Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'BORD Agent' = '%WINDIR%\SysWOW64\28463\BORD.exe'
Malicious functions
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %WINDIR%\SysWOW64\28463\BORD.006
on window messages:
- Handler for all processes: %WINDIR%\SysWOW64\28463\BORD.006
- Handler for all processes: %WINDIR%\SysWOW64\28463\BORD.007
Modifies file system
Creates the following files
- %TEMP%\cryptedfile.exe
- %TEMP%\@68d9.tmp
- %TEMP%\@68da.tmp
- %WINDIR%\syswow64\28463\bord.001
- %WINDIR%\syswow64\28463\bord.006
- %WINDIR%\syswow64\28463\bord.007
- %WINDIR%\syswow64\28463\bord.exe
Deletes the following files
- %TEMP%\@68d9.tmp
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'AKLMW'
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
- ClassName: 'IEFrame' WindowName: ''
Creates and executes the following
- '%TEMP%\cryptedfile.exe'
- '%WINDIR%\syswow64\28463\bord.exe'
- '%WINDIR%\syswow64\28463\bord.exe' ' (with hidden window)
