Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{90EAB2F7-BBE6-4265-AF34-010DB8F155A1}' = '%PROGRAMDATA%\scrvs\scrvs'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '{EBB76DB8-FCB0-44EF-B541-DF828297E0EB}' = '%PROGRAMDATA%\scrvs\scrvs'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %PROGRAMDATA%\scrvs\scrvs
Network activity
Connects to
- 'rs###.mooo.com':9889
UDP
- DNS ASK rs###.mooo.com
Miscellaneous
Executes the following
- '<SYSTEM32>\svchost.exe'
- '%WINDIR%\explorer.exe'
