Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'windows update' = '%WINDIR%\Microsoft\csrss.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'windows update' = '%WINDIR%\Microsoft\csrss.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{O50H0078-M2H3-W756-6PDW-FBBY1546MQUK}] 'StubPath' = '%WINDIR%\Microsoft\csrss.exe restart'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{O50H0078-M2H3-W756-6PDW-FBBY1546MQUK}] 'StubPath' = '%WINDIR%\Microsoft\csrss.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %WINDIR%\microsoft\csrss.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\microsoft\csrss.exe
Network activity
Connects to
- 're######res1209.ddns.net':8000
- 're######res1209.ddns.net':9000
UDP
- DNS ASK re######res1209.ddns.net
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
