Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- <Current directory>\tt.jpg
- %TEMP%\install.zip
- C:\$loading\word\enginedp.bat
- C:\$loading\word\sun.exe
- C:\$loading\word\xssdll.txt
Sets the 'hidden' attribute to the following files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\10833751234567931\....\temporaryfile
Network activity
TCP
- '43.##6.38.106':1527
Miscellaneous
Searches for the following windows
- ClassName: 'CTXOPConntion_Class' WindowName: ''
Creates and executes the following
- 'C:\$loading\word\sun.exe'
- '%WINDIR%\syswow64\cmd.exe' /c C:\$loading\Word\EngineDP.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c C:\$loading\Word\EngineDP.bat
