Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Update' = '"%CommonProgramFiles%\M-49-6940-2955-59400\rjmynangs.exe"'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Update' = '"%CommonProgramFiles%\M-49-6940-2955-59400\rjmynangs.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe] 'Debugger' = 'lgzo_.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe] 'Debugger' = 'ohpx_.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe] 'Debugger' = 'dbla_.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\housecalllauncher.exe] 'Debugger' = 'dlnq_.exe'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\SSDPSRV] 'Start' = '00000002'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Injects code into
the following system processes:
- <SYSTEM32>\wuauclt.exe
- <SYSTEM32>\ctfmon.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- iexplore.exe process, wininet.dll module
Searches for registry branches where third party applications store passwords
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander]
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Deluxe]
Searches for windows to
detect analytical utilities:
- ClassName: 'SmartSniff', WindowName: ''
- ClassName: 'TCPViewClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2500' = '00000003'
Modifies file system
Moves itself
- from <Full path to file> to %CommonProgramFiles%\m-49-6940-2955-59400\rjmynangs.exe
Network activity
UDP
- DNS ASK microsoft.com
- DNS ASK sr#1.su
Miscellaneous
Executes the following
- '<SYSTEM32>\wuauclt.exe'
