Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Audio Driver' = '"%APPDATA%\audiohd.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows-Network Component' = '"<SYSTEM32>\WUDHost.exe"'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- %APPDATA%\audiohd.exe
- <SYSTEM32>\wudhost.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\audiohd.exe
- <SYSTEM32>\wudhost.exe
Network activity
Connects to
- 'yo###ebsite.com':80
TCP
HTTP POST requests
- http://yo###ebsite.com/gate.php
UDP
- DNS ASK yo###ebsite.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\audiohd.exe'
- '<SYSTEM32>\wudhost.exe'
- '%APPDATA%\audiohd.exe' ' (with hidden window)
- '<SYSTEM32>\wudhost.exe' ' (with hidden window)
