':4444
- '22#.#2.151.53':4444
- '90.##5.96.226':4444
- '21#.#86.200.101':4444
- '25#.#4.199.87':4444
- '15#.#.105.69':4444
- '42.##.235.52':4444
- '18#.#4.108.36':4444
- '19#.#19.120.125':4444
- '19#.#55.132.213':4444
- '21.##8.64.47':4444
- '31.##5.76.135':4444
- '23#.#1.147.17':4444
- '54.##8.81.102':4444
- '12#.#8.35.89':4444
- '20#.#1.220.174':4444
- '20.##4.176.161':4444
- '22#.#9.163.144':4444
- '82.#4.143.7':4444
- '18#.#18.52.167':4444
- '19#.#53.62.3':4444
- '19#.#90.74.92':4444
- '22.##3.6.177':4444
- '92.##.216.164':4444
- '17#.#21.147.249':4444
- '17#.#.159.84':4444
- '1.###.91.169':4444
- '9.##7.103.4':4444
- '18.##.113.93':4444
- '94.##5.45.178':4444
- '16#.#06.1.167':4444
- '10#.#64.120.81':4444
- '24#.#9.187.252':4444
- '23#.#5.175.232':4444
- '60.##.107.64':4444
- '67.##.119.152':4444
- '28.##.113.23':4444
- '22#.#15.232.193':4444
- '22#.#52.244.28':4444
- '23#.#64.180.165':4444
- '60.##1.186.202':4444
- '13#.#1.142.190':4444
- '20#.#18.73.22':4444
- '21#.#54.86.110':4444
- '40.##7.17.196':4444
- '49.##4.29.31':4444
- '56.##.40.119':4444
- '13#.#32.227.205':4444
- '14#.#18.93.234':4444
- '13#.#27.34.19':4444
- '13#.#87.64.11':4444
- '11#.#6.57.199':4444
- '12#.#2.69.33':4444
- '13#.#17.81.122':4444
- '20#.#0.13.208':4444
- '24.##5.220.194':4444
- '40.##2.213.73':4444
- '48.##.225.161':4444
- '57.##.237.250':4444
- '13#.#4.169.81':4444
- '20#.#37.123.68':4444
- '90.##9.252.53':4444
- '20#.#03.181.191':4444
- '96.##7.108.246':4444
- '25#.#4.159.35':4444
- '15#.#33.200.80':4444
- '11#.#4.29.52':4444
- '77.##0.129.241':4444
- '15#.#4.63.72':4444
- '37.##4.190.56':4444
- '47.##1.202.145':4444
- '56.##6.214.233':4444
- '13#.#30.146.65':4444
- '20#.#54.102.53':4444
- '89.##.229.37':4444
- '16#.#48.161.122':4444
- '23#.#18.117.109':4444
- '59.##.48.194':4444
- '39.##3.76.65':4444
- '13#.#96.4.181':4444
- '14#.#62.46.108':4444
- '38.##0.134.187':4444
- '11#.#.88.173':4444
- '18#.#15.19.7':4444
- '4.##.229.247':4444
- '80.##.161.79':4444
- '22#.#1.36.62':4444
- '22#.#17.46.151':4444
- '23#.#54.58.240':4444
- '60.##7.244.71':4444
- '69.##2.2.160':4444
- '76.##0.14.248':4444
- '20#.#49.190.12':4444
- '72.##.161.149':4444
Miscellaneous:
Searches for the following windows:
- ClassName: 'ConsoleWindowClass' WindowName: ''
