Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\bitbf19.tmp
- %WINDIR%\tasks\visual.job
- <SYSTEM32>\tasks\visual
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\extrac32.exe
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\59f6a1af.png
- %APPDATA%\icq-profile\bitb4e6.tmp
- %TEMP%\4691062a.lnk
Sets the 'hidden' attribute to the following files
- %APPDATA%\icq-profile\bitb4e6.tmp
- %APPDATA%\microsoft\windows\start menu\programs\startup\bitbf19.tmp
Moves the following files
- from %APPDATA%\icq-profile\bitb4e6.tmp to %APPDATA%\icq-profile\visual.exe
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK i.##gur.com
- DNS ASK microsoft.com
- DNS ASK ai####obblelulu.tw
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\extrac32.exe'
- '%WINDIR%\syswow64\cmd.exe'
