Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\pp.vbs
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\aspnet_compiler.exe
Modifies file system
Creates the following files
- C:\users\public\nod.ps1
Network activity
TCP
- 'wi#####.publicvm.com':5552
UDP
- DNS ASK wi#####.publicvm.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windo 1 -noexit -exec bypass -file "C:\Users\Public\nod.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windo 1 -noexit -exec bypass -file "C:\Users\Public\nod.ps1"' (with hidden window)
Executes the following
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\pp.vbs"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\aspnet_compiler.exe'
